diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..7b553fe
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,150 @@
+name: Galleon Pack Template Java CI
+
+on: [push, pull_request]
+
+jobs:
+  # This just runs mvn install like a user would on cloning the repository
+  raw:
+    name: Normal checkout
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/cache@v1
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+      - name: Set up JDK 1.8
+        uses: actions/setup-java@v1
+        with:
+          java-version: 1.8
+
+      - name: Build and Test
+        run: |
+          mvn --version
+          mvn -B install
+
+      - name: Zip Artifacts
+        run: zip -R artifacts.zip 'server.log' 'surefire-reports/*.txt' 'surefire-reports/*.xml'
+
+      - uses: actions/upload-artifact@v1
+        with:
+          # Expressions in the name don't seem to get resolved
+          #name: ci-artifacts-galleon-template-raw-{{job.container.id}}
+          name: ci-artifacts-galleon-template-raw
+          path: artifacts.zip
+
+
+  wildfly-master:
+    # This adjusts the build to use the versions from wildfly master
+    name: Against WildFly master
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout feature pack
+        uses: actions/checkout@v2
+        with:
+          path: main
+
+      - name: Checkout wildfly master
+        uses: actions/checkout@v2
+        with:
+          repository: wildfly/wildfly
+          path: wildfly-master
+
+      - uses: actions/cache@v1
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+      - name: Set up JDK 1.8
+        uses: actions/setup-java@v1
+        with:
+          java-version: 1.8
+
+      - name: Initialise Feature Pack version
+        # Needed to download everything from Maven to not pollute the output in the next steps
+        run:
+          mvn help:evaluate -Dexpression=project.version -pl .
+        working-directory: main
+
+      - name: Set FEATURE_PACK_VERSION
+        run: |
+          TMP="$(mvn help:evaluate -Dexpression=project.version -pl . | grep -v '^\[')"
+          echo "FEATURE_PACK_VERSION=${TMP}" >> $GITHUB_ENV
+          echo "TMP ${TMP}"
+        working-directory: main
+
+      - name: Initialise WildFly versions
+        # Needed to download everything from Maven to not pollute the output in the next steps
+        run: |
+          mvn -B help:evaluate -Dexpression=project.version -pl .
+          mvn -B help:evaluate -Dexpression=version.org.wildfly.core -pl .
+        working-directory: wildfly-master
+
+      - name: Set WILDFLY_VERSION
+        run: |
+          TMP="$(mvn help:evaluate -Dexpression=project.version -pl . | grep -v '^\[')"
+          echo "WILDFLY_VERSION=${TMP}" >> $GITHUB_ENV
+        working-directory: wildfly-master
+
+      - name: Set WILDFLY_CORE_VERSION
+        run: |
+          TMP="$(mvn help:evaluate -Dexpression=version.org.wildfly.core -pl . | grep -v '^\[')"
+          echo "WILDFLY_CORE_VERSION=${TMP}" >> $GITHUB_ENV
+        working-directory: wildfly-master
+
+      - name: Show read versions
+        run: |
+          echo "Feature pack version ${FEATURE_PACK_VERSION}"
+          echo "WildFly version ${WILDFLY_VERSION}"
+          echo "WildFly Core version ${WILDFLY_CORE_VERSION}"
+
+      - name: Build WildFly master
+        run: mvn -B install -DskipTests
+        working-directory: wildfly-master
+
+      - name: Build and Test
+        run: |
+          mvn --version
+          mvn -B install -Dversion.org.wildfly=${WILDFLY_VERSION} -Dversion.org.wildfly.core=${WILDFLY_CORE_VERSION}
+        working-directory: main
+
+      - name: Calculate directories to check
+        run: |
+          SRV_DIR="build/target/wildfly-${WILDFLY_VERSION}-template-${FEATURE_PACK_VERSION}"
+          echo "BUILD_SERVER_DIR=${SRV_DIR}" >> $GITHUB_ENV
+          MODULES_BASE="${SRV_DIR}/modules/system/layers/base"
+          echo "UNDERTOW_MODULE_XML=${MODULES_BASE}/org/wildfly/extension/undertow/main/module.xml" >> $GITHUB_ENV
+          echo "CONTROLLER_MODULE_XML=${MODULES_BASE}/org/jboss/as/controller/main/module.xml" >> $GITHUB_ENV
+
+      - name: Check versions
+        run: |
+          if grep -q org.wildfly:wildfly-undertow:${WILDFLY_VERSION} "${UNDERTOW_MODULE_XML}" && grep -q org.wildfly.core:wildfly-controller:${WILDFLY_CORE_VERSION} "${CONTROLLER_MODULE_XML}"; then
+            echo "Versions in module.xml files as expected!"
+          else
+            echo "Versions in module.xml files not as expected!"
+            "Expected WildFly version '${WILDFLY_VERSION}' and Core version '${WILDFLY_CORE_VERSION}'"
+            echo "Showing contents of ${UNDERTOW_MODULE_XML} and ${CONTROLLER_MODULE_XML}"
+            echo "Exiting..."
+            exit 1
+          fi
+        working-directory: main
+
+      - name: Zip Artifacts
+        run: zip -R artifacts.zip 'server.log' 'surefire-reports/*.txt' 'surefire-reports/*.xml'
+        working-directory: main
+
+      - uses: actions/upload-artifact@v1
+        with:
+          # Expressions in the name don't seem to get resolved
+          #name: ci-artifacts-galleon-template-wf-master-{{job.container.id}}
+          name: ci-artifacts-galleon-template-wf-master
+          path: main/artifacts.zip
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e1613b8
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,65 @@
+# ignore .svn metadata files
+.svn
+# ignore Maven generated target folders
+~
+target
+# ignore downloaded maven
+/tools/maven
+/tools/maven.zip
+/tools/wrapper
+# ignore eclipse files
+.project
+.classpath
+.settings
+.metadata
+.checkstyle
+# ignore m2e annotation processing files
+.factorypath
+# ignore IDEA files
+*.iml
+*.ipr
+*.iws
+.idea
+# ignore NetBeans files
+nbactions.xml
+nb-configuration.xml
+catalog.xml
+#
+maven-ant-tasks.jar
+test-output
+transaction.log
+# ignore VS Code files
+.vscode/
+# vim files
+*.swp
+/.gitk-tmp.*
+atlassian-ide-plugin.xml
+# temp files
+*~
+# maven versions plugin
+pom.xml.versionsBackup
+# hprof dumps
+/*.hprof
+# ignore 'randomly' strewn around logs
+server.log
+# ignore java crashes
+hs_err_pid*.log
+# H2 databases produced by tests
+*.h2.db
+# JBoss transaction generated files
+PutObjectStoreDirHere
+# ignore mvn-rpmbuild repo
+/.m2
+# ignore eap repo
+local-repo-eap
+# ignore the build metadata created by the build metadata plugin
+build.metadata
+#These keep hanging around
+arquillian/*/server.log*
+client/shade/dependency-reduced-pom.xml
+
+#OS X stuff
+.DS_Store
+
+# Zanata files
+**/.zanata-cache/
diff --git a/LICENCE.txt b/LICENCE.txt
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/LICENCE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/README.md b/README.md
index 20bdefb..9832f77 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,311 @@
-# elytron-tls
+![Galleon Pack Template Java CI](https://github.com/wildfly/wildfly-feature-pack-template/workflows/Galleon%20Pack%20Template%20Java%20CI/badge.svg)
+
+# Elytron TLS Subsystem
+A lightweight TLS/SSL subsystem based on the Elytron project.
+
+We will start off by showing you how to run the example, and dig more into the details of how this
+feature pack is structured so that you can adapt it to provide your functionality as a Galleon
+feature pack.
+
+The master branch targets the current wildfly version under development. When WildFly is released there
+is a tag for the relevant WildFly version:
+* [WildFly 18](https://github.com/wildfly/wildfly-feature-pack-template/tree/wildfly-18)
+* [WildFly 19](https://github.com/wildfly/wildfly-feature-pack-template/tree/wildfly-19)
+* [WildFly 20](https://github.com/wildfly/wildfly-feature-pack-template/tree/wildfly-20)
+* [WildFly 23](https://github.com/wildfly/wildfly-feature-pack-template/tree/wildfly-23)
+
+## Building the Galleon feature pack
+
+To build the Galleon feature pack, simply clone this repository, and on your command line go to the
+checkout folder and run
+```
+mvn install
+```
+and it will build everything, and run the testsuite. An example patched server
+will be created in the `build/target/` directory. We will explore how to use
+Galleon CLI to provision a server from the command line later on.
+
+## Running the example application
+
+The example application lives in the 
+[`example/`](example)
+directory. It is a trivial application exposing a 
+[REST endpoint](example/src/main/java/org/wildfly/extension/feature/pack/template/example/JaxRsResource.java) 
+which is injected with an instance of the bean we have a `@Produces` for in the subsystem's dependency 
+[`dependency/`](dependency)
+folder. 
+The `@ExampleQualifier` Qualifier is also defined in the `dependency/` folder. 
+
+Start the server by running
+```
+./build/target/wildfly-<WildFly Version>-template-<Template Version>/bin/standalone.sh
+```
+ 
+In another terminal window run:
+```
+mvn package wildfly:deploy -pl example
+```
+and see the application gets deployed.
+
+Then go to http://localhost:8080/example/greeting and see the hello message. It just says 'Welcome' in a different
+language each time you refresh the page.
+
+## Project structure
+
+The [root POM](pom.xml) contains the
+WildFly versions we wrote this template Galleon feature pack for at the top of the `<properties>` section. 
+However, newer versions of WildFly are generally backwards compatible (unless you really dug into some server
+internals) so you can install it into a later version of WildFly. 
+
+It adds an additional layer called `template-layer`, which contains a new
+subsystem called `template-subsystem`. This subsystem is implemented in the 
+`org.wildfly.extension.template-subsystem` module which in turn has a dependency
+on the `org.wildfly.template-dependency` module. The latter module basically
+makes a CDI `@Produces` available. The code for these modules are in the
+[`subsystem/`](subsystem)
+and [`dependency/`](dependency)
+Maven sub-modules, and the subsystem's 
+[`DependencyProcessor`](subsystem/src/main/java/org/wildfly/extension/feature/pack/template/subsystem/deployment/DependencyProcessor.java)
+makes the `org.wildfly.template-dependency` module available to the deployment. 
+
+The [`feature-pack/`](feature-pack)
+Maven sub-module defines the Galleon feature pack. 
+It defines the JBoss modules for the subsystem and dependency under the [`feature-pack/src/main/resources/modules/system/layers/base`](feature-pack/src/main/resources/modules/system/layers/base)
+directory. Both of these modules are brought in by the layer implemented by this Galleon Feature Pack.
+
+The layer is defined in [`feature-pack/src/main/resources/layers/standalone/template-layer/layer-spec.xml`](feature-pack/src/main/resources/layers/standalone/template-layer/layer-spec.xml).
+As we are making a CDI `@Produces` method available we need CDI, so our layer has a dependency on
+the `cdi` layer.
+
+Our layer also has a dependency on the `template-subsystem` feature group which is defined in
+[`feature-pack/src/main/resources/feature_groups/template-subsystem.xml`](feature-pack/src/main/resources/feature_groups/template-subsystem.xml)
+which contains our `<feature spec="subsystem.template-subsystem"/>`.
+Note that the 'spec' value is of the format:
+```
+subsystem.<subsystem-name>
+```  
+In our case the name of the subsystem is `template-subsystem`, so the full name is `subsystem.template-subsystem`. 
+When provisioning the server this results in an operation to add the subsystem:
+```
+/subsystem=template-subsystem:add()
+``` 
+Our subsystem is empty, as it has no attributes or child resources. 
+
+As an example, __if__ the subsystem had an attribute called
+`test` which should be set to `10`, we would write its feature spec as 
+```
+<feature spec="subsystem.template-subsystem">
+    <param name="test" value="10"/>
+</feature
+```
+which would result in the following __not working__ (since our subsystem has no attributes) 
+subsystem add operation:
+```
+/subsystem=template-subsystem:add(test=10)
+``` 
+
+
+
+
+[`feature-pack/wildfly-feature-pack-build.xml`](feature-pack/wildfly-feature-pack-build.xml)
+takes care of adding the subsystem to the configuration under `<extensions>` near the end of the file
+where we add a dependency on the `org.wildfly.extension.template-subsystem` module we have defined for our subsystem.
+Galleon is smart enough to look at the dependencies of this module to bring in modules it in turn depends on. 
+So in this case it will e.g. bring in the `org.wildfly.template-dependency` module (or 'package' in Galleon terminology)
+too. 
+
+It also configures the feature packs that we depend upon. Note
+that we have a direct dependency on `org.wildfly:wildfly-galleon-pack`. This in turn has a dependency on
+`org.wildfly:wildfly-ee-galleon-pack` which is why the first 
+is listed under `dependencies` and the other under `transitive`. For each feature pack we can configure further
+what we want to include. 
+
+[`feature-pack/pom.xml`](feature-pack/pom.xml)
+has the `wildfly-galleon-maven-plugin` which creates the Galleon Feature Pack. Note that it uses
+the `build-feature-pack` goal which is needed to add a new subsystem along with the mentioned
+entry in `wildfly-feature-pack-build.xml`.
+
+__Note regarding non-configurable feature additions:__
+_If you just want to make some additional modules 
+available in the server you would use the `build-user-feature-pack` instead, and not use a `wildfly-feature-pack-build.xml`. 
+[`wildfly-extras/wildfly-datasources-feature-pack/`](https://github.com/wildfly-extras/wildfly-datasources-feature-pack)
+contains an example of this simpler scenario. To bring in the module containing our functionality in this case you
+need to add it to the `packages` section of the `layer-spec.xml` instead. The name of the package in this case
+is the name of your module (i.e. `org.wildfly.extension.template-subsystem`). As before the `org.wildfly.template-dependency`
+will also be brought in since it is a dependency in the subsystem's `module.xml`._
+
+If adding licenses is important to you, they are set up in the following places:
+* [`feature-pack/src/license/template-feature-pack-licenses.xml`](feature-pack/src/license/template-feature-pack-licenses.xml) - 
+This file lists the dependencies that are installed by the feature pack, and lists the
+license for each.
+* [`feature-pack/src/main/resources/content/docs/licenses/`](feature-pack/src/main/resources/content/docs/licenses) -
+For each license we use, we have a .txt file whose name is the license name in lower case.
+   
+The [`build/pom.xml`](build/pom.xml)
+file uses the `provision` goal of the `galleon-maven-plugin` to provision a server. It essentially
+lists our feature pack and its direct dependency `org.wildfly:wildfly-feature-pack`.
+
+In the `config` section of the plugin we select the layers we want to use. In this case
+we are selecting enough functionality for our sample, by selecting the following layers
+* `jaxrs` - this in turn depends on the `web-server` layer.
+* `management` - this installs the management interfaces, so that the plugin triggered by
+`mvn wildfly:deploy` can deploy the sample application via the management interfaces.
+* `template-layer` - our custom layer which in turn pulls in `cdi`
+
+The [`testsuite/`](testsuite) 
+folder is the root of a hierarchy of Maven modules to run the testsuite against a patched
+WildFly server. This root module takes some of the `plumbing` from the main
+WildFly testsuite.
+
+It's child module [`testsuite/integration/`](testsuite/integration)
+sets up some of the common dependencies for all tests, and allows you to have one or more
+child modules.
+
+In this case we have one child module: [`testsuite/integration/subsystem/`](testsuite/integration/subsystem).
+Its [`pom`](testsuite/integration/subsystem/pom.xml)
+uses the the `provision` goal of the `galleon-maven-plugin` to provision a server as above, although in
+this case we are not using the `jaxrs` layer since the test does not use JAX-RS. Instead we use the following
+layers:
+* `web-server` - Installs the undertow subsystem and its dependencies
+* `jmx-remoting` - Needed by Arquillian 
+* `template-layer` - our custom layer which in turn pulls in `cdi`
+
+### Adding more dependencies
+If you want your layer to bring in more content, which is not a module, you would add it under the 
+[`feature-pack/src/main/resources/packages`](feature-pack/src/main/resources/packages)
+directory. The name of the directory is what becomes the package name. You then reference the name of
+that package from the `<packages>` section of your `layer-spec.xml`.
+
+For modules, it depends on if you are adding a feature or not.
+
+As we have seen a feature in this context is a WildFly Extension which provides a subsystem which in turn has configuration.
+To provision these we use the `build-feature-pack` goal of the plugin which looks for the `wildfly-feature-pack-build.xml`
+where the extension module is added.  Modules depended on by the extension module 
+are pulled in too. If you have some additional modules to add, you can add those in the
+`registerAdditionalRuntimePackages()` method of [`TemplateSubsystemDefinition`](subsystem/src/main/java/org/wildfly/extension/feature/pack/template/subsystem/TemplateSubsystemDefinition.java).
+
+If your addition is not a feature, we use the `build-user-feature-pack` goal of the plugin. This does not use  
+`wildfly-feature-pack-build.xml`, and since it does not define a subsystem there is no
+`TemplateSubsystemDefinition`. In this case we add the required modules to 
+the `<packages>` section of your `layer-spec.xml`.
+
+## Adapting for your feature
+To adapt this for your own usage, you should of course rename things for your subsystem.
+I have attempted to add TODO comments in the relevant places as hints for what to change. Note
+that quite a lot will need changing!
+
+## Installing the feature pack into a WildFly installation with Galleon CLI
+
+The server we have seen from the `build/` folder is handy for running our example, but it is not really
+how we install Galleon feature packs in real life.
+
+To do this we first provision  WildFly itself using Galleon CLI. This is an alternative
+to the more common way of downloading and extracting the zip from the
+[WildFly downloads page](https://www.wildfly.org/downloads).
+
+You first need to [download Galleon](https://github.com/wildfly/galleon/releases)
+and unzip it somewhere. In my case I just have it in my `~/Downloads` folder, and I am using 
+Galleon 4.2.8.
+
+As we will see below there are two main ways to use Gallon CLI to provision servers. We can either
+run commands directly in Galleon CLI directly, or we can provide an XML file which contains all the
+information for Galleon CLI to be able to provision a server.
+
+### Using CLI commands directly
+
+This consists of two steps. 
+1) Installing the base WildFly server
+2) Installing our Galleon feature pack with the extra functionality
+
+#### Install main server
+First we run the CLI to install the full WildFly server (the result will be the same as the downloaded
+zip):
+```
+~/Downloads/galleon-4.2.8.Final/bin/galleon.sh install wildfly:current --dir=wildfly
+```
+The `wildfly:current` above tells Galleon to provision the latest version of WildFly which
+at the time of writing is 20.0.0.Final. If you want to install a particular version of 
+WildFly, you can append the version, e.g:
+* `wildfly:current#24.0.0.Beta1-SNAPSHOT` - installs WildFly from locally build maven artifacts 
+
+`--dir` specifies the directory to install the server into. In this case I am using 
+a relative directory called `wildfly`.
+
+If you want to trim the base server that we install (similar to what we did in the testsuite and the 
+example server build), you can specify which layers to install by passing in the `--layers`
+option. To install the same server as we used to run the example above, you can run:
+```
+~/Downloads/galleon-4.2.8.Final/bin/galleon.sh install wildfly:current --dir=wildfly --layers=jaxrs,management
+```
+Note that we did not install our `template-layer` because this is unknown in the main
+WildFly feature pack. We will add it in the next step.
+
+#### Install our layer
+Next we want to install our layer. We do this by running:
+```
+~/Downloads/galleon-4.2.8.Final/bin/galleon.sh install org.wildfly.extras.wildfly-feature-pack-template:template-feature-pack:1.0.0.Alpha-SNAPSHOT --layers=template-layer --dir=wildfly
+``` 
+`org.wildfly.extras.wildfly-feature-pack-template:template-feature-pack:1.0.0.Alpha-SNAPSHOT`
+is the Maven GAV of the Galleon feature pack (i.e. what we have in 
+[`feature-pack/pom.xml`](feature-pack/pom.xml)).
+
+If you went with the trimmed server in the previous step, and you look at
+`wildfly/standalone/configuration/standalone.xml`, you should see that 
+both the `template-subsystem` and the `weld` subsystems were added in this second step.
+Weld is our CDI implementation, and as we have seen CDI is a dependency of our layer, so 
+Galleon pulls it in too!
+
+Now you can start the server by running
+```
+./wildfly/bin/standalone.sh
+``` 
+and in another terminal window you can deploy the example into this server
+```
+mvn package wildfly:deploy -pl example/
+```
+and then go to http://localhost:8080/example/greeting as before.
+
+### Provisioning from an XML file
+
+An alternative to having to type all those CLI commands every time you want to provision a server is
+to use an XML file as input to the Galleon CLI. There is an example in 
+[`provision.xml`](provision.xml)
+
+As you can see, it lists the feature pack(s) we depend on, and our feature pack.
+For each of those we specify the GAV, as in the previous section. We can
+set what to include from each feature pack (Refer to the 
+[Galleon documentation](https://docs.wildfly.org/galleon/) for more in-depth
+explanation of what each setting does). And finally, we say that we want the `cloud-profile` 
+and `template-layer` layers. `cloud-profile` is just to give you another example server,
+we could have used the same layers as in the previous section.
+
+To provision the server, you now simply run the following command:
+```
+~/Downloads/galleon-4.2.5.Final/bin/galleon.sh provision /path/to/provision.xml --dir=wildfly
+``` 
+
+Now you can start the server and run the example as we saw in the previous section.
+
+
+## How do I know which layers to depend on?
+
+There is a list of all our layers defined by WildFly and WildFly Core in our 
+[documentation](https://docs.wildfly.org/18/Admin_Guide.html#wildfly-galleon-layers).
+
+However, if you want to understand better what their dependencies are, you can look at the 
+layer-spec.xml for the various layers in the following locations:
+* WildFly Core's [Core Feature Pack](https://github.com/wildfly/wildfly-core/tree/15.0.1.Final/core-feature-pack/galleon-common/src/main/resources/layers/standalone)
+* WildFly's [Servlet Feature Pack](https://github.com/wildfly/wildfly/tree/23.0.0.Final/servlet-feature-pack/galleon-common/src/main/resources/layers/standalone)
+* WildFly's [EE Feature Pack](https://github.com/wildfly/wildfly/tree/23.0.0.Final/ee-feature-pack/galleon-common/src/main/resources/layers/standalone)
+* WildFly's [MicroProfile Feature Pack](https://github.com/wildfly/wildfly/tree/23.0.0.Final/microprofile/galleon-common/src/main/resources/layers/standalone)
+
+Note that the above links takes you to the versions used for WildFly 20.0.0.Final. If you
+are interested in another/newer WildFly version, adjust the tag name in the URL.
+
+## Debugging failures
+To debug failures in the provisioning of the server of the creation of the Galleon feature pack, it is
+good to run `mvn install -X` which will provide more logging.
+
+If the above doesn't shed any light on your problems, it can also be good to look at the 
+`feature-pack/target/layout/org.wildfly.extras.wildfly-feature-pack-template/template-feature-pack/<version>/`
+directory to see if everything you expect is there.
\ No newline at end of file
diff --git a/build/assembly.xml b/build/assembly.xml
new file mode 100644
index 0000000..450fc69
--- /dev/null
+++ b/build/assembly.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2 http://maven.apache.org/xsd/assembly-1.1.2.xsd">
+    <id>thin-server</id>
+    <formats>
+       <format>zip</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <fileSets>
+        <fileSet>
+            <directory>target</directory>
+            <outputDirectory/>
+            <includes>
+                <include>${server.name}/**</include>
+            </includes>
+        </fileSet>
+    </fileSets>
+</assembly>
diff --git a/build/pom.xml b/build/pom.xml
new file mode 100644
index 0000000..132fb49
--- /dev/null
+++ b/build/pom.xml
@@ -0,0 +1,135 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.wildfly.extras.elytron-tls</groupId>
+        <artifactId>elytron-tls-parent</artifactId>
+        <version>1.0.0.Alpha-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>elytron-tls-build</artifactId>
+    <name>Elytron TLS: Build</name>
+
+    <packaging>pom</packaging>
+
+    <dependencies>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>elytron-tls-galleon-pack</artifactId>
+            <type>pom</type>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>elytron-tls-galleon-pack</artifactId>
+            <type>zip</type>
+            <exclusions>
+                <exclusion>
+                    <groupId>*</groupId>
+                    <artifactId>*</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <finalName>${server.name}</finalName>
+        <plugins>
+            <plugin>
+                <groupId>org.jboss.galleon</groupId>
+                <artifactId>galleon-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>server-provisioning</id>
+                        <goals>
+                            <goal>provision</goal>
+                        </goals>
+                        <phase>prepare-package</phase>
+                        <configuration>
+                            <install-dir>${project.build.directory}/${project.build.finalName}</install-dir>
+                            <record-state>false</record-state>
+                            <log-time>${galleon.log.time}</log-time>
+                            <offline>true</offline>
+                            <feature-packs>
+                                <feature-pack>
+                                    <groupId>org.wildfly</groupId>
+                                    <artifactId>wildfly-galleon-pack</artifactId>
+                                    <version>${version.org.wildfly}</version>
+                                </feature-pack>
+                                <feature-pack>
+                                    <groupId>${project.groupId}</groupId>
+                                    <artifactId>elytron-tls-galleon-pack</artifactId>
+                                    <version>${project.version}</version>
+                                </feature-pack>
+                            </feature-packs>
+                            <configurations>
+                                <config>
+                                    <model>standalone</model>
+                                    <name>standalone.xml</name>
+                                    <layers>
+                                        <!--
+                                            Layers needed to have a base server that makes sense,
+                                            which are not required by this FP's layers
+                                        -->
+                                        <layer>jaxrs</layer>
+                                        <layer>management</layer>
+                                        <!-- Layers from this FP  -->
+                                        <layer>elytron-tls</layer>
+                                    </layers>
+                                </config>
+                            </configurations>
+                            <plugin-options>
+                                <jboss-maven-dist/>
+                                <jboss-fork-embedded>${galleon.fork.embedded}</jboss-fork-embedded>
+                                <optional-packages>passive+</optional-packages>
+                            </plugin-options>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>assemble</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>assembly.xml</descriptor>
+                            </descriptors>
+                            <recompressZippedFiles>true</recompressZippedFiles>
+                            <finalName>${project.build.finalName}</finalName>
+                            <appendAssemblyId>false</appendAssemblyId>
+                            <outputDirectory>${project.build.directory}</outputDirectory>
+                            <workDirectory>${project.build.directory}/assembly/work</workDirectory>
+                            <tarLongFileMode>gnu</tarLongFileMode>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
\ No newline at end of file
diff --git a/checkstyle-suppressions.xml b/checkstyle-suppressions.xml
new file mode 100644
index 0000000..146227d
--- /dev/null
+++ b/checkstyle-suppressions.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!DOCTYPE suppressions PUBLIC
+        "-//Puppy Crawl//DTD Suppressions 1.1//EN"
+        "http://www.puppycrawl.com/dtds/suppressions_1_1.dtd">
+
+<suppressions>
+    <!-- Ignore files pulled down from zanata -->
+    <suppress files="LocalDescriptions_.+\.properties|.*\.i18n_.+\.properties" checks=".*"/>
+</suppressions>
\ No newline at end of file
diff --git a/galleon-pack/pom.xml b/galleon-pack/pom.xml
new file mode 100644
index 0000000..71b6c02
--- /dev/null
+++ b/galleon-pack/pom.xml
@@ -0,0 +1,142 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.wildfly.extras.elytron-tls</groupId>
+        <artifactId>elytron-tls-parent</artifactId>
+        <version>1.0.0.Alpha-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>elytron-tls-galleon-pack</artifactId>
+    <packaging>pom</packaging>
+
+    <name>Elytron TLS: Galleon Pack</name>
+
+    <properties>
+        <license.output.directory>${project.build.directory}/resources/content/docs/licenses</license.output.directory>
+        <license.src.directory>${basedir}/src/license</license.src.directory>
+    </properties>
+
+    <build>
+        <finalName>${server.name}</finalName>
+        <plugins>
+            <plugin>
+                <!-- Feature pack generation is vulnerable to leftover files in the target
+                     folder from previous builds, so always clean even if the clean lifecycle is not invoked -->
+                <artifactId>maven-clean-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>auto-clean</id>
+                        <phase>initialize</phase>
+                        <goals>
+                            <goal>clean</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-resources-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>copy-resources</id>
+                        <phase>process-resources</phase>
+                        <goals>
+                            <goal>copy-resources</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${basedir}/target/resources</outputDirectory>
+                            <resources>
+                                <resource>
+                                    <directory>${basedir}/src/main/resources</directory>
+                                </resource>
+                            </resources>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.wildfly.galleon-plugins</groupId>
+                <artifactId>wildfly-galleon-maven-plugin</artifactId>
+                <version>${version.org.wildfly.galleon-plugins}</version>
+                <executions>
+                    <execution>
+                        <id>elytron-tls-galleon-pack-build</id>
+                        <goals>
+                            <goal>build-feature-pack</goal>
+                        </goals>
+                        <phase>prepare-package</phase>
+                        <configuration>
+                            <fork-embedded>${galleon.fork.embedded}</fork-embedded>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.wildfly.maven.plugins</groupId>
+                <artifactId>licenses-plugin</artifactId>
+                <version>2.3.0.Final</version>
+                <inherited>false</inherited>
+                <executions>
+                    <execution>
+                        <id>update-licenses-xml</id>
+                        <goals>
+                            <goal>insert-versions</goal>
+                        </goals>
+                        <phase>process-resources</phase>
+                        <configuration>
+                            <sortByGroupIdAndArtifactId>true</sortByGroupIdAndArtifactId>
+                            <!-- TODO Give these the same name as you changed the xml to -->
+                            <licensesConfigFile>src/license/elytron-tls-galleon-pack-licenses.xml</licensesConfigFile>
+                            <licensesOutputFile>${license.output.directory}/elytron-tls-galleon-pack-licenses.xml</licensesOutputFile>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+    <dependencies>
+        <!-- Other feature pack dependencies -->
+        <dependency>
+            <groupId>org.wildfly</groupId>
+            <artifactId>wildfly-galleon-pack</artifactId>
+            <version>${version.org.wildfly}</version>
+            <type>zip</type>
+        </dependency>
+
+        <dependency>
+            <groupId>org.wildfly.galleon-plugins</groupId>
+            <artifactId>wildfly-galleon-plugins</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <!-- module and copy artifact dependencies -->
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>elytron-tls-subsystem</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-ssl-common</artifactId>
+        </dependency>
+    </dependencies>
+</project>
\ No newline at end of file
diff --git a/galleon-pack/src/license/elytron-tls-galleon-pack-licenses.xml b/galleon-pack/src/license/elytron-tls-galleon-pack-licenses.xml
new file mode 100644
index 0000000..6b69442
--- /dev/null
+++ b/galleon-pack/src/license/elytron-tls-galleon-pack-licenses.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!--
+TODO: Rename this file to something which matches our Galleon feature pack name
+-->
+<licenseSummary>
+    <dependencies>
+        <!-- Project dependencies -->
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>elytron-tls-subsystem</artifactId>
+            <licenses>
+                <license>
+                    <name>Apache License 2.0</name>
+                    <url>http://www.apache.org/licenses/LICENSE-2.0</url>
+                    <distribution>repo</distribution>
+                </license>
+            </licenses>
+        </dependency>
+
+
+
+        <!-- External dependencies -->
+
+    </dependencies>
+</licenseSummary>
\ No newline at end of file
diff --git a/galleon-pack/src/main/resources/content/docs/licenses/apache license 2.0.txt b/galleon-pack/src/main/resources/content/docs/licenses/apache license 2.0.txt
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/galleon-pack/src/main/resources/content/docs/licenses/apache license 2.0.txt	
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/galleon-pack/src/main/resources/content/docs/licenses/licenses.css b/galleon-pack/src/main/resources/content/docs/licenses/licenses.css
new file mode 100644
index 0000000..566d3c9
--- /dev/null
+++ b/galleon-pack/src/main/resources/content/docs/licenses/licenses.css
@@ -0,0 +1,22 @@
+table {
+    border-collapse: collapse;
+}
+
+table, th, td {
+    border: 1px solid navy;
+}
+
+th {
+    text-align: left;
+    background-color: #BCC6CC;
+
+}
+
+th, td {
+    padding: 2px;
+    text-align: left;
+}
+
+tr:nth-child(even) {
+    background-color: #f2f2f2;
+}
\ No newline at end of file
diff --git a/galleon-pack/src/main/resources/content/docs/licenses/licenses.xsl b/galleon-pack/src/main/resources/content/docs/licenses/licenses.xsl
new file mode 100644
index 0000000..cdd1a0e
--- /dev/null
+++ b/galleon-pack/src/main/resources/content/docs/licenses/licenses.xsl
@@ -0,0 +1,71 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+
+    <xsl:output method="html" encoding="utf-8" standalone="no" media-type="text/html" />
+    <xsl:param name="version"/>
+    <xsl:param name="product.release.name"/>
+    <xsl:variable name="lowercase" select="'abcdefghijklmnopqrstuvwxyz '" />
+    <xsl:variable name="uppercase" select="'ABCDEFGHIJKLMNOPQRSTUVWXYZ!'" />
+    
+    <xsl:template match="/">
+        <html>
+            <head>
+                <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+                <link rel="stylesheet" type="text/css" href="licenses.css"/>
+            </head>
+            <body>
+                <h2><xsl:value-of select="$product.release.name"/><xsl:text> </xsl:text><xsl:value-of select="substring-before($version, '-')"/> - Servlet Feature Pack</h2>
+                <p>The following material has been provided for informational purposes only, and should not be relied upon or construed as a legal opinion or legal advice.</p>
+                <!-- Read matching templates -->
+                <table>
+                    <tr>
+                        <th>Package Group</th>
+                        <th>Package Artifact</th>
+                        <th>Package Version</th>
+                        <th>Remote Licenses</th>
+                        <th>Local Licenses</th>
+                    </tr>
+                    <xsl:for-each select="licenseSummary/dependencies/dependency">
+                        <xsl:sort select="concat(groupId, '.', artifactId)"/>
+                        <tr>
+                            <td><xsl:value-of select="groupId"/></td>
+                            <td><xsl:value-of select="artifactId"/></td>
+                            <td><xsl:value-of select="version"/></td>
+                            <td>
+                                <xsl:for-each select="licenses/license">
+                                    <a href="{./url}"><xsl:value-of select="name"/></a><br/>
+                                </xsl:for-each>
+                            </td>
+                            <td>
+                                <xsl:for-each select="licenses/license">
+                                    <xsl:variable name="filename">
+                                        <xsl:call-template name="remap-local-filename">
+                                            <xsl:with-param name="name" select="name" />
+                                        </xsl:call-template>
+                                    </xsl:variable>
+                                    <a href="{$filename}"><xsl:value-of select="$filename"/></a><br/>
+                                </xsl:for-each>
+                            </td>
+                        </tr>
+                    </xsl:for-each>
+                </table>
+            </body>
+        </html>
+    </xsl:template>
+
+    <xsl:template name="remap-local-filename">
+        <xsl:param name="name"/>
+        <xsl:choose>
+            <xsl:when test="$name = 'GNU General Public License v2.0 only'">
+                <xsl:text>gnu general public license v2.0 only.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = ''">
+                <xsl:text>.html</xsl:text>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:value-of select="concat(translate($name, $uppercase, $lowercase), '.txt')"/>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+</xsl:stylesheet>
diff --git a/galleon-pack/src/main/resources/feature_groups/elytron-tls-undertow-https.xml b/galleon-pack/src/main/resources/feature_groups/elytron-tls-undertow-https.xml
new file mode 100644
index 0000000..712e639
--- /dev/null
+++ b/galleon-pack/src/main/resources/feature_groups/elytron-tls-undertow-https.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2022 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!-- Elytron TLS subsystem configured with Undertow HTTPS listener -->
+<feature-group-spec name="elytron-tls-undertow-https" xmlns="urn:jboss:galleon:feature-group:1.0">
+    <feature-group name="elytron-tls">
+        <feature spec="subsystem.elytron-tls.server-ssl-context">
+            <param name="server-ssl-context" value="elytron-tls-server-context"/>
+        </feature>
+    </feature-group>
+    <feature spec="subsystem.undertow">
+        <feature spec="subsystem.undertow.server">
+            <param name="server" value="default-server" />
+            <feature spec="subsystem.undertow.server.https-listener">
+                <param name="https-listener" value="https"/>
+                <param name="ssl-context" value="elytron-tls-server-context" />
+                <param name="enable-http2" value="true"/>
+                <param name="socket-binding" value="https"/>
+                <unset param="worker"/>
+                <unset param="buffer-pool"/>
+            </feature>
+        </feature>
+    </feature>
+</feature-group-spec>
diff --git a/galleon-pack/src/main/resources/feature_groups/elytron-tls.xml b/galleon-pack/src/main/resources/feature_groups/elytron-tls.xml
new file mode 100644
index 0000000..292c3b6
--- /dev/null
+++ b/galleon-pack/src/main/resources/feature_groups/elytron-tls.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2022 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<feature-group-spec name="elytron-tls" xmlns="urn:jboss:galleon:feature-group:1.0">
+    <feature spec="subsystem.elytron-tls"/>
+</feature-group-spec>
\ No newline at end of file
diff --git a/galleon-pack/src/main/resources/layers/standalone/elytron-tls/layer-spec.xml b/galleon-pack/src/main/resources/layers/standalone/elytron-tls/layer-spec.xml
new file mode 100644
index 0000000..b6a8a5e
--- /dev/null
+++ b/galleon-pack/src/main/resources/layers/standalone/elytron-tls/layer-spec.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2022 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<layer-spec xmlns="urn:jboss:galleon:layer-spec:1.0" name="elytron-tls">
+    <feature-group name="elytron-tls"/>
+</layer-spec>
\ No newline at end of file
diff --git a/galleon-pack/src/main/resources/modules/system/layers/base/org/wildfly/extension/elytron-tls/main/module.xml b/galleon-pack/src/main/resources/modules/system/layers/base/org/wildfly/extension/elytron-tls/main/module.xml
new file mode 100644
index 0000000..16df6f8
--- /dev/null
+++ b/galleon-pack/src/main/resources/modules/system/layers/base/org/wildfly/extension/elytron-tls/main/module.xml
@@ -0,0 +1,36 @@
+<!--
+  ~ Copyright 2022 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<module xmlns="urn:jboss:module:1.9" name="org.wildfly.extension.elytron-tls">
+    <properties>
+        <property name="jboss.api" value="private"/>
+    </properties>
+
+    <resources>
+        <artifact name="${org.wildfly.extras.elytron-tls:elytron-tls-subsystem}"/>
+        <artifact name="${org.wildfly.security:wildfly-elytron-ssl-common}"/>
+    </resources>
+
+    <dependencies>
+        <module name="org.jboss.as.controller"/>
+        <module name="org.jboss.as.server"/>
+        <module name="org.jboss.logging"/>
+        <module name="org.jboss.modules"/>
+        <module name="org.jboss.staxmapper"/>
+        <module name="org.wildfly.common"/>
+        <module name="org.wildfly.security.elytron-base"/>
+        <module name="org.wildfly.security.manager"/>
+    </dependencies>
+</module>
\ No newline at end of file
diff --git a/galleon-pack/src/main/resources/packages/docs.licenses.merge/content/docs/licenses/licenses.xsl b/galleon-pack/src/main/resources/packages/docs.licenses.merge/content/docs/licenses/licenses.xsl
new file mode 100644
index 0000000..8755195
--- /dev/null
+++ b/galleon-pack/src/main/resources/packages/docs.licenses.merge/content/docs/licenses/licenses.xsl
@@ -0,0 +1,115 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+
+    <xsl:output method="html" encoding="utf-8" standalone="no" media-type="text/html" />
+    <xsl:param name="version"/>
+    <xsl:param name="product.release.name"/>
+    <xsl:variable name="lowercase" select="'abcdefghijklmnopqrstuvwxyz '" />
+    <xsl:variable name="uppercase" select="'ABCDEFGHIJKLMNOPQRSTUVWXYZ!'" />
+    
+    <xsl:template match="/">
+        <html>
+            <head>
+                <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+                <link rel="stylesheet" type="text/css" href="licenses.css"/>
+            </head>
+            <body>
+                <h2><xsl:value-of select="$product.release.name"/><xsl:text> </xsl:text><xsl:value-of select="substring-before($version, '-')"/></h2>
+                <p>The following material has been provided for informational purposes only, and should not be relied upon or construed as a legal opinion or legal advice.</p>
+                <!-- Read matching templates -->
+                <table>
+                    <tr>
+                        <th>Package Group</th>
+                        <th>Package Artifact</th>
+                        <th>Package Version</th>
+                        <th>Remote Licenses</th>
+                        <th>Local Licenses</th>
+                    </tr>
+                    <xsl:for-each select="licenseSummary/dependencies/dependency">
+                        <xsl:sort select="concat(groupId, '.', artifactId)"/>
+                        <xsl:variable name="GAV" select="concat(groupId, ':', artifactId, ':', version)"/>
+                        <xsl:variable name="countOfPrevious" select="count(preceding-sibling::*[(concat(groupId, ':', artifactId, ':', version) = $GAV)])"/>
+                        <xsl:if test="$countOfPrevious = 0">
+                        <tr>
+                            <td><xsl:value-of select="groupId"/></td>
+                            <td><xsl:value-of select="artifactId"/></td>
+                            <td><xsl:value-of select="version"/></td>
+                            <td>
+                                <xsl:for-each select="licenses/license">
+                                    <xsl:choose>
+                                        <xsl:when test="name = 'Public Domain'">
+                                            <xsl:value-of select="name"/><br/>
+                                        </xsl:when>
+                                        <xsl:otherwise>
+                                            <a href="{./url}"><xsl:value-of select="name"/></a><br/>
+                                        </xsl:otherwise>
+                                    </xsl:choose>
+                                </xsl:for-each>
+                            </td>
+                            <td>
+                                <xsl:for-each select="licenses/license">
+                                    <xsl:variable name="filename">
+                                        <xsl:call-template name="remap-local-filename">
+                                            <xsl:with-param name="name" select="name" />
+                                        </xsl:call-template>
+                                    </xsl:variable>
+                                    <a href="{$filename}"><xsl:value-of select="$filename"/></a><br/>
+                                </xsl:for-each>
+                            </td>
+                        </tr>
+                        </xsl:if>
+                    </xsl:for-each>
+                </table>
+            </body>
+        </html>
+    </xsl:template>
+
+    <xsl:template name="remap-local-filename">
+        <xsl:param name="name"/>
+        <xsl:choose>
+            <xsl:when test="$name = 'BSD 3-Clause &quot;New&quot; or &quot;Revised&quot; License'">
+                <xsl:text>bsd 3-clause new or revised license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'BSD 3-Clause No Nuclear License'">
+                <xsl:text>bsd 3-clause no nuclear license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'Creative Commons Attribution 2.5'">
+                <xsl:text>creative commons attribution 2.5.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'FSF All Permissive License'">
+                <xsl:text>fsf all permissive license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'GNU General Public License v2.0 only'">
+                <xsl:text>gnu general public license v2.0 only.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'ICU License'">
+                <xsl:text>icu license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'Indiana University Extreme! Lab Software License 1.1.1'">
+                <xsl:text>indiana university extreme lab software license 1.1.1.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'Mozilla Public License 2.0'">
+                <xsl:text>mozilla public license 2.0.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'Plexus Classworlds License'">
+                <xsl:text>plexus classworlds license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'Sax Public Domain Notice'">
+                <xsl:text>sax public domain notice.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'The JSoup MIT License'">
+                <xsl:text>the jsoup mit license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'W3C Document License'">
+                <xsl:text>w3c document license.html</xsl:text>
+            </xsl:when>
+            <xsl:when test="$name = 'W3C Software Notice and Document License (2002-12-31)'">
+                <xsl:text>w3c software notice and document license (2002-12-31).html</xsl:text>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:value-of select="concat(translate($name, $uppercase, $lowercase), '.txt')"/>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+</xsl:stylesheet>
diff --git a/galleon-pack/src/main/resources/packages/docs.licenses.merge/package.xml b/galleon-pack/src/main/resources/packages/docs.licenses.merge/package.xml
new file mode 100644
index 0000000..b404ab5
--- /dev/null
+++ b/galleon-pack/src/main/resources/packages/docs.licenses.merge/package.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" ?>
+
+<package-spec xmlns="urn:jboss:galleon:package:2.0" name="docs.licenses.merge">
+    <dependencies>
+    <!--
+        <origin name="org.wildfly.core:wildfly-core-galleon-pack">
+            <package name="docs.licenses.merge"/>
+        </origin>
+    -->
+        <package name="docs.licenses"/>
+    </dependencies>
+</package-spec>
\ No newline at end of file
diff --git a/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/alternative-tasks.xml b/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/alternative-tasks.xml
new file mode 100644
index 0000000..8912065
--- /dev/null
+++ b/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/alternative-tasks.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" ?>
+
+<tasks xmlns="urn:wildfly:wildfly-feature-pack-tasks:2.0">
+    <delete path="docs/licenses/licenses.html"/>
+    <transform stylesheet="docs/licenses/licenses.xsl" src="docs/licenses/licenses.xml" output="docs/licenses/licenses.html" phase="FINALIZING"/>
+</tasks>
diff --git a/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/merger.xsl b/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/merger.xsl
new file mode 100644
index 0000000..55065af
--- /dev/null
+++ b/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/merger.xsl
@@ -0,0 +1,102 @@
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+    <xsl:output method="xml" indent="yes"/>
+    <xsl:param name="fileList"/>
+    <xsl:param name="fileSeparator"/>
+
+    <xsl:template match="/">
+        <xsl:call-template name="startDocument"/>
+        <xsl:call-template name="tokenizeString">
+            <xsl:with-param name="list" select="$fileList"/>
+            <xsl:with-param name="delimiter" select="','"/>
+        </xsl:call-template>
+        <xsl:call-template name="endDocument"/>
+    </xsl:template>
+
+    <xsl:template name="tokenizeString">
+        <!--passed template parameter -->
+        <xsl:param name="list"/>
+        <xsl:param name="delimiter"/>
+        <xsl:choose>
+            <xsl:when test="contains($list, $delimiter)">
+                <xsl:call-template name="processFile">
+                    <!-- get everything in front of the first delimiter -->
+                    <xsl:with-param name="fileName" select="substring-before($list,$delimiter)"/>
+                </xsl:call-template>
+                <xsl:call-template name="tokenizeString">
+                    <!-- store anything left in another variable -->
+                    <xsl:with-param name="list" select="substring-after($list,$delimiter)"/>
+                    <xsl:with-param name="delimiter" select="$delimiter"/>
+                </xsl:call-template>
+            </xsl:when>
+            <xsl:otherwise>
+                <xsl:choose>
+                    <xsl:when test="$list = ''">
+                        <xsl:text/>
+                    </xsl:when>
+                    <xsl:otherwise>
+                        <xsl:call-template name="processFile">
+                            <!-- get everything in front of the first delimiter -->
+                            <xsl:with-param name="fileName" select="$list"/>
+                        </xsl:call-template>
+                    </xsl:otherwise>
+                </xsl:choose>
+            </xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
+    <xsl:template name="substring-after-last">
+        <xsl:param name="string" />
+        <xsl:param name="delimiter" />
+        <xsl:choose>
+            <xsl:when test="contains($string, $delimiter)">
+                <xsl:call-template name="substring-after-last">
+                    <xsl:with-param name="string" select="substring-after($string, $delimiter)" />
+                    <xsl:with-param name="delimiter" select="$delimiter" />
+                </xsl:call-template>
+            </xsl:when>
+            <xsl:otherwise><xsl:value-of select="$string" /></xsl:otherwise>
+        </xsl:choose>
+    </xsl:template>
+
+    <!-- FILE PROCESSING -->
+      
+    <xsl:template name="startDocument">
+        <xsl:text disable-output-escaping="no">
+</xsl:text>
+        <xsl:text disable-output-escaping="yes">&lt;licenseSummary&gt;</xsl:text>
+        <xsl:text disable-output-escaping="no">
+  </xsl:text>
+        <xsl:text disable-output-escaping="yes">&lt;dependencies&gt;</xsl:text>
+    </xsl:template>
+
+    <xsl:template name="endDocument">
+            <xsl:text disable-output-escaping="no">
+  </xsl:text>
+        <xsl:text disable-output-escaping="yes">&lt;/dependencies&gt;</xsl:text>
+        <xsl:text disable-output-escaping="no">
+</xsl:text>
+        <xsl:text disable-output-escaping="yes">&lt;/licenseSummary&gt;</xsl:text>
+    </xsl:template>
+
+    <xsl:template name="processFile">
+        <xsl:param name="fileName"/>
+        <xsl:for-each select="document($fileName)/licenseSummary/dependencies/*">
+            <xsl:text disable-output-escaping="no">
+    </xsl:text>
+            <xsl:copy>
+                <xsl:apply-templates select="@* | node()"/><xsl:text disable-output-escaping="no">  </xsl:text><source><xsl:call-template name="substring-after-last">
+                    <xsl:with-param name="string" select="$fileName"/>
+                    <xsl:with-param name="delimiter" select="$fileSeparator"/>
+                </xsl:call-template></source><xsl:text disable-output-escaping="no">
+    </xsl:text>
+            </xsl:copy>
+        </xsl:for-each>
+    </xsl:template>
+
+    <xsl:template match="@* | node()">
+        <xsl:copy>
+            <xsl:apply-templates select="@* | node()"/>
+        </xsl:copy>
+    </xsl:template>
+
+</xsl:stylesheet>
diff --git a/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/tasks.xml b/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/tasks.xml
new file mode 100644
index 0000000..0be85f2
--- /dev/null
+++ b/galleon-pack/src/main/resources/packages/docs.licenses.merge/pm/wildfly/tasks.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" ?>
+
+<tasks xmlns="urn:wildfly:wildfly-feature-pack-tasks:2.0">
+    <delete path="docs/licenses/licenses.html"/>
+    <xml-merge basedir="docs/licenses" output="docs/licenses/licenses.xml">
+        <filter pattern="*-licenses.xml" include="true"/>
+    </xml-merge>
+    <transform stylesheet="docs/licenses/licenses.xsl" src="docs/licenses/licenses.xml" output="docs/licenses/licenses.html" phase="FINALIZING"/>
+</tasks>
diff --git a/galleon-pack/src/main/resources/packages/docs.licenses/pm/wildfly/tasks.xml b/galleon-pack/src/main/resources/packages/docs.licenses/pm/wildfly/tasks.xml
new file mode 100644
index 0000000..0f1f3f0
--- /dev/null
+++ b/galleon-pack/src/main/resources/packages/docs.licenses/pm/wildfly/tasks.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" ?>
+
+<tasks xmlns="urn:wildfly:wildfly-feature-pack-tasks:2.0">
+    <copy-path src="docs/licenses/licenses.xsl" relative-to="content" target="docs/licenses/elytron-tls-galleon-pack-licenses.xsl"/>
+    <transform stylesheet="docs/licenses/elytron-tls-galleon-pack-licenses.xsl" src="docs/licenses/elytron-tls-galleon-pack-licenses.xml" output="docs/licenses/elytron-tls-galleon-pack-licenses.html" feature-pack-properties="true"/>
+    <delete path="docs/licenses/elytron-tls-galleon-pack-licenses.xsl"/>
+</tasks>
diff --git a/galleon-pack/wildfly-feature-pack-build.xml b/galleon-pack/wildfly-feature-pack-build.xml
new file mode 100644
index 0000000..ea76402
--- /dev/null
+++ b/galleon-pack/wildfly-feature-pack-build.xml
@@ -0,0 +1,50 @@
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!--
+If you want to use a Galleon 'universe' (see the Galleon documentation) you could express that there instead.
+-->
+<build xmlns="urn:wildfly:feature-pack-build:3.1" producer="org.wildfly.extras.elytron-tls:elytron-tls-galleon-pack">
+    <transitive>
+        <dependency group-id="org.wildfly" artifact-id="wildfly-ee-galleon-pack">
+            <name>org.wildfly:wildfly-ee-galleon-pack</name>
+            <packages inherit="false">
+                <exclude name="product.conf"/>
+            </packages>
+            <default-configs inherit="false"/>
+        </dependency>
+    </transitive>
+    <dependencies>
+        <dependency group-id="org.wildfly" artifact-id="wildfly-galleon-pack">
+            <name>org.wildfly:wildfly-galleon-pack</name>
+            <packages inherit="false">
+                <include name="docs.examples"/>
+            </packages>
+            <default-configs inherit="false"/>
+        </dependency>
+    </dependencies>
+    <default-packages>
+        <package name="modules.all"/>
+        <package name="docs"/>
+        <package name="docs.licenses.merge"/>
+    </default-packages>
+    <generate-feature-specs>
+        <extensions>
+            <standalone>
+                <extension>org.wildfly.extension.elytron-tls</extension>
+            </standalone>
+        </extensions>
+    </generate-feature-specs>
+</build>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
new file mode 100644
index 0000000..926013e
--- /dev/null
+++ b/pom.xml
@@ -0,0 +1,672 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.jboss</groupId>
+        <artifactId>jboss-parent</artifactId>
+        <version>35</version>
+    </parent>
+    <groupId>org.wildfly.extras.elytron-tls</groupId>
+    <artifactId>elytron-tls-parent</artifactId>
+    <version>1.0.0.Alpha-SNAPSHOT</version>
+    <packaging>pom</packaging>
+    <name>Elytron TLS: Parent</name>
+  
+    <description>Elytron TLS: Parent</description>
+
+    <licenses>
+        <license>
+            <name>Apache License, Version 2.0</name>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+            <distribution>repo</distribution>
+        </license>
+    </licenses>
+    <properties>
+
+        <version.org.wildfly>26.1.1.Final</version.org.wildfly>
+        <version.org.wildfly.component.matrix>26.1.1.Final</version.org.wildfly.component.matrix>
+        <version.org.wildfly.core>18.1.1.Final</version.org.wildfly.core>
+        <version.org.wildfly.common>1.6.0.Final</version.org.wildfly.common>
+        <version.org.wildfly.security.elytron>1.20.1.CR1-SNAPSHOT</version.org.wildfly.security.elytron>
+
+
+        <!-- Other dependency versions -->
+        <version.io.netty>4.1.71.Final</version.io.netty>
+        <version.jakarta.json.jakarta-json-api>1.1.6</version.jakarta.json.jakarta-json-api>
+        <version.org.apache.velocity>2.3</version.org.apache.velocity>
+        <version.org.bouncycastle>1.69</version.org.bouncycastle>
+        <version.org.glassfish.jakarta.json>1.1.6</version.org.glassfish.jakarta.json>
+        <version.org.jboss.arquillian.junit>1.6.0.Final</version.org.jboss.arquillian.junit>
+        <version.org.jboss.galleon>4.2.8.Final</version.org.jboss.galleon>
+        <version.org.jmockit>1.39</version.org.jmockit>
+        <version.org.mockserver>5.8.1</version.org.mockserver>
+
+
+        <!-- Plugin versions and their dependency versions -->
+        <version.jacoco.plugin>0.8.0</version.jacoco.plugin>
+        <version.org.wildfly.checkstyle-config>1.0.8.Final</version.org.wildfly.checkstyle-config>
+        <version.org.wildfly.galleon-plugins>5.2.11.Final</version.org.wildfly.galleon-plugins>
+        <version.surefire.plugin>2.22.2</version.surefire.plugin>
+        <version.xml.plugin>1.0.1</version.xml.plugin>
+
+        <!-- Modularized JDK support (various workarounds) - activated via profile -->
+        <modular.jdk.args/>
+        <modular.jdk.props/>
+
+        <!-- Misc. -->
+        <wildfly-extras.repo.scm.connection>git@github.com:wildfly-security-incubator/elytron-tls.git</wildfly-extras.repo.scm.connection>
+        <wildfly-extras.repo.scm.url>https://github.com/wildfly-security-incubator/elytron-tls</wildfly-extras.repo.scm.url>
+        <!-- Protocol to use for communication with remote maven repositories.
+            You can set to 'http' if you are using a maven proxy and 'https'
+            interferes with that. Use 'https' for builds that will be released
+            to non-snapshot public maven repos
+        -->
+        <maven.repository.protocol>https</maven.repository.protocol>
+        <!-- The full remote maven repo URL; can be overridden via -D for special use cases -->
+        <maven.repository.url>${maven.repository.protocol}://repository.jboss.org/nexus/content/groups/public/</maven.repository.url>
+        <!-- https://access.redhat.com/maven-repository - this is needed for the picketlink dependency -->
+        <maven.redhat.repository.url>${maven.repository.protocol}://maven.repository.redhat.com/ga/</maven.redhat.repository.url>
+
+        <!-- Name of the built server -->
+        <server.name>wildfly-${version.org.wildfly}-elytron-tls-${project.version}</server.name>
+        <wildfly.build.output.dir>build/target/${server.name}</wildfly.build.output.dir>
+
+        <!-- Galleon -->
+        <galleon.fork.embedded>true</galleon.fork.embedded>
+        <galleon.log.time>true</galleon.log.time>
+        <!-- Builds need to override this -->
+        <galleon.wildfly.home>/tmp</galleon.wildfly.home>
+
+        <!-- Surefire args -->
+        <surefire.jpda.args/>
+        <surefire.system.args>${modular.jdk.args} ${modular.jdk.props} -ea -Duser.region=US -Duser.language=en -Duser.timezone=America/Chicago -XX:MaxMetaspaceSize=256m
+            ${surefire.jpda.args} ${surefire.jacoco.args}
+        </surefire.system.args>
+        <test.level>INFO</test.level>
+
+        <!--
+            See ChildFirstClassLoaderBuilder in model-test for the explanation of the org.jboss.model.test.cache.root and org.jboss.model.test.classpath.cache properties.
+            If used in conjunction with org.jboss.model.test.classpath.cache -Dorg.jboss.model.test.cache.strict on the command line, transformers tests must
+            propagate these to the test when run
+         -->
+        <!-- The name of the root checkout folder to create org.jboss.model.test.classpath.cache under for subsystem-test and core-model-test -->
+        <org.jboss.model.test.cache.root>[pom.xml,testsuite]</org.jboss.model.test.cache.root>
+        <!-- Location relative to root that will be used for the cached legacy classpaths used by subsystem-test and core-model-test-->
+        <org.jboss.model.test.classpath.cache>target/model-test-cache</org.jboss.model.test.classpath.cache>
+
+        <!-- Checkstyle configuration -->
+        <linkXRef>false</linkXRef>
+
+        <!-- WildFLy plugin version. We use it to be able to run wildfly:deploy for the example -->
+        <version.wildfly.maven.plugin>3.0.1.Final</version.wildfly.maven.plugin>
+    </properties>
+    <repositories>
+        <repository>
+            <releases>
+                <enabled>true</enabled>
+                <updatePolicy>never</updatePolicy>
+            </releases>
+            <snapshots>
+                <enabled>true</enabled>
+                <updatePolicy>never</updatePolicy>
+            </snapshots>
+            <id>jboss-public-repository-group</id>
+            <name>JBoss Public Repository Group</name>
+            <url>${maven.repository.url}</url>
+            <layout>default</layout>
+        </repository>
+        <repository>
+            <releases>
+                <enabled>true</enabled>
+                <updatePolicy>never</updatePolicy>
+            </releases>
+            <snapshots>
+                <enabled>true</enabled>
+                <updatePolicy>never</updatePolicy>
+            </snapshots>
+            <id>jboss-enterprise-maven-repository</id>
+            <name>JBoss Enterprise Maven Repository</name>
+            <url>${maven.redhat.repository.url}</url>
+            <layout>default</layout>
+        </repository>
+    </repositories>
+    <pluginRepositories>
+        <pluginRepository>
+            <releases>
+                <enabled>true</enabled>
+            </releases>
+            <snapshots>
+                <enabled>true</enabled>
+            </snapshots>
+            <id>jboss-public-repository-group</id>
+            <name>JBoss Public Repository Group</name>
+            <url>${maven.repository.url}</url>
+        </pluginRepository>
+        <pluginRepository>
+            <releases>
+                <enabled>true</enabled>
+            </releases>
+            <snapshots>
+                <enabled>false</enabled>
+            </snapshots>
+            <id>jboss-enterprise-maven-repository</id>
+            <name>JBoss Enterprise Maven Repository</name>
+            <url>${maven.redhat.repository.url}</url>
+        </pluginRepository>
+    </pluginRepositories>
+
+    <dependencyManagement>
+        <dependencies>
+            <!-- WildFly dependencies -->
+            <dependency>
+                <groupId>org.wildfly</groupId>
+                <artifactId>wildfly-ee-galleon-pack</artifactId>
+                <version>${version.org.wildfly}</version>
+                <type>zip</type>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly</groupId>
+                <artifactId>wildfly-galleon-pack</artifactId>
+                <version>${version.org.wildfly}</version>
+                <type>zip</type>
+            </dependency>
+
+            <!-- This BOM makes most of the dependencies from WildFly available for normal (non-plugin use -->
+            <dependency>
+                <groupId>org.wildfly</groupId>
+                <artifactId>wildfly-component-matrix</artifactId>
+                <version>${version.org.wildfly.component.matrix}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+
+
+
+            <!-- Project -->
+            <dependency>
+                <groupId>${project.groupId}</groupId>
+                <artifactId>elytron-tls-subsystem</artifactId>
+                <version>${project.version}</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>*</groupId>
+                        <artifactId>*</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
+            <dependency>
+                <groupId>${project.groupId}</groupId>
+                <artifactId>elytron-tls-galleon-pack</artifactId>
+                <version>${project.version}</version>
+                <type>pom</type>
+                <exclusions>
+                    <exclusion>
+                        <groupId>*</groupId>
+                        <artifactId>*</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
+            <dependency>
+                <groupId>${project.groupId}</groupId>
+                <artifactId>elytron-tls-galleon-pack</artifactId>
+                <version>${project.version}</version>
+                <type>zip</type>
+                <exclusions>
+                    <exclusion>
+                        <groupId>*</groupId>
+                        <artifactId>*</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
+
+
+
+            <!-- External dependencies -->
+            <!-- This does not go into the modules so don't worry about exclusions -->
+            <dependency>
+                <groupId>jakarta.json</groupId>
+                <artifactId>jakarta.json-api</artifactId>
+                <version>${version.jakarta.json.jakarta-json-api}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.glassfish</groupId>
+                <artifactId>jakarta.json</artifactId>
+                <version>${version.org.glassfish.jakarta.json}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.checkstyle</groupId>
+                <artifactId>wildfly-checkstyle-config</artifactId>
+                <version>${version.org.wildfly.checkstyle-config}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-asn1</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-base</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-credential</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-provider-util</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-ssl-common</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-x500</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-x500-cert</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-x500-cert-acme</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-x500-cert-util</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-x500-principal</artifactId>
+                <version>${version.org.wildfly.security.elytron}</version>
+            </dependency>
+
+
+            <!-- Test dependencies -->
+            <!-- mockserver-netty uses .... netty!  But we want a later version with some CVE fixes-->
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-buffer</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-codec</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-codec-http</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-codec-socks</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-common</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-handler</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-handler-proxy</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-transport</artifactId>
+                <version>${version.io.netty}</version>
+                <scope>test</scope>
+            </dependency>
+            <!-- mockserver-netty transitively uses velocity but we want a later version with a CVE fixed -->
+            <dependency>
+                <groupId>org.apache.velocity</groupId>
+                <artifactId>velocity-engine-core</artifactId>
+                <version>${version.org.apache.velocity}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.velocity</groupId>
+                <artifactId>velocity-engine-scripting</artifactId>
+                <version>${version.org.apache.velocity}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcpkix-jdk15on</artifactId>
+                <version>${version.org.bouncycastle}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk15on</artifactId>
+                <version>${version.org.bouncycastle}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.jboss.arquillian.junit</groupId>
+                <artifactId>arquillian-junit-core</artifactId>
+                <scope>test</scope>
+                <version>${version.org.jboss.arquillian.junit}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.jmockit</groupId>
+                <artifactId>jmockit</artifactId>
+                <scope>test</scope>
+                <version>${version.org.jmockit}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.mock-server</groupId>
+                <artifactId>mockserver-netty</artifactId>
+                <version>${version.org.mockserver}</version>
+                <scope>test</scope>
+                <exclusions>
+                    <exclusion>
+                        <groupId>com.google.code.findbugs</groupId>
+                        <artifactId>jsr305</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.apache.commons</groupId>
+                        <artifactId>commons-lang3</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>com.google.guava</groupId>
+                        <artifactId>guava</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcmail-jdk15on</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcprov-jdk15on</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcpkix-jdk15on</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcutil-jdk15on</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
+                <dependency>
+                <groupId>org.wildfly.core</groupId>
+                <artifactId>wildfly-core-test-runner</artifactId>
+                <version>${version.org.wildfly.core}</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.core</groupId>
+                <artifactId>wildfly-subsystem-test</artifactId>
+                <version>${version.org.wildfly.core}</version>
+                <type>pom</type>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.openssl</groupId>
+                <artifactId>wildfly-openssl-java</artifactId>
+                <version>2.2.1.Final</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.wildfly.security</groupId>
+                <artifactId>wildfly-elytron-tests-common</artifactId>
+                <scope>test</scope>
+                <version>1.18.0.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+    <build>
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-dependency-plugin</artifactId>
+                    <version>3.3.0</version>
+                    <goals>
+                        <goal>copy</goal>
+                        <goal>properties</goal>
+                        <goal>copy-dependencies</goal>
+                        <goal>unpack-dependencies</goal>
+                    </goals>
+                </plugin>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-surefire-plugin</artifactId>
+                    <version>${version.surefire.plugin}</version>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.apache.maven.surefire</groupId>
+                            <artifactId>surefire-junit47</artifactId>
+                            <version>${version.surefire.plugin}</version>
+                        </dependency>
+                    </dependencies>
+                    <configuration>
+                        <redirectTestOutputToFile>true</redirectTestOutputToFile>
+                        <enableAssertions>true</enableAssertions>
+                        <systemPropertyVariables>
+                            <org.jboss.model.test.cache.root>${org.jboss.model.test.cache.root}</org.jboss.model.test.cache.root>
+                            <org.jboss.model.test.classpath.cache>${org.jboss.model.test.classpath.cache}</org.jboss.model.test.classpath.cache>
+                            <org.jboss.model.test.cache.strict>true</org.jboss.model.test.cache.strict>
+                        </systemPropertyVariables>
+                        <systemProperties>
+                            <property>
+                                <name>java.util.logging.manager</name>
+                                <value>org.jboss.logmanager.LogManager</value>
+                            </property>
+                            <property>
+                                <name>jboss.remoting.leakdebugging</name>
+                                <value>false</value>
+                            </property>
+                            <property>
+                                <name>test.level</name>
+                                <value>${test.level}</value>
+                            </property>
+                        </systemProperties>
+                        <argLine>${surefire.system.args}</argLine>
+                    </configuration>
+
+                </plugin>
+                <plugin>
+                    <groupId>org.codehaus.mojo</groupId>
+                    <artifactId>xml-maven-plugin</artifactId>
+                    <version>${version.xml.plugin}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.jacoco</groupId>
+                    <artifactId>jacoco-maven-plugin</artifactId>
+                    <version>${version.jacoco.plugin}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.jboss.galleon</groupId>
+                    <artifactId>galleon-maven-plugin</artifactId>
+                    <version>${version.org.jboss.galleon}</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.wildfly.galleon-plugins</groupId>
+                    <artifactId>wildfly-galleon-maven-plugin</artifactId>
+                    <version>${version.org.wildfly.galleon-plugins}</version>
+                    <dependencies>
+                        <!--
+                            feature-spec-gen uses wildfly-embedded to generate the feature specs, hence the designated
+                            wildfly-embedded version must match the pack one
+                        -->
+                        <dependency>
+                            <groupId>org.wildfly.core</groupId>
+                            <artifactId>wildfly-embedded</artifactId>
+                            <version>${version.org.wildfly.core}</version>
+                        </dependency>
+                        <!-- If you add a dependency on wildfly-embedded you need to bring your own transitives -->
+                        <dependency>
+                            <groupId>org.wildfly.common</groupId>
+                            <artifactId>wildfly-common</artifactId>
+                            <version>${version.org.wildfly.common}</version>
+                        </dependency>
+                    </dependencies>
+                </plugin>
+                <!-- Only here to be able to run wildfly:deploy for the example -->
+                <plugin>
+                    <groupId>org.wildfly.plugins</groupId>
+                    <artifactId>wildfly-maven-plugin</artifactId>
+                    <version>${version.wildfly.maven.plugin}</version>
+                </plugin>
+                <!-- Checkstyle -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-checkstyle-plugin</artifactId>
+                    <version>${version.checkstyle.plugin}</version>
+                    <executions>
+                        <execution>
+                            <id>check-style</id>
+                            <phase>compile</phase>
+                            <goals>
+                                <goal>checkstyle</goal>
+                            </goals>
+                        </execution>
+                    </executions>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.wildfly.checkstyle</groupId>
+                            <artifactId>wildfly-checkstyle-config</artifactId>
+                            <version>${version.org.wildfly.checkstyle-config}</version>
+                        </dependency>
+                    </dependencies>
+                    <configuration>
+                        <configLocation>wildfly-checkstyle/checkstyle.xml</configLocation>
+                        <consoleOutput>true</consoleOutput>
+                        <failsOnError>true</failsOnError>
+                        <includeTestSourceDirectory>true</includeTestSourceDirectory>
+                        <excludes>**/*$logger.java,**/*$bundle.java</excludes>
+                        <suppressionsLocation>checkstyle-suppressions.xml</suppressionsLocation>
+                        <useFile/>
+                    </configuration>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+    </build>
+    <scm>
+        <connection>scm:git:${wildfly-extras.repo.scm.connection}</connection>
+        <developerConnection>scm:git:${wildfly-extras.repo.scm.connection}</developerConnection>
+        <url>${wildfly-extras.repo.scm.url}</url>
+        <tag>HEAD</tag>
+    </scm>
+    <modules>
+        <module>build</module>
+        <module>galleon-pack</module>
+        <module>subsystem</module>
+        <module>testsuite</module>
+    </modules>
+
+    <profiles>
+        <profile>
+            <id>jdk9</id>
+            <activation>
+                <jdk>[9,)</jdk>
+            </activation>
+            <properties>
+                <modular.jdk.args>--add-exports=java.base/sun.nio.ch=ALL-UNNAMED
+                    --add-exports=jdk.unsupported/sun.reflect=ALL-UNNAMED
+                    --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED
+                    --add-modules=java.se</modular.jdk.args>
+            </properties>
+        </profile>
+
+        <!--
+            JaCoCo test coverage. Will set ${surefire.jacoco.args} to be used in WildFly Test Runner config and as surefire jvm argument.
+            This profile generate .exec files only. This profile doesn't generate html coverage report.
+        -->
+        <profile>
+            <id>ts.jacoco.profile</id>
+            <activation>
+                <property>
+                    <name>coverage</name>
+                </property>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.jacoco</groupId>
+                        <artifactId>jacoco-maven-plugin</artifactId>
+                        <version>${version.jacoco.plugin}</version>
+                        <executions>
+                            <execution>
+                                <id>ts.jacoco-prepare</id>
+                                <phase>process-test-classes</phase>
+                                <goals>
+                                    <goal>prepare-agent</goal>
+                                </goals>
+                                <configuration>
+                                    <append>true</append>
+                                    <destFile>target/jacoco.exec</destFile>
+                                    <includes>
+                                        <include>*</include>
+                                    </includes>
+                                    <excludes>
+                                        <exclude>org.jboss.as.test.*</exclude>
+                                    </excludes>
+                                    <output>file</output>
+                                    <propertyName>surefire.jacoco.args</propertyName>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+
+        <!--
+            This profile is needed for the jacoco plugin as the jacoco plugin is unable to replace surefire.jacoco.args
+            property if this property is defined in main properties section of the pom file
+          -->
+        <profile>
+            <id>ts.jacoco.profile.not.enabled</id>
+            <activation>
+                <property>
+                    <name>!coverage</name>
+                </property>
+            </activation>
+            <properties>
+                <surefire.jacoco.args/>
+            </properties>
+        </profile>
+    </profiles>
+</project>
diff --git a/provision.xml b/provision.xml
new file mode 100644
index 0000000..c7a3c24
--- /dev/null
+++ b/provision.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" ?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+
+<!--
+    USAGE:
+        /path/to/galleon/bin/galleon.sh provision /path/to/this/provision.xml -dir=/path/to/created/wildfly/install/dir
+    (note that `-dir` should have double hyphens, which don't work in XML comments!)
+-->
+<installation xmlns="urn:jboss:galleon:provisioning:3.0">
+    <feature-pack location="wildfly@maven(org.jboss.universe:community-universe):current">
+        <default-configs inherit="false"/>
+        <packages inherit="false">
+            <!-- If docs/licenses is desired, uncomment this line -->
+            <include name="docs.licenses"/>
+        </packages>
+    </feature-pack>
+    <feature-pack location="org.wildfly.extras.elytron-tls:elytron-tls-galleon-pack:1.0.0.Alpha-SNAPSHOT">
+        <default-configs inherit="false"/>
+        <packages inherit="false">
+            <!-- If docs/licenses is desired, uncomment this line -->
+            <include name="docs.licenses.merge"/>
+        </packages>
+    </feature-pack>
+    <config model="standalone" name="standalone.xml">
+        <layers>
+            <!-- The base server -->
+            <include name="cloud-profile"/>
+
+            <!-- Our layer(s) -->
+            <include name="elytron-tls"/>
+        </layers>
+    </config>
+    <options>
+        <option name="optional-packages" value="passive+"/>
+    </options>
+</installation>
diff --git a/subsystem/pom.xml b/subsystem/pom.xml
new file mode 100644
index 0000000..75532a6
--- /dev/null
+++ b/subsystem/pom.xml
@@ -0,0 +1,193 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.wildfly.extras.elytron-tls</groupId>
+        <artifactId>elytron-tls-parent</artifactId>
+        <version>1.0.0.Alpha-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>elytron-tls-subsystem</artifactId>
+    <name>Elytron TLS: Elytron TLS Extension</name>
+
+    <dependencies>
+        <dependency>
+            <groupId>jakarta.json</groupId>
+            <artifactId>jakarta.json-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.glassfish</groupId>
+            <artifactId>jakarta.json</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging-annotations</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging-processor</artifactId>
+            <scope>provided</scope>
+            <optional>true</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.core</groupId>
+            <artifactId>wildfly-controller</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.core</groupId>
+            <artifactId>wildfly-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.checkstyle</groupId>
+            <artifactId>wildfly-checkstyle-config</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-asn1</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-base</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-credential</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-provider-util</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-ssl-common</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-x500</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-x500-cert</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-x500-cert-acme</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-x500-cert-util</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-x500-principal</artifactId>
+        </dependency>
+
+        <!-- Test dependencies -->
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-jdk15on</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.mock-server</groupId>
+            <artifactId>mockserver-netty</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.jmockit</groupId>
+            <artifactId>jmockit</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.core</groupId>
+            <artifactId>wildfly-subsystem-test</artifactId>
+            <type>pom</type>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>xml-maven-plugin</artifactId>
+                <version>${version.xml.plugin}</version>
+                <configuration>
+                    <validationSets>
+                        <validationSet>
+                            <dir>src/test/resources/org/wildfly/extension/elytron/tls</dir>
+                            <includes>
+                                <include>*.xml</include>
+                            </includes>
+                            <excludes>
+                                <exclude>elytron-tls-expressions.xml</exclude>
+                            </excludes>
+                            <systemId>src/main/resources/schema/elytron-tls-subsystem_1_0.xsd</systemId>
+                        </validationSet>
+                        <validationSet>
+                            <dir>src/main/resources/subsystem-templates</dir>
+                        </validationSet>
+                        <validationSet>
+                            <dir>src/main/resources/schema</dir>
+                        </validationSet>
+                    </validationSets>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>xml-validation</id>
+                        <phase>compile</phase>
+                        <goals>
+                            <goal>validate</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+            <plugin><!-- to obtain jmockit jar path -->
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-dependency-plugin</artifactId>
+                <version>${version.dependency.plugin}</version>
+                <executions>
+                    <execution>
+                        <id>getClasspathFilenames</id>
+                        <goals>
+                            <goal>properties</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <version>${version.surefire.plugin}</version>
+                <configuration>
+                    <reuseForks>false</reuseForks>
+                    <argLine>-javaagent:@{org.jmockit:jmockit:jar} ${surefire.jacoco.args} ${modular.jdk.args} -Dorg.wildfly.extension.elytron.restore-default-ssl-context=true -Dauthconfigprovider.factory=org.wildfly.security.auth.jaspi.ElytronAuthConfigFactory</argLine>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
\ No newline at end of file
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AbstractCredentialStoreResourceDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AbstractCredentialStoreResourceDefinition.java
new file mode 100644
index 0000000..ef7aad6
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AbstractCredentialStoreResourceDefinition.java
@@ -0,0 +1,362 @@
+ /*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_API_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls.ServiceStateDefinition.STATE;
+import static org.wildfly.extension.elytron.tls.ServiceStateDefinition.populateResponse;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+import static org.wildfly.security.encryption.SecretKeyUtil.exportSecretKey;
+import static org.wildfly.security.encryption.SecretKeyUtil.generateSecretKey;
+import static org.wildfly.security.encryption.SecretKeyUtil.importSecretKey;
+
+import java.security.GeneralSecurityException;
+import java.security.NoSuchAlgorithmException;
+import java.security.spec.InvalidKeySpecException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.logging.Level;
+
+import javax.crypto.SecretKey;
+
+import org.jboss.as.controller.AbstractWriteAttributeHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.wildfly.common.function.ExceptionFunction;
+import org.wildfly.security.credential.Credential;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.credential.store.CredentialStoreException;
+import org.wildfly.security.credential.store.UnsupportedCredentialTypeException;
+import org.wildfly.security.password.PasswordFactory;
+import org.wildfly.security.password.interfaces.ClearPassword;
+import org.wildfly.security.password.spec.ClearPasswordSpec;
+
+/**
+ * A common base for resource definitions representing credential stores.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+abstract class AbstractCredentialStoreResourceDefinition extends SimpleResourceDefinition {
+
+    static final ServiceUtil<CredentialStore> CREDENTIAL_STORE_UTIL = ServiceUtil.newInstance(CREDENTIAL_STORE_RUNTIME_CAPABILITY, Constants.CREDENTIAL_STORE, CredentialStore.class);
+
+    protected ServiceUtil<CredentialStore> getCredentialStoreUtil() {
+        return CREDENTIAL_STORE_UTIL;
+    }
+
+    // Operations
+
+    static final StandardResourceDescriptionResolver OPERATION_RESOLVER = ElytronTlsExtension
+            .getResourceDescriptionResolver(Constants.CREDENTIAL_STORE,
+                    Constants.OPERATIONS);
+
+    static final SimpleOperationDefinition READ_ALIASES = new SimpleOperationDefinitionBuilder(Constants.READ_ALIASES, OPERATION_RESOLVER)
+            .setRuntimeOnly()
+            .setReadOnly()
+            .build();
+
+    static final SimpleAttributeDefinition ALIAS = new SimpleAttributeDefinitionBuilder(Constants.ALIAS, ModelType.STRING, false)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleAttributeDefinition KEY = new SimpleAttributeDefinitionBuilder(Constants.KEY, ModelType.STRING, false)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleOperationDefinition EXPORT_SECRET_KEY = new SimpleOperationDefinitionBuilder(Constants.EXPORT_SECRET_KEY, OPERATION_RESOLVER)
+            .setParameters(ALIAS)
+            .setRuntimeOnly()
+            .build();
+
+    static final SimpleOperationDefinition IMPORT_SECRET_KEY = new SimpleOperationDefinitionBuilder(Constants.IMPORT_SECRET_KEY, OPERATION_RESOLVER)
+            .setParameters(ALIAS, KEY)
+            .setRuntimeOnly()
+            .build();
+
+    static final SimpleOperationDefinition RELOAD = new SimpleOperationDefinitionBuilder(Constants.RELOAD, OPERATION_RESOLVER)
+            .setRuntimeOnly()
+            .build();
+
+    static final OperationStepHandler RELOAD_HANDLER = new CredentialStoreReloadHandler();
+
+    protected AbstractCredentialStoreResourceDefinition(Parameters parameters) {
+        super(parameters);
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        AttributeDefinition[] configAttributes = getAttributeDefinitions();
+        AbstractWriteAttributeHandler write = new ElytronReloadRequiredWriteAttributeHandler(configAttributes);
+        for (AttributeDefinition current : configAttributes) {
+            resourceRegistration.registerReadWriteAttribute(current, null, write);
+        }
+        if (isServerOrHostController(resourceRegistration)) {
+            resourceRegistration.registerReadOnlyAttribute(STATE, new ElytronRuntimeOnlyHandler() {
+
+                @Override
+                protected void executeRuntimeStep(OperationContext context, ModelNode operation) {
+                    ServiceName credentialStoreClientServiceName = getCredentialStoreUtil().serviceName(operation);
+                    ServiceController<?> serviceController = context.getServiceRegistry(false).getRequiredService(credentialStoreClientServiceName);
+
+                    populateResponse(context.getResult(), serviceController);
+                }
+
+            });
+        }
+    }
+
+    protected abstract AttributeDefinition[] getAttributeDefinitions();
+
+    protected void readAliasesOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        try {
+            try {
+                List<ModelNode> list = new ArrayList<>();
+                Set<String> aliases = credentialStore.getAliases();
+                for (String s : aliases) {
+                    ModelNode modelNode = new ModelNode(s);
+                    list.add(modelNode);
+                }
+                context.getResult().set(list);
+            } catch (CredentialStoreException e) {
+                throw LOGGER.unableToCompleteOperation(e, dumpCause(e));
+            }
+        } catch (RuntimeException e) {
+            e.printStackTrace();
+            throw new OperationFailedException(e);
+        }
+    }
+
+    protected void removeAliasOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore, Class<? extends Credential> credentialType) throws OperationFailedException {
+        try {
+            try {
+                String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+
+                Credential retrieved = credentialStore.retrieve(alias, credentialType);
+                if (retrieved == null) {
+                    throw LOGGER.credentialDoesNotExist(alias, credentialType.getSimpleName());
+                }
+                credentialStore.remove(alias, credentialType);
+                context.addResponseWarning(Level.WARNING, LOGGER.updateDependantServices(alias));
+                try {
+                    credentialStore.flush();
+                } catch (CredentialStoreException e) {
+                    // the operation fails, return removed entry back to the store to avoid an inconsistency
+                    // between the store on the FS and in the memory
+                    credentialStore.store(alias, retrieved);
+                    throw e;
+                }
+            } catch (CredentialStoreException e) {
+                throw LOGGER.unableToCompleteOperation(e, dumpCause(e));
+            }
+        } catch (RuntimeException e) {
+            throw new OperationFailedException(e);
+        }
+    }
+
+    protected void exportSecretKeyOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore)
+            throws OperationFailedException {
+        try {
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+
+            SecretKeyCredential credential = credentialStore.retrieve(alias, SecretKeyCredential.class);
+            if (credential == null) {
+                throw LOGGER.credentialDoesNotExist(alias, SecretKeyCredential.class.getSimpleName());
+            }
+
+            SecretKey secretKey = credential.getSecretKey();
+            String exportedKey = exportSecretKey(secretKey);
+
+            ModelNode result = context.getResult();
+            result.get(Constants.KEY).set(exportedKey);
+        } catch (GeneralSecurityException e) {
+            throw LOGGER.secretKeyOperationFailed(Constants.EXPORT_SECRET_KEY, dumpCause(e), e);
+        }
+    }
+
+    protected void importSecretKeyOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore)
+            throws OperationFailedException {
+        try {
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            String rawKey = KEY.resolveModelAttribute(context, operation).asString();
+
+            if (credentialStore.exists(alias, SecretKeyCredential.class)) {
+                throw LOGGER.credentialAlreadyExists(alias, SecretKeyCredential.class.getName());
+            }
+
+            SecretKey secretKey = importSecretKey(rawKey);
+
+            storeSecretKey(credentialStore, alias, secretKey);
+
+        } catch (GeneralSecurityException e) {
+            throw LOGGER.secretKeyOperationFailed(Constants.IMPORT_SECRET_KEY, dumpCause(e), e);
+        }
+    }
+
+    protected void generateSecretKeyOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore,
+            int keySize) throws OperationFailedException {
+        try {
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+
+            if (credentialStore.exists(alias, SecretKeyCredential.class)) {
+                throw LOGGER.credentialAlreadyExists(alias, SecretKeyCredential.class.getName());
+            }
+
+            SecretKey secretKey = generateSecretKey(keySize);
+            storeSecretKey(credentialStore, alias, secretKey);
+
+        } catch (GeneralSecurityException e) {
+            throw LOGGER.secretKeyOperationFailed(Constants.GENERATE_SECRET_KEY, dumpCause(e), e);
+        }
+    }
+
+    /**
+     * Convert {@code char[]} password to {@code PasswordCredential}
+     * @param password to convert
+     * @return new {@code PasswordCredential}
+     * @throws UnsupportedCredentialTypeException should never happen as we have only supported types and algorithms
+     */
+    protected static PasswordCredential createCredentialFromPassword(char[] password) throws UnsupportedCredentialTypeException {
+        try {
+            PasswordFactory passwordFactory = PasswordFactory.getInstance(ClearPassword.ALGORITHM_CLEAR);
+            return new PasswordCredential(passwordFactory.generatePassword(new ClearPasswordSpec(password)));
+        } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
+            throw new UnsupportedCredentialTypeException(e);
+        }
+    }
+
+    protected static void storeSecret(CredentialStore credentialStore, String alias, String secretValue) throws CredentialStoreException {
+        char[] secret = secretValue != null ? secretValue.toCharArray() : new char[0];
+        storeCredential(credentialStore, alias, createCredentialFromPassword(secret));
+    }
+
+    protected static void storeSecretKey(CredentialStore credentialStore, String alias, SecretKey secretKey) throws CredentialStoreException {
+        storeCredential(credentialStore, alias, new SecretKeyCredential(secretKey));
+    }
+
+    protected static void storeCredential(CredentialStore credentialStore, String alias, Credential credential) throws CredentialStoreException {
+        credentialStore.store(alias, credential);
+        try {
+            credentialStore.flush();
+        } catch (CredentialStoreException e) {
+            // operation fails, remove the entry from the store, to avoid an inconsistency between
+            // the store on the FS and in the memory
+            credentialStore.remove(alias, PasswordCredential.class);
+            throw e;
+        }
+    }
+
+    protected static String dumpCause(Throwable e) {
+        StringBuffer sb = new StringBuffer().append(e.getLocalizedMessage());
+        Throwable c = e.getCause();
+        int depth = 0;
+        while(c != null && depth++ < 10) {
+            sb.append("->").append(c.getLocalizedMessage());
+            c = c.getCause() == c ? null : c.getCause();
+        }
+        return sb.toString();
+    }
+
+    protected abstract static class AbstractCredentialStoreDoohickey extends ElytronDoohickey<CredentialStore> {
+
+        protected AbstractCredentialStoreDoohickey(PathAddress resourceAddress) {
+            super(resourceAddress);
+        }
+
+        protected abstract void reload(OperationContext context) throws GeneralSecurityException, OperationFailedException;
+
+    }
+
+    protected static class CredentialStoreRuntimeHandler extends ElytronRuntimeOnlyHandler {
+
+        private final Map<String, CredentialStoreRuntimeOperation> definedOperations;
+
+        protected CredentialStoreRuntimeHandler(final Map<String, CredentialStoreRuntimeOperation> definedOperations) {
+            this.definedOperations = definedOperations;
+        }
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            final String operationName = operation.require(ModelDescriptionConstants.OP).asString();
+            CredentialStoreRuntimeOperation operationMethod = definedOperations.get(operationName);
+            if (operationMethod == null) {
+                throw LOGGER.invalidOperationName(operationName, getExpectedOperationNames());
+            }
+
+            CredentialStore credentialStore = getCredentialStore(context);
+            operationMethod.handle(context, operation, credentialStore);
+        }
+
+        private String[] getExpectedOperationNames() {
+            return definedOperations.keySet().toArray(new String[definedOperations.size()]);
+        }
+
+        protected CredentialStore getCredentialStore(OperationContext context) throws OperationFailedException {
+            final ExceptionFunction<OperationContext, CredentialStore, OperationFailedException> credentialStoreApi = context
+                    .getCapabilityRuntimeAPI(CREDENTIAL_STORE_API_CAPABILITY, context.getCurrentAddressValue(), ExceptionFunction.class);
+
+            return credentialStoreApi.apply(context);
+        }
+
+    }
+
+    static class CredentialStoreReloadHandler extends ElytronRuntimeOnlyHandler {
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            final ExceptionFunction<OperationContext, CredentialStore, OperationFailedException> credentialStoreApi = context
+                    .getCapabilityRuntimeAPI(CREDENTIAL_STORE_API_CAPABILITY, context.getCurrentAddressValue(), ExceptionFunction.class);
+
+            AbstractCredentialStoreDoohickey doohickey = (AbstractCredentialStoreDoohickey) credentialStoreApi;
+
+            try {
+                doohickey.reload(context);
+            } catch (GeneralSecurityException e) {
+                throw LOGGER.unableToReloadCredentialStore(e);
+            }
+
+        }
+
+    }
+
+    @FunctionalInterface
+    interface CredentialStoreRuntimeOperation {
+
+        void handle(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException;
+
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AcmeAccountService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AcmeAccountService.java
new file mode 100644
index 0000000..d5f650f
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AcmeAccountService.java
@@ -0,0 +1,152 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2018 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.msc.inject.Injector;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceRegistry;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+import org.jboss.msc.value.InjectedValue;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.security.credential.source.CredentialSource;
+import org.wildfly.security.x500.cert.acme.AcmeAccount;
+import org.wildfly.security.x500.cert.acme.CertificateAuthority;
+
+/**
+ * A {@link Service} responsible for a single {@link AcmeAccount} instance.
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+class AcmeAccountService implements Service<AcmeAccount> {
+
+    private final InjectedValue<KeyStore> keyStoreInjector = new InjectedValue<>();
+    private final InjectedValue<ExceptionSupplier<CredentialSource, Exception>> credentialSourceSupplierInjector = new InjectedValue<>();
+    private final String certificateAuthorityName;
+    private final List<String> contactUrlsList;
+    private final String alias;
+    private final String keyStoreName;
+    private volatile AcmeAccount acmeAccount;
+
+    AcmeAccountService(String certificateAuthorityName, List<String> contactUrlsList, String alias, String keyStoreName) {
+        this.certificateAuthorityName = certificateAuthorityName;
+        this.contactUrlsList = contactUrlsList;
+        this.alias = alias;
+        this.keyStoreName = keyStoreName;
+    }
+
+    @Override
+    public void start(StartContext startContext) throws StartException {
+        try {
+            final ServiceRegistry serviceRegistry = startContext.getController().getServiceContainer();
+            final ModifiableKeyStoreService keyStoreService = CertificateAuthorityAccountDefinition.getModifiableKeyStoreService(serviceRegistry, keyStoreName);
+            char[] keyPassword = resolveKeyPassword((KeyStoreService) keyStoreService);
+            KeyStore keyStore = keyStoreInjector.getValue();
+            CertificateAuthority certificateAuthority;
+            if (certificateAuthorityName.equalsIgnoreCase(CertificateAuthority.LETS_ENCRYPT.getName())) {
+                certificateAuthority = CertificateAuthority.LETS_ENCRYPT;
+            } else {
+                certificateAuthority = CertificateAuthorityDefinition.getCertificateAuthorityService(serviceRegistry, certificateAuthorityName).getValue();
+            }
+
+            AcmeAccount.Builder acmeAccountBuilder = AcmeAccount.builder()
+                    .setServerUrl(certificateAuthority.getUrl());
+            if (certificateAuthority.getStagingUrl() != null) {
+                acmeAccountBuilder.setStagingServerUrl(certificateAuthority.getStagingUrl());
+            }
+            if (! contactUrlsList.isEmpty()) {
+                acmeAccountBuilder = acmeAccountBuilder.setContactUrls(contactUrlsList.toArray(new String[contactUrlsList.size()]));
+            }
+            boolean updateAccountKeyStore = false;
+            if (keyStore.containsAlias(alias)) {
+                // use existing account key pair
+                X509Certificate certificate = (X509Certificate) keyStore.getCertificate(alias);
+                if (certificate == null) {
+                    throw LOGGER.unableToObtainCertificateAuthorityAccountCertificate(alias);
+                }
+                PrivateKey privateKey = (PrivateKey) keyStore.getKey(alias, keyPassword);
+                if (privateKey == null) {
+                    throw LOGGER.unableToObtainCertificateAuthorityAccountPrivateKey(alias);
+                }
+                acmeAccountBuilder = acmeAccountBuilder.setKey(certificate, privateKey);
+            } else {
+                updateAccountKeyStore = true;
+            }
+            acmeAccount = acmeAccountBuilder.build();
+            if (updateAccountKeyStore) {
+                saveCertificateAuthorityAccountKey(keyStoreService, keyPassword); // persist the generated key pair
+            }
+        } catch (Exception e) {
+            throw LOGGER.unableToStartService(e);
+        }
+    }
+
+    @Override
+    public void stop(StopContext stopContext) {
+        acmeAccount = null;
+    }
+
+    @Override
+    public AcmeAccount getValue() throws IllegalStateException, IllegalArgumentException {
+        return acmeAccount;
+    }
+
+    Injector<KeyStore> getKeyStoreInjector() {
+        return keyStoreInjector;
+    }
+
+    Injector<ExceptionSupplier<CredentialSource, Exception>> getCredentialSourceSupplierInjector() {
+        return credentialSourceSupplierInjector;
+    }
+
+    char[] resolveKeyPassword(KeyStoreService keyStoreService) throws RuntimeException {
+        try {
+            return keyStoreService.resolveKeyPassword(credentialSourceSupplierInjector.getOptionalValue());
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    void saveCertificateAuthorityAccountKey(OperationContext operationContext) throws OperationFailedException {
+        final ModifiableKeyStoreService keyStoreService = CertificateAuthorityAccountDefinition.getModifiableKeyStoreService(operationContext, keyStoreName);
+        char[] keyPassword = resolveKeyPassword((KeyStoreService) keyStoreService);
+        saveCertificateAuthorityAccountKey(keyStoreService, keyPassword);
+    }
+
+    private void saveCertificateAuthorityAccountKey(ModifiableKeyStoreService keyStoreService, char[] keyPassword) throws OperationFailedException {
+        KeyStore modifiableAccountkeyStore = keyStoreService.getModifiableValue();
+        try {
+            modifiableAccountkeyStore.setKeyEntry(alias, acmeAccount.getPrivateKey(), keyPassword, new X509Certificate[]{ acmeAccount.getCertificate() });
+        } catch (KeyStoreException e) {
+            throw LOGGER.unableToUpdateCertificateAuthorityAccountKeyStore(e, e.getLocalizedMessage());
+        }
+        ((KeyStoreService) keyStoreService).save();
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AdvancedModifiableKeyStoreDecorator.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AdvancedModifiableKeyStoreDecorator.java
new file mode 100644
index 0000000..48823b5
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AdvancedModifiableKeyStoreDecorator.java
@@ -0,0 +1,1061 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.DIRECTORY;
+import static org.jboss.as.controller.security.CredentialReference.rollbackCredentialStoreUpdate;
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.CertificateChainAttributeDefinitions.writeCertificate;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.getRequiredService;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.RELATIVE_TO;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathResolver;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.UnrecoverableEntryException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CRLReason;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
+import java.time.format.DateTimeParseException;
+import java.time.temporal.ChronoUnit;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Enumeration;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.ServiceLoader;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.jboss.as.controller.ObjectListAttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.StringListAttributeDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.ResourceDescriptionResolver;
+import org.jboss.as.controller.operations.validation.IntRangeValidator;
+import org.jboss.as.controller.operations.validation.LongRangeValidator;
+import org.jboss.as.controller.operations.validation.StringAllowedValuesValidator;
+import org.jboss.as.controller.operations.validation.StringLengthValidator;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+import org.wildfly.common.bytes.ByteStringBuilder;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PathResolver;
+import org.wildfly.extension.elytron.tls._private.ElytronTLSMessages;
+import org.wildfly.security.credential.source.CredentialSource;
+import org.wildfly.security.pem.Pem;
+import org.wildfly.security.x500.X500;
+import org.wildfly.security.x500.cert.PKCS10CertificateSigningRequest;
+import org.wildfly.security.x500.cert.SelfSignedX509CertificateAndSigningKey;
+import org.wildfly.security.x500.cert.X509CertificateChainAndSigningKey;
+import org.wildfly.security.x500.cert.acme.AcmeAccount;
+import org.wildfly.security.x500.cert.acme.AcmeClientSpi;
+import org.wildfly.security.x500.cert.acme.AcmeException;
+
+/**
+ * A {@link ResourceDefinition} that wraps an existing resource and adds operations for advanced {@link KeyStore} manipulation.
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+class AdvancedModifiableKeyStoreDecorator extends ModifiableKeyStoreDecorator {
+
+    static final String DATE_FORMAT = "yyyy-MM-dd HH:mm:ss";
+    static final DateTimeFormatter NOT_VALID_BEFORE_FORMATTER = DateTimeFormatter.ofPattern(DATE_FORMAT).withZone(ZoneId.systemDefault());
+
+    // Common attributes
+    static final SimpleAttributeDefinition ALIAS = new SimpleAttributeDefinitionBuilder(Constants.ALIAS, ModelType.STRING)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleAttributeDefinition SIGNATURE_ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.SIGNATURE_ALGORITHM, ModelType.STRING, true)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleAttributeDefinition NAME = new SimpleAttributeDefinitionBuilder(Constants.NAME, ModelType.STRING)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleAttributeDefinition CRITICAL = new SimpleAttributeDefinitionBuilder(Constants.CRITICAL, ModelType.BOOLEAN, true)
+            .setAllowExpression(true)
+            .setDefaultValue(ModelNode.FALSE)
+            .build();
+
+    static final SimpleAttributeDefinition VALUE = new SimpleAttributeDefinitionBuilder(Constants.VALUE, ModelType.STRING)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .build();
+
+    static final ObjectTypeAttributeDefinition EXTENSION = new ObjectTypeAttributeDefinition.Builder(Constants.EXTENSION, NAME, CRITICAL, VALUE)
+            .build();
+
+    static final ObjectListAttributeDefinition EXTENSIONS = new ObjectListAttributeDefinition.Builder(Constants.EXTENSIONS, EXTENSION)
+            .setRequired(false)
+            .setAllowDuplicates(false)
+            .build();
+
+    static final ObjectTypeAttributeDefinition CREDENTIAL_REFERENCE = CredentialReference.getAttributeBuilder(true, true).build();
+
+    static final SimpleAttributeDefinition PATH = new SimpleAttributeDefinitionBuilder(FileAttributeDefinitions.PATH)
+            .setRequired(true)
+            .build();
+
+    private static final AcmeClientSpi acmeClient;
+    static {
+        acmeClient = loadAcmeClient();
+    }
+
+    private static AcmeClientSpi loadAcmeClient() {
+        for (AcmeClientSpi acmeClient : ServiceLoader.load(AcmeClientSpi.class, ElytronTLSMessages.class.getClassLoader())) {
+            return acmeClient;
+        }
+        throw LOGGER.unableToInstatiateAcmeClientSpiImplementation();
+    }
+
+    static ResourceDefinition wrap(ResourceDefinition resourceDefinition) {
+        return new AdvancedModifiableKeyStoreDecorator(resourceDefinition);
+    }
+
+    private AdvancedModifiableKeyStoreDecorator(ResourceDefinition resourceDefinition) {
+        super(resourceDefinition);
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration);
+        ResourceDescriptionResolver resolver = ElytronTlsExtension.getResourceDescriptionResolver(Constants.MODIFIABLE_KEY_STORE);
+
+        if (isServerOrHostController(resourceRegistration)) { // server-only operations
+            // Create key pair / self-signed certificate
+            GenerateKeyPairHandler.register(resourceRegistration, resolver);
+
+            // Create PKCS #10 CSR
+            GenerateCertificateSigningRequestHandler.register(resourceRegistration, resolver);
+
+            // Import certificate or certificate chain from a file
+            ImportCertificateHandler.register(resourceRegistration, resolver);
+
+            // Export certificate to a file
+            ExportCertificateHandler.register(resourceRegistration, resolver);
+
+            // Move an existing entry to a new alias
+            ChangeAliasHandler.register(resourceRegistration, resolver);
+
+            // Obtain a signed certificate from a certificate authority
+            ObtainCertificateHandler.register(resourceRegistration, resolver);
+
+            // Revoke a signed certificate
+            RevokeCertificateHandler.register(resourceRegistration, resolver);
+
+            // Check if a signed certificate is due for renewal
+            ShouldRenewCertificateHandler.register(resourceRegistration, resolver);
+        }
+    }
+
+    static class GenerateKeyPairHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.ALGORITHM, ModelType.STRING, true)
+                .setAllowExpression(true)
+                .setMinSize(1)
+                .build();
+
+        static final SimpleAttributeDefinition KEY_SIZE = new SimpleAttributeDefinitionBuilder(Constants.KEY_SIZE, ModelType.INT, true)
+                .setAllowExpression(true)
+                .setValidator(new KeySizeValidator())
+                .build();
+
+        static final SimpleAttributeDefinition DISTINGUISHED_NAME = new SimpleAttributeDefinitionBuilder(Constants.DISTINGUISHED_NAME, ModelType.STRING)
+                .setAllowExpression(true)
+                .setMinSize(1)
+                .build();
+
+        static final SimpleAttributeDefinition NOT_BEFORE = new SimpleAttributeDefinitionBuilder(Constants.NOT_BEFORE, ModelType.STRING, true)
+                .setAllowExpression(true)
+                .setValidator(new NotBeforeValidator())
+                .build();
+
+        static final SimpleAttributeDefinition VALIDITY = new SimpleAttributeDefinitionBuilder(Constants.VALIDITY, ModelType.LONG, true)
+                .setAllowExpression(true)
+                .setValidator(new LongRangeValidator(1L))
+                .setDefaultValue(new ModelNode(90))
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.GENERATE_KEY_PAIR, descriptionResolver)
+                            .setParameters(ALIAS, ALGORITHM, SIGNATURE_ALGORITHM, KEY_SIZE, DISTINGUISHED_NAME,
+                                    NOT_BEFORE, VALIDITY, EXTENSIONS, CREDENTIAL_REFERENCE)
+                            .setRuntimeOnly()
+                            .build(),
+                    new GenerateKeyPairHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            String algorithm = ALGORITHM.resolveModelAttribute(context, operation).asStringOrNull();
+            String signatureAlgorithm = SIGNATURE_ALGORITHM.resolveModelAttribute(context, operation).asStringOrNull();
+            Integer keySize = KEY_SIZE.resolveModelAttribute(context, operation).asIntOrNull();
+            String distinguishedName = DISTINGUISHED_NAME.resolveModelAttribute(context, operation).asString();
+            String notBefore = NOT_BEFORE.resolveModelAttribute(context, operation).asStringOrNull();
+            Long validity = VALIDITY.resolveModelAttribute(context, operation).asLong();
+            ModelNode extensions = EXTENSIONS.resolveModelAttribute(context, operation);
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = null;
+            ModelNode credentialReference = CREDENTIAL_REFERENCE.resolveModelAttribute(context, operation);
+            if (credentialReference.isDefined()) {
+                credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, operation, null);
+            }
+            char[] keyPassword = resolveKeyPassword(((KeyStoreService) keyStoreService), credentialSourceSupplier);
+
+            try {
+                if (keyStore.containsAlias(alias)) {
+                    throw LOGGER.keyStoreAliasAlreadyExists(alias);
+                }
+                SelfSignedX509CertificateAndSigningKey.Builder certAndKeyBuilder = SelfSignedX509CertificateAndSigningKey.builder();
+                certAndKeyBuilder.setDn(new X500Principal(distinguishedName));
+                if (algorithm != null) {
+                    certAndKeyBuilder.setKeyAlgorithmName(algorithm);
+                }
+                if (signatureAlgorithm != null) {
+                    certAndKeyBuilder.setSignatureAlgorithmName(signatureAlgorithm);
+                }
+                if (keySize != null) {
+                    certAndKeyBuilder.setKeySize(keySize);
+                }
+                final ZonedDateTime notBeforeDateTime;
+                if (notBefore != null) {
+                    notBeforeDateTime = ZonedDateTime.from(NOT_VALID_BEFORE_FORMATTER.parse(notBefore));
+                } else {
+                    notBeforeDateTime = ZonedDateTime.now();
+                }
+                certAndKeyBuilder.setNotValidBefore(notBeforeDateTime);
+                certAndKeyBuilder.setNotValidAfter(notBeforeDateTime.plusDays(validity));
+                if (extensions.isDefined()) {
+                    for (ModelNode extension : extensions.asList()) {
+                        Boolean critical = CRITICAL.resolveModelAttribute(context, extension).asBoolean();
+                        String extensionName = NAME.resolveModelAttribute(context, extension).asString();
+                        String extensionValue = VALUE.resolveModelAttribute(context, extension).asString();
+                        certAndKeyBuilder.addExtension(critical, extensionName, extensionValue);
+                    }
+                }
+
+                SelfSignedX509CertificateAndSigningKey certAndKey = certAndKeyBuilder.build();
+                final PrivateKey privateKey = certAndKey.getSigningKey();
+                final X509Certificate[] certChain = new X509Certificate[1];
+                certChain[0] = certAndKey.getSelfSignedCertificate();
+                keyStore.setKeyEntry(alias, privateKey, keyPassword, certChain);
+            } catch (Exception e) {
+                rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, credentialReference);
+                if (e instanceof IllegalArgumentException) {
+                    throw new OperationFailedException(e);
+                } else {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+    }
+
+    static class GenerateCertificateSigningRequestHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition DISTINGUISHED_NAME = new SimpleAttributeDefinitionBuilder(Constants.DISTINGUISHED_NAME, ModelType.STRING, true)
+                .setAllowExpression(true)
+                .setMinSize(1)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.GENERATE_CERTIFICATE_SIGNING_REQUEST, descriptionResolver)
+                            .setParameters(ALIAS, SIGNATURE_ALGORITHM, DISTINGUISHED_NAME,
+                                    EXTENSIONS, CREDENTIAL_REFERENCE, PATH, RELATIVE_TO)
+                            .setRuntimeOnly()
+                            .build(),
+                    new GenerateCertificateSigningRequestHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            String signatureAlgorithm = SIGNATURE_ALGORITHM.resolveModelAttribute(context, operation).asStringOrNull();
+            String distinguishedName = DISTINGUISHED_NAME.resolveModelAttribute(context, operation).asStringOrNull();
+            ModelNode extensions = EXTENSIONS.resolveModelAttribute(context, operation);
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = null;
+            ModelNode credentialReference = CREDENTIAL_REFERENCE.resolveModelAttribute(context, operation);
+            if (credentialReference.isDefined()) {
+                credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, operation, null);
+            }
+            char[] keyPassword = resolveKeyPassword(((KeyStoreService) keyStoreService), credentialSourceSupplier);
+            String path = PATH.resolveModelAttribute(context, operation).asString();
+            String relativeTo = RELATIVE_TO.resolveModelAttribute(context, operation).asStringOrNull();
+            PathResolver pathResolver = pathResolver();
+            File resolvedPath = ((KeyStoreService) keyStoreService).getResolvedPath(pathResolver, path, relativeTo);
+
+            try {
+                if (! keyStore.containsAlias(alias)) {
+                    throw LOGGER.keyStoreAliasDoesNotExist(alias);
+                }
+                if (! keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
+                    throw LOGGER.keyStoreAliasDoesNotIdentifyPrivateKeyEntry(alias);
+                }
+                final PrivateKey privateKey;
+                try {
+                    privateKey = (PrivateKey) keyStore.getKey(alias, keyPassword);
+                } catch (UnrecoverableKeyException e) {
+                    throw LOGGER.unableToObtainPrivateKey(alias);
+                }
+                if (privateKey == null) {
+                    throw LOGGER.unableToObtainPrivateKey(alias);
+                }
+                final Certificate certificate = keyStore.getCertificate(alias);
+                if (certificate == null) {
+                    throw LOGGER.unableToObtainCertificate(alias);
+                }
+
+                PKCS10CertificateSigningRequest.Builder csrBuilder = PKCS10CertificateSigningRequest.builder();
+                csrBuilder.setSigningKey(privateKey);
+                csrBuilder.setCertificate(certificate);
+                if (signatureAlgorithm != null) {
+                    csrBuilder.setSignatureAlgorithmName(signatureAlgorithm);
+                }
+                if (distinguishedName != null) {
+                    csrBuilder.setSubjectDn(new X500Principal(distinguishedName));
+                }
+                if (extensions.isDefined()) {
+                    for (ModelNode extension : extensions.asList()) {
+                        Boolean critical = CRITICAL.resolveModelAttribute(context, extension).asBoolean();
+                        String extensionName = NAME.resolveModelAttribute(context, extension).asString();
+                        String extensionValue = VALUE.resolveModelAttribute(context, extension).asString();
+                        csrBuilder.addExtension(critical, extensionName, extensionValue);
+                    }
+                }
+
+                PKCS10CertificateSigningRequest csr = csrBuilder.build();
+                try (FileOutputStream fos = new FileOutputStream(resolvedPath)) {
+                    fos.write(csr.getPem());
+                }
+            } catch (Exception e) {
+                rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, credentialReference);
+                if (e instanceof OperationFailedException) {
+                    throw (OperationFailedException) e;
+                } else if (e instanceof IllegalArgumentException) {
+                    throw new OperationFailedException(e);
+                } else {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+    }
+
+    static class ImportCertificateHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition TRUST_CACERTS = new SimpleAttributeDefinitionBuilder(Constants.TRUST_CACERTS, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .setDefaultValue(ModelNode.FALSE)
+                .build();
+
+        static final SimpleAttributeDefinition VALIDATE = new SimpleAttributeDefinitionBuilder(Constants.VALIDATE, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .setDefaultValue(ModelNode.TRUE)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.IMPORT_CERTIFICATE, descriptionResolver)
+                            .setParameters(ALIAS, CREDENTIAL_REFERENCE, PATH, RELATIVE_TO, TRUST_CACERTS, VALIDATE)
+                            .setRuntimeOnly()
+                            .build(),
+                    new ImportCertificateHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = null;
+            ModelNode credentialReference = CREDENTIAL_REFERENCE.resolveModelAttribute(context, operation);
+            if (credentialReference.isDefined()) {
+                credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, operation, null);
+            }
+            char[] keyPassword = resolveKeyPassword(((KeyStoreService) keyStoreService), credentialSourceSupplier);
+            String path = PATH.resolveModelAttribute(context, operation).asString();
+            String relativeTo = RELATIVE_TO.resolveModelAttribute(context, operation).asStringOrNull();
+            PathResolver pathResolver = pathResolver();
+            File resolvedPath = ((KeyStoreService) keyStoreService).getResolvedPath(pathResolver, path, relativeTo);
+            boolean trustCacerts = TRUST_CACERTS.resolveModelAttribute(context, operation).asBoolean();
+            boolean validate = VALIDATE.resolveModelAttribute(context, operation).asBoolean();
+
+            try {
+                final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+                if (keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
+                    // import the response from a certificate signing request
+                    final PrivateKey privateKey;
+                    try {
+                        privateKey = (PrivateKey) keyStore.getKey(alias, keyPassword);
+                    } catch (UnrecoverableKeyException e) {
+                        throw LOGGER.unableToObtainPrivateKey(alias);
+                    }
+                    if (privateKey == null) {
+                        throw LOGGER.unableToObtainPrivateKey(alias);
+                    }
+                    final Certificate certificate = keyStore.getCertificate(alias);
+                    if (certificate == null) {
+                        throw LOGGER.unableToObtainCertificate(alias);
+                    }
+                    final PublicKey publicKey = certificate.getPublicKey();
+                    final Collection<? extends Certificate> reply;
+                    try (FileInputStream fis = new FileInputStream(resolvedPath)) {
+                        reply = certificateFactory.generateCertificates(fis);
+                    } catch (FileNotFoundException e) {
+                        throw LOGGER.certificateFileDoesNotExist(e);
+                    }
+                    if (reply.isEmpty()) {
+                        throw LOGGER.noCertificatesFoundInCertificateReply();
+                    }
+                    final Certificate[] replyCertificates = reply.toArray(new Certificate[reply.size()]);
+                    X509Certificate[] certificateChain;
+
+                    if (replyCertificates.length == 1) {
+                        // reply is a single certificate, build up certificate chain
+                        final X509Certificate replyCertificate = (X509Certificate) replyCertificates[0];
+                        if (! replyCertificate.getPublicKey().equals(publicKey)) {
+                            throw LOGGER.publicKeyFromCertificateReplyDoesNotMatchKeyStore();
+                        }
+                        if (replyCertificate.equals(certificate)) {
+                            throw LOGGER.certificateReplySameAsCertificateFromKeyStore();
+                        }
+                        final HashMap<Principal, HashSet<X509Certificate>> certificatesMap = getKeyStoreCertificates(keyStore, getCacertsKeyStore(trustCacerts));
+                        certificateChain = X500.createX509CertificateChain(replyCertificate, certificatesMap);
+                    } else {
+                        // reply is a certificate chain, ensure the certificates in the chain are in the correct order (PKCS #7 certificate chains are unordered)
+                        certificateChain = X500.asOrderedX509CertificateChain(publicKey, replyCertificates);
+                        if (validate) {
+                            // check that the top-most certificate in the chain is actually trusted
+                            final X509Certificate lastCertificate = certificateChain[certificateChain.length - 1];
+                            final X509Certificate certificateOrIssuer = getCertificateOrIssuerFromKeyStores(lastCertificate, keyStore, getCacertsKeyStore(trustCacerts));
+                            if (certificateOrIssuer == null) {
+                                writeCertificate(context.getResult().get(Constants.CERTIFICATE), lastCertificate);
+                                throw LOGGER.topMostCertificateFromCertificateReplyNotTrusted();
+                            }
+                            if (! lastCertificate.equals(certificateOrIssuer)) {
+                                X509Certificate[] newCertificateChain = Arrays.copyOf(certificateChain, certificateChain.length + 1);
+                                newCertificateChain[newCertificateChain.length - 1] = certificateOrIssuer;
+                                certificateChain = newCertificateChain;
+                            }
+                        }
+                    }
+                    keyStore.setKeyEntry(alias, privateKey, keyPassword, certificateChain);
+                } else if (! keyStore.containsAlias(alias)) {
+                    // import a trusted certificate
+                    final X509Certificate trustedCertificate;
+                    try (FileInputStream fis = new FileInputStream(resolvedPath)) {
+                        trustedCertificate = (X509Certificate) certificateFactory.generateCertificate(fis);
+                    } catch (FileNotFoundException e) {
+                        throw LOGGER.certificateFileDoesNotExist(e);
+                    }
+                    if (validate) {
+                        String trustedCertificateAlias = keyStore.getCertificateAlias(trustedCertificate);
+                        if (trustedCertificateAlias != null) {
+                            throw LOGGER.trustedCertificateAlreadyInKeyStore(trustedCertificateAlias);
+                        }
+                        final KeyStore cacertsKeyStore = getCacertsKeyStore(trustCacerts);
+                        if (trustedCertificate.getIssuerDN().equals(trustedCertificate.getSubjectDN())) {
+                            trustedCertificate.verify(trustedCertificate.getPublicKey());
+                            // self-signed, not found in keystore
+                            if (cacertsKeyStore != null) {
+                                trustedCertificateAlias = cacertsKeyStore.getCertificateAlias(trustedCertificate);
+                                if (trustedCertificateAlias != null) {
+                                    throw LOGGER.trustedCertificateAlreadyInCacertsKeyStore(trustedCertificateAlias);
+                                }
+                            }
+                            writeCertificate(context.getResult().get(Constants.CERTIFICATE), trustedCertificate, true);
+                            throw LOGGER.unableToDetermineIfCertificateIsTrusted();
+                        } else {
+                            try {
+                                final HashMap<Principal, HashSet<X509Certificate>> certificatesMap = getKeyStoreCertificates(keyStore, cacertsKeyStore);
+                                X500.createX509CertificateChain(trustedCertificate, certificatesMap);
+                            } catch (IllegalArgumentException e) {
+                                writeCertificate(context.getResult().get(Constants.CERTIFICATE), trustedCertificate, true);
+                                throw LOGGER.unableToDetermineIfCertificateIsTrusted();
+                            }
+                        }
+                    }
+                    keyStore.setCertificateEntry(alias, trustedCertificate);
+                }
+            } catch (Exception e) {
+                rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, credentialReference);
+                if (e instanceof OperationFailedException) {
+                    throw (OperationFailedException) e;
+                } else {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+
+        private static KeyStore getCacertsKeyStore(final boolean trustCacerts) throws Exception {
+            KeyStore cacertsKeyStore = null;
+            if (trustCacerts) {
+                File cacertsFile = new File(System.getProperty("java.home") + File.separator + "lib"
+                        + File.separator + "security" + File.separator + "cacerts");
+                try (FileInputStream fis = new FileInputStream(cacertsFile)) {
+                    cacertsKeyStore = KeyStore.getInstance("JKS");
+                    cacertsKeyStore.load(fis, null);
+                }
+            }
+            return cacertsKeyStore;
+        }
+
+        private static HashMap<Principal, HashSet<X509Certificate>> getKeyStoreCertificates(final KeyStore... keyStores) throws KeyStoreException {
+            final HashMap<Principal, HashSet<X509Certificate>> certificatesMap = new HashMap<>();
+            for (KeyStore keyStore : keyStores) {
+                if (keyStore != null) {
+                    Enumeration<String> aliases = keyStore.aliases();
+                    while (aliases.hasMoreElements()) {
+                        String alias = aliases.nextElement();
+                        Certificate certificate = keyStore.getCertificate(alias);
+                        if (certificate != null && certificate instanceof X509Certificate) {
+                            X509Certificate x509Certificate = ((X509Certificate) certificate);
+                            HashSet<X509Certificate> principalCertificates = certificatesMap.get(x509Certificate.getSubjectDN());
+                            if (principalCertificates == null) {
+                                principalCertificates = new HashSet<>();
+                                certificatesMap.put(x509Certificate.getSubjectDN(), principalCertificates);
+                            }
+                            principalCertificates.add(x509Certificate);
+                        }
+                    }
+                }
+            }
+            return certificatesMap;
+        }
+
+        private static X509Certificate getCertificateOrIssuerFromKeyStores(final X509Certificate certificate, final KeyStore... keyStores) throws KeyStoreException {
+            for (KeyStore keyStore : keyStores) {
+                if (keyStore != null) {
+                    if (keyStore.getCertificateAlias(certificate) != null) {
+                        return certificate;
+                    } else {
+                        Enumeration<String> aliases = keyStore.aliases();
+                        while (aliases.hasMoreElements()) {
+                            String alias = aliases.nextElement();
+                            Certificate issuerCertificate = keyStore.getCertificate(alias);
+                            if (issuerCertificate != null && issuerCertificate instanceof X509Certificate) {
+                                X509Certificate x509IssuerCertificate = ((X509Certificate) issuerCertificate);
+                                if (x509IssuerCertificate.getSubjectDN().equals(certificate.getIssuerDN())) {
+                                    try {
+                                        certificate.verify(x509IssuerCertificate.getPublicKey());
+                                        return x509IssuerCertificate;
+                                    } catch (Exception e) {
+                                        // keep looking
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            return null;
+        }
+    }
+
+    static class ExportCertificateHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition PEM = new SimpleAttributeDefinitionBuilder(Constants.PEM, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .setDefaultValue(ModelNode.FALSE)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.EXPORT_CERTIFICATE, descriptionResolver)
+                            .setParameters(ALIAS, PATH, RELATIVE_TO, PEM)
+                            .setRuntimeOnly()
+                            .build(),
+                    new ExportCertificateHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            String path = PATH.resolveModelAttribute(context, operation).asString();
+            String relativeTo = RELATIVE_TO.resolveModelAttribute(context, operation).asStringOrNull();
+            PathResolver pathResolver = pathResolver();
+            File resolvedPath = ((KeyStoreService) keyStoreService).getResolvedPath(pathResolver, path, relativeTo);
+            boolean pem = PEM.resolveModelAttribute(context, operation).asBoolean();
+
+            try {
+                if (! keyStore.containsAlias(alias)) {
+                    throw LOGGER.keyStoreAliasDoesNotExist(alias);
+                }
+                final X509Certificate certificate = (X509Certificate) keyStore.getCertificate(alias);
+                if (certificate == null) {
+                    throw LOGGER.unableToObtainCertificate(alias);
+                }
+                try (FileOutputStream fos = new FileOutputStream(resolvedPath)) {
+                    if (pem) {
+                        ByteStringBuilder pemCertificate = new ByteStringBuilder();
+                        Pem.generatePemX509Certificate(pemCertificate, certificate);
+                        fos.write(pemCertificate.toArray());
+                    } else {
+                        fos.write(certificate.getEncoded());
+                    }
+                }
+            } catch (Exception e) {
+                if (e instanceof OperationFailedException) {
+                    throw (OperationFailedException) e;
+                } else {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+    }
+
+    static class ChangeAliasHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition NEW_ALIAS = new SimpleAttributeDefinitionBuilder(Constants.NEW_ALIAS, ModelType.STRING)
+                .setAllowExpression(true)
+                .setMinSize(1)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.CHANGE_ALIAS, descriptionResolver)
+                            .setParameters(ALIAS, NEW_ALIAS, CREDENTIAL_REFERENCE)
+                            .setRuntimeOnly()
+                            .build(),
+                    new ChangeAliasHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            String newAlias = NEW_ALIAS.resolveModelAttribute(context, operation).asString();
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = null;
+            ModelNode credentialReference = CREDENTIAL_REFERENCE.resolveModelAttribute(context, operation);
+            if (credentialReference.isDefined()) {
+                credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, operation, null);
+            }
+            char[] keyPassword = resolveKeyPassword(((KeyStoreService) keyStoreService), credentialSourceSupplier);
+
+            try {
+                if (! keyStore.containsAlias(alias)) {
+                    throw LOGGER.keyStoreAliasDoesNotExist(alias);
+                }
+                if (keyStore.containsAlias(newAlias)) {
+                    throw LOGGER.keyStoreAliasAlreadyExists(newAlias);
+                }
+                KeyStore.Entry entry;
+                KeyStore.PasswordProtection passwordProtection = null;
+                try {
+                    // try without a password first
+                    entry = keyStore.getEntry(alias, passwordProtection);
+                } catch (UnrecoverableEntryException e) {
+                    passwordProtection = new KeyStore.PasswordProtection(keyPassword);
+                    try {
+                        entry = keyStore.getEntry(alias, passwordProtection);
+                    } catch (UnrecoverableEntryException ex) {
+                        throw LOGGER.unableToObtainEntry(alias);
+                    }
+                }
+                if (entry == null) {
+                    throw LOGGER.unableToObtainEntry(alias);
+                }
+                keyStore.setEntry(newAlias, entry, passwordProtection);
+                if (keyStore.containsAlias(alias)) {
+                    keyStore.deleteEntry(alias);
+                }
+            } catch (Exception e) {
+                rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, credentialReference);
+                if (e instanceof OperationFailedException) {
+                    throw (OperationFailedException) e;
+                } else {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+    }
+
+    static class ObtainCertificateHandler extends ElytronRuntimeOnlyHandler {
+
+        static final StringListAttributeDefinition DOMAIN_NAMES = new StringListAttributeDefinition.Builder(Constants.DOMAIN_NAMES)
+                .build();
+
+        static final SimpleAttributeDefinition CERTIFICATE_AUTHORITY_ACCOUNT = new SimpleAttributeDefinitionBuilder(Constants.CERTIFICATE_AUTHORITY_ACCOUNT, ModelType.STRING, false)
+                .setMinSize(1)
+                .setRestartAllServices()
+                .setCapabilityReference(CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY, KEY_STORE_CAPABILITY, true)
+                .build();
+
+        static final SimpleAttributeDefinition AGREE_TO_TERMS_OF_SERVICE = new SimpleAttributeDefinitionBuilder(Constants.AGREE_TO_TERMS_OF_SERVICE, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .build();
+
+        static final SimpleAttributeDefinition STAGING = new SimpleAttributeDefinitionBuilder(Constants.STAGING, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .setDefaultValue(ModelNode.FALSE)
+                .build();
+
+        static final SimpleAttributeDefinition ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.ALGORITHM, ModelType.STRING, true)
+                .setAllowExpression(true)
+                .setValidator(new StringAllowedValuesValidator("RSA", "EC"))
+                .setDefaultValue(new ModelNode("RSA"))
+                .setMinSize(1)
+                .build();
+
+        static final SimpleAttributeDefinition KEY_SIZE = new SimpleAttributeDefinitionBuilder(Constants.KEY_SIZE, ModelType.INT, true)
+                .setAllowExpression(true)
+                .setDefaultValue(new ModelNode(2048))
+                .setValidator(new KeySizeValidator())
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.OBTAIN_CERTIFICATE, descriptionResolver)
+                            .setParameters(ALIAS, DOMAIN_NAMES, CERTIFICATE_AUTHORITY_ACCOUNT, AGREE_TO_TERMS_OF_SERVICE, STAGING, ALGORITHM, KEY_SIZE, CREDENTIAL_REFERENCE)
+                            .setRuntimeOnly()
+                            .build(),
+                    new ObtainCertificateHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            List<String> domainNames = DOMAIN_NAMES.unwrap(context, operation);
+            String certificateAuthorityAccountName = CERTIFICATE_AUTHORITY_ACCOUNT.resolveModelAttribute(context, operation).asString();
+            Boolean agreeToTermsOfService = AGREE_TO_TERMS_OF_SERVICE.resolveModelAttribute(context, operation).asBooleanOrNull();
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+            String algorithm = ALGORITHM.resolveModelAttribute(context, operation).asString();
+            Integer keySize = KEY_SIZE.resolveModelAttribute(context, operation).asInt();
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = null;
+            ModelNode credentialReference = CREDENTIAL_REFERENCE.resolveModelAttribute(context, operation);
+            if (credentialReference.isDefined()) {
+                credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, operation, null);
+            }
+            char[] keyPassword = resolveKeyPassword(((KeyStoreService) keyStoreService), credentialSourceSupplier);
+
+            try {
+                final AcmeAccount acmeAccount = getAcmeAccount(context, certificateAuthorityAccountName, staging);
+                if (agreeToTermsOfService != null) {
+                    acmeAccount.setTermsOfServiceAgreed(agreeToTermsOfService);
+                }
+                // ensure we have an account with the certificate authority and that it's up to date
+                boolean created = false;
+                if (acmeAccount.getAccountUrl() == null) {
+                    created = acmeClient.createAccount(acmeAccount, staging);
+                }
+                if (! created) {
+                    acmeClient.updateAccount(acmeAccount, staging, acmeAccount.isTermsOfServiceAgreed(), acmeAccount.getContactUrls());
+                }
+                X509CertificateChainAndSigningKey certificateChainAndSigningKey = acmeClient.obtainCertificateChain(acmeAccount, staging, algorithm, keySize, domainNames.toArray(new String[domainNames.size()]));
+                keyStore.setKeyEntry(alias, certificateChainAndSigningKey.getSigningKey(), keyPassword, certificateChainAndSigningKey.getCertificateChain());
+                ((KeyStoreService) keyStoreService).save();
+            } catch (Exception e) {
+                rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, credentialReference);
+                if (e instanceof IllegalArgumentException || e instanceof AcmeException) {
+                    throw new OperationFailedException(e);
+                } else {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+    }
+
+    static class RevokeCertificateHandler extends ElytronRuntimeOnlyHandler {
+        static final String UNSPECIFIED = "UNSPECIFIED";
+        static final String KEY_COMPROMISE = "KEYCOMPROMISE";
+        static final String CA_COMPROMISE = "CACOMPROMISE";
+        static final String AFFILIATION_CHANGED = "AFFILIATIONCHANGED";
+        static final String SUPERSEDED = "SUPERSEDED";
+        static final String CESSATION_OF_OPERATION = "CESSATIONOFOPERATION";
+        static final String CERTIFICATE_HOLD = "CERTIFICATEHOLD";
+        static final String REMOVE_FROM_CRL = "REMOVEFROMCRL";
+        static final String PRIVILEGE_WITHDRAWN = "PRIVILEGEWITHDRAWN";
+        static final String AA_COMPROMISE = "AACOMPROMISE";
+        static final String[] ALLOWED_VALUES = { UNSPECIFIED, KEY_COMPROMISE, CA_COMPROMISE, AFFILIATION_CHANGED, SUPERSEDED,
+                CESSATION_OF_OPERATION, CERTIFICATE_HOLD, REMOVE_FROM_CRL, PRIVILEGE_WITHDRAWN, AA_COMPROMISE };
+
+        static final SimpleAttributeDefinition REASON = new SimpleAttributeDefinitionBuilder(Constants.REASON, ModelType.STRING, true)
+                .setAllowExpression(true)
+                .setAllowedValues(ALLOWED_VALUES)
+                .setMinSize(1)
+                .build();
+
+        static final SimpleAttributeDefinition CERTIFICATE_AUTHORITY_ACCOUNT = new SimpleAttributeDefinitionBuilder(Constants.CERTIFICATE_AUTHORITY_ACCOUNT, ModelType.STRING, false)
+                .setMinSize(1)
+                .setRestartAllServices()
+                .setCapabilityReference(CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY, KEY_STORE_CAPABILITY, true)
+                .build();
+
+        static final SimpleAttributeDefinition STAGING = new SimpleAttributeDefinitionBuilder(Constants.STAGING, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .setDefaultValue(ModelNode.FALSE)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.REVOKE_CERTIFICATE, descriptionResolver)
+                            .setParameters(ALIAS, REASON, CERTIFICATE_AUTHORITY_ACCOUNT, STAGING)
+                            .setRuntimeOnly()
+                            .build(),
+                    new RevokeCertificateHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            String reason = REASON.resolveModelAttribute(context, operation).asStringOrNull();
+            String certificateAuthorityAccountName = CERTIFICATE_AUTHORITY_ACCOUNT.resolveModelAttribute(context, operation).asString();
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+
+            try {
+                if (! keyStore.containsAlias(alias)) {
+                    throw LOGGER.keyStoreAliasDoesNotExist(alias);
+                }
+                X509Certificate certificateToRevoke = (X509Certificate) keyStore.getCertificate(alias);
+                if (certificateToRevoke == null) {
+                    throw LOGGER.unableToObtainCertificate(alias);
+                }
+                final AcmeAccount acmeAccount = getAcmeAccount(context, certificateAuthorityAccountName, staging);
+                if (reason != null) {
+                    acmeClient.revokeCertificate(acmeAccount, staging, certificateToRevoke, getCRLReason(reason));
+                } else {
+                    acmeClient.revokeCertificate(acmeAccount, staging, certificateToRevoke);
+                }
+                keyStore.deleteEntry(alias);
+                ((KeyStoreService) keyStoreService).save();
+            } catch (IllegalArgumentException | AcmeException e) {
+                throw new OperationFailedException(e);
+            } catch (KeyStoreException e) {
+                throw new RuntimeException(e);
+            }
+        }
+
+        static CRLReason getCRLReason(String reason) throws OperationFailedException {
+            switch (reason.toUpperCase(Locale.ENGLISH)) {
+                case UNSPECIFIED:
+                    return CRLReason.UNSPECIFIED;
+                case KEY_COMPROMISE:
+                    return CRLReason.KEY_COMPROMISE;
+                case CA_COMPROMISE:
+                    return CRLReason.CA_COMPROMISE;
+                case AFFILIATION_CHANGED:
+                    return CRLReason.AFFILIATION_CHANGED;
+                case SUPERSEDED:
+                    return CRLReason.SUPERSEDED;
+                case CESSATION_OF_OPERATION:
+                    return CRLReason.CESSATION_OF_OPERATION;
+                case CERTIFICATE_HOLD:
+                    return CRLReason.CERTIFICATE_HOLD;
+                case REMOVE_FROM_CRL:
+                    return CRLReason.REMOVE_FROM_CRL;
+                case PRIVILEGE_WITHDRAWN:
+                    return CRLReason.PRIVILEGE_WITHDRAWN;
+                case AA_COMPROMISE:
+                    return CRLReason.AA_COMPROMISE;
+                default:
+                    throw LOGGER.invalidCertificateRevocationReason(reason);
+            }
+        }
+    }
+
+    static class ShouldRenewCertificateHandler extends ElytronRuntimeOnlyHandler {
+        static final SimpleAttributeDefinition EXPIRATION = new SimpleAttributeDefinitionBuilder(Constants.EXPIRATION, ModelType.LONG, true)
+                .setAllowExpression(true)
+                .setValidator(new LongRangeValidator(1L))
+                .setDefaultValue(new ModelNode(30))
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.SHOULD_RENEW_CERTIFICATE, descriptionResolver)
+                            .setParameters(ALIAS, EXPIRATION)
+                            .setRuntimeOnly()
+                            .build(),
+                    new ShouldRenewCertificateHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context);
+            KeyStore keyStore = keyStoreService.getModifiableValue();
+
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            Long expiration = EXPIRATION.resolveModelAttribute(context, operation).asLong();
+
+            try {
+                if (! keyStore.containsAlias(alias)) {
+                    throw LOGGER.keyStoreAliasDoesNotExist(alias);
+                }
+                X509Certificate certificate = (X509Certificate) keyStore.getCertificate(alias);
+                if (certificate == null) {
+                    throw LOGGER.unableToObtainCertificate(alias);
+                }
+                ZonedDateTime current = ZonedDateTime.now().withZoneSameInstant(ZoneId.of("UTC")).withNano(0);
+                ZonedDateTime notAfter = ZonedDateTime.ofInstant(certificate.getNotAfter().toInstant(), ZoneId.of("UTC"));
+                long daysToExpiry = ChronoUnit.DAYS.between(current, notAfter);
+                ModelNode result = context.getResult();
+                if (daysToExpiry <= 0) {
+                    // already expired
+                    result.get(Constants.SHOULD_RENEW_CERTIFICATE).set(ModelNode.TRUE);
+                    daysToExpiry = 0;
+                } else {
+                    if (daysToExpiry <= expiration) {
+                        result.get(Constants.SHOULD_RENEW_CERTIFICATE).set(ModelNode.TRUE);
+                    } else {
+                        result.get(Constants.SHOULD_RENEW_CERTIFICATE).set(ModelNode.FALSE);
+                    }
+                }
+                result.get(Constants.DAYS_TO_EXPIRY).set(new ModelNode(daysToExpiry));
+            } catch (KeyStoreException e) {
+                throw new RuntimeException(e);
+            }
+        }
+    }
+
+    static class NotBeforeValidator extends StringLengthValidator {
+
+        NotBeforeValidator() {
+            super(1, true, true);
+        }
+
+        @Override
+        public void validateParameter(String parameterName, ModelNode value) throws OperationFailedException {
+            super.validateParameter(parameterName, value);
+            if (value.isDefined()) {
+                try {
+                    NOT_VALID_BEFORE_FORMATTER.parse(value.asString());
+                } catch (DateTimeParseException e){
+                    throw LOGGER.invalidNotBefore(e, e.getLocalizedMessage());
+                }
+            }
+        }
+    }
+
+    static class KeySizeValidator extends IntRangeValidator {
+
+        KeySizeValidator() {
+            super(1);
+        }
+
+        @Override
+        public void validateParameter(String parameterName, ModelNode value) throws OperationFailedException {
+            super.validateParameter(parameterName, value);
+            if (value.isDefined()) {
+                int intValue = value.asInt();
+                // check that the given value is a power of 2
+                if ((intValue & (intValue - 1)) != 0) {
+                    throw LOGGER.invalidKeySize(intValue);
+                }
+            }
+        }
+    }
+
+    private static char[] resolveKeyPassword(final KeyStoreService keyStoreService, final ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier) throws RuntimeException {
+        try {
+            return keyStoreService.resolveKeyPassword(credentialSourceSupplier);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private static AcmeAccount getAcmeAccount(OperationContext context, String certificateAuthorityAccountName, boolean staging) throws OperationFailedException {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+        RuntimeCapability<Void> runtimeCapability = CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY.fromBaseCapability(certificateAuthorityAccountName);
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+
+        ServiceController<AcmeAccount> serviceContainer = getRequiredService(serviceRegistry, serviceName, AcmeAccount.class);
+        ServiceController.State serviceState = serviceContainer.getState();
+        if (serviceState != ServiceController.State.UP) {
+            throw LOGGER.requiredServiceNotUp(serviceName, serviceState);
+        }
+        AcmeAccount acmeAccount = serviceContainer.getService().getValue();
+        return resetAcmeAccount(acmeAccount, staging);
+    }
+
+    static AcmeAccount resetAcmeAccount(AcmeAccount acmeAccount, boolean staging) {
+        String accountUrl = acmeAccount.getAccountUrl();
+        if (accountUrl != null && acmeAccount.getStagingServerUrl() != null) {
+            String stagingEndpoint = acmeAccount.getStagingServerUrl().substring(0, acmeAccount.getStagingServerUrl().indexOf("/" + DIRECTORY));
+            if ((accountUrl.startsWith(stagingEndpoint) && ! staging) || (! accountUrl.startsWith(stagingEndpoint) && staging)) {
+                // need to reset the account information so it will get populated with the correct staging / non-staging account URL
+                AcmeAccount.Builder acmeAccountBuilder = AcmeAccount.builder();
+                acmeAccountBuilder
+                        .setServerUrl(acmeAccount.getServerUrl())
+                        .setStagingServerUrl(acmeAccount.getStagingServerUrl())
+                        .setDn(acmeAccount.getDn())
+                        .setKey(acmeAccount.getCertificate(), acmeAccount.getPrivateKey())
+                        .setTermsOfServiceAgreed(acmeAccount.isTermsOfServiceAgreed());
+                if (acmeAccount.getContactUrls() != null) {
+                    acmeAccountBuilder.setContactUrls(acmeAccount.getContactUrls());
+                }
+                return acmeAccountBuilder.build();
+            }
+        }
+        return acmeAccount;
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AggregateComponentDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AggregateComponentDefinition.java
new file mode 100644
index 0000000..1bfc90e
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AggregateComponentDefinition.java
@@ -0,0 +1,258 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.commonRequirements;
+
+import java.lang.reflect.Array;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.function.Supplier;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.CapabilityServiceBuilder;
+import org.jboss.as.controller.ListAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.StringListAttributeDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController.Mode;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceTarget;
+import org.jboss.msc.service.StartException;
+import org.wildfly.common.function.ExceptionFunction;
+import org.wildfly.common.function.ExceptionSupplier;
+
+/**
+ * A {@link ResourceDefinition} for components that are aggregations of the same type.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class AggregateComponentDefinition<T> extends SimpleResourceDefinition {
+
+    private final ListAttributeDefinition aggregateReferences;
+    private final OperationStepHandler attributeWriteHandler;
+
+    private AggregateComponentDefinition(Class<T> classType, String pathKey, OperationStepHandler addHandler, OperationStepHandler removeHandler,
+                                         ListAttributeDefinition aggregateReferences, OperationStepHandler attributeWriteHandler, RuntimeCapability<?> runtimeCapability) {
+        super(new Parameters(PathElement.pathElement(pathKey), ElytronTlsExtension.getResourceDescriptionResolver(pathKey))
+            .setAddHandler(addHandler)
+            .setRemoveHandler(removeHandler)
+            .setAddRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setCapabilities(runtimeCapability));
+
+        this.aggregateReferences = aggregateReferences;
+        this.attributeWriteHandler = attributeWriteHandler;
+    }
+
+    ListAttributeDefinition getReferencesAttribute() {
+        return aggregateReferences;
+    }
+
+    /**
+     * @see SimpleResourceDefinition#registerAttributes(ManagementResourceRegistration)
+     */
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        resourceRegistration.registerReadWriteAttribute(aggregateReferences, null, attributeWriteHandler);
+    }
+
+    static <T> AggregateComponentDefinition<T> create(Class<T> aggregationType, String componentName, String referencesName, RuntimeCapability<?> runtimeCapability, Function<T[], T> aggregator) {
+        return create(aggregationType, componentName, referencesName, runtimeCapability, aggregator, true);
+    }
+
+    static <T> AggregateComponentDefinition<T> create(Class<T> aggregationType, String componentName, String referencesName,
+            RuntimeCapability<?> runtimeCapability, Function<T[], T> aggregator, boolean dependOnProviderRegistration) {
+        String capabilityName = runtimeCapability.getName();
+        StringListAttributeDefinition aggregateReferences = new StringListAttributeDefinition.Builder(referencesName)
+            .setMinSize(2)
+            .setRequired(true)
+            .setCapabilityReference(capabilityName, capabilityName)//todo this is ultra fishy
+            .setRestartAllServices()
+            .build();
+
+        AbstractAddStepHandler add = new AggregateComponentAddHandler<>(aggregationType, aggregator, aggregateReferences, runtimeCapability, dependOnProviderRegistration);
+        OperationStepHandler remove = new TrivialCapabilityServiceRemoveHandler(add, runtimeCapability);
+        OperationStepHandler write = new ElytronReloadRequiredWriteAttributeHandler(aggregateReferences);
+
+        return new AggregateComponentDefinition<>(aggregationType, componentName, add, remove, aggregateReferences, write, runtimeCapability);
+    }
+
+    static <T> AggregateComponentDefinition<T> create(Class<T> aggregationType, String componentName, String referencesName,
+            RuntimeCapability<?> runtimeCapability, String apiCapabilityName, Function<T[], T> aggregator, boolean dependOnProviderRegistration) {
+        String capabilityName = runtimeCapability.getName();
+        StringListAttributeDefinition aggregateReferences = new StringListAttributeDefinition.Builder(referencesName)
+            .setMinSize(2)
+            .setRequired(true)
+            .setCapabilityReference(capabilityName, capabilityName)//todo this is ultra fishy
+            .setRestartAllServices()
+            .build();
+
+        AbstractAddStepHandler add = new AggregateApiComponentAddHandler<>(aggregationType, aggregator, aggregateReferences, runtimeCapability, apiCapabilityName, dependOnProviderRegistration);
+        OperationStepHandler remove = new TrivialCapabilityServiceRemoveHandler(add, runtimeCapability);
+        OperationStepHandler write = new ElytronReloadRequiredWriteAttributeHandler(aggregateReferences);
+
+        return new AggregateComponentDefinition<>(aggregationType, componentName, add, remove, aggregateReferences, write, runtimeCapability);
+    }
+
+    private static class AggregateComponentAddHandler<T> extends BaseAddHandler {
+
+        private final Class<T> aggregationType;
+        private final Function<T[], T> aggregator;
+        private final StringListAttributeDefinition aggregateReferences;
+        private final RuntimeCapability<?> runtimeCapability;
+        private final boolean dependOnProviderRegistration;
+
+        private AggregateComponentAddHandler(Class<T> aggregationType, Function<T[], T> aggregator,
+                StringListAttributeDefinition aggregateReferences, RuntimeCapability<?> runtimeCapability,
+                boolean dependOnProviderRegistration) {
+            super(runtimeCapability, aggregateReferences);
+            this.aggregationType = aggregationType;
+            this.aggregator = aggregator;
+            this.aggregateReferences = aggregateReferences;
+            this.runtimeCapability = runtimeCapability;
+            this.dependOnProviderRegistration = dependOnProviderRegistration;
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, ModelNode model)
+                throws OperationFailedException {
+            ServiceTarget serviceTarget = context.getServiceTarget();
+            RuntimeCapability<?> instanceRuntimeCapability = runtimeCapability.fromBaseCapability(context.getCurrentAddressValue());
+            ServiceName componentName = instanceRuntimeCapability.getCapabilityServiceName(aggregationType);
+
+            AggregateComponentService<T> aggregateComponentService = new AggregateComponentService<>(aggregationType, aggregator);
+
+            ServiceBuilder<T> serviceBuilder = serviceTarget.addService(componentName, aggregateComponentService);
+
+            List<String> aggregates = aggregateReferences.unwrap(context, model);
+
+            String baseCapabilityName = runtimeCapability.getName();
+            for (String current : aggregates) {
+                String runtimeCapabilityName = RuntimeCapability.buildDynamicCapabilityName(baseCapabilityName, current);
+                ServiceName realmServiceName = context.getCapabilityServiceName(runtimeCapabilityName, aggregationType);
+
+                serviceBuilder.addDependency(realmServiceName, aggregationType, aggregateComponentService.newInjector());
+            }
+
+            commonRequirements(serviceBuilder, true, dependOnProviderRegistration)
+                .setInitialMode(Mode.LAZY)
+                .install();
+        }
+
+    }
+
+    private static class AggregateApiComponentAddHandler<T> extends DoohickeyAddHandler<T> {
+
+        private final Class<T> aggregationType;
+        private final Function<T[], T> aggregator;
+        private final StringListAttributeDefinition aggregateReferences;
+        private final RuntimeCapability<?> runtimeCapability;
+        private final boolean dependOnProviderRegistration;
+        private final String apiCapabilityName;
+
+        private AggregateApiComponentAddHandler(Class<T> aggregationType, Function<T[], T> aggregator,
+                StringListAttributeDefinition aggregateReferences, RuntimeCapability<?> runtimeCapability, String apiCapabilityName,
+                boolean dependOnProviderRegistration) {
+            super(runtimeCapability, new AttributeDefinition[] { aggregateReferences }, apiCapabilityName);
+
+            this.aggregationType = aggregationType;
+            this.aggregator = aggregator;
+            this.aggregateReferences = aggregateReferences;
+            this.runtimeCapability = runtimeCapability;
+            this.dependOnProviderRegistration = dependOnProviderRegistration;
+            this.apiCapabilityName = apiCapabilityName;
+         }
+
+        @Override
+        protected ElytronDoohickey<T> createDoohickey(PathAddress resourceAddress) {
+            return new ElytronDoohickey<T>(resourceAddress) {
+
+                private volatile List<String> aggregates;
+
+                @Override
+                protected void resolveRuntime(ModelNode model, OperationContext context) throws OperationFailedException {
+                    aggregates = aggregateReferences.unwrap(context, model);
+                }
+
+                @Override
+                protected ExceptionSupplier<T, StartException> prepareServiceSupplier(OperationContext context,
+                        CapabilityServiceBuilder<?> serviceBuilder) throws OperationFailedException {
+
+                    final List<Supplier<T>> typeSuppliers = new ArrayList<>(aggregates.size());
+                    for (String current : aggregates) {
+                        String capabilityName = RuntimeCapability.buildDynamicCapabilityName(runtimeCapability.getName(), current);
+                        ServiceName serviceName = context.getCapabilityServiceName(capabilityName, aggregationType);
+
+                        typeSuppliers.add(serviceBuilder.requires(serviceName));
+                    }
+
+                    return new ExceptionSupplier<T, StartException>() {
+
+                        @Override
+                        public T get() throws StartException {
+                            List<T> loadedTypes = new ArrayList<>(typeSuppliers.size());
+                            for (Supplier<T> current : typeSuppliers) {
+                                loadedTypes.add(current.get());
+                            }
+
+                            return aggregator.apply(loadedTypes.toArray((T[]) Array.newInstance(aggregationType, loadedTypes.size())));
+                        }
+                    };
+                }
+
+                @Override
+                protected T createImmediately(OperationContext foreignContext) throws OperationFailedException {
+                    List<T> loadedTypes = new ArrayList<>(aggregates.size());
+                    for (String current : aggregates) {
+                        final ExceptionFunction<OperationContext, T, OperationFailedException> typeApi = foreignContext
+                                .getCapabilityRuntimeAPI(apiCapabilityName, current, ExceptionFunction.class);
+                        loadedTypes.add(typeApi.apply(foreignContext));
+                    }
+
+                    return aggregator.apply(loadedTypes.toArray((T[]) Array.newInstance(aggregationType, loadedTypes.size())));
+                }
+
+            };
+        }
+
+        @Override
+        protected boolean dependOnProviderRegistration() {
+            return dependOnProviderRegistration;
+        }
+
+        @Override
+        protected Mode getInitialMode() {
+            return Mode.LAZY;
+        }
+
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AggregateComponentService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AggregateComponentService.java
new file mode 100644
index 0000000..496a0b5
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/AggregateComponentService.java
@@ -0,0 +1,88 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import java.lang.reflect.Array;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+
+import org.jboss.msc.inject.Injector;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+import org.jboss.msc.value.InjectedValue;
+
+/**
+ *
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class AggregateComponentService<T> implements Service<T> {
+
+    private final Class<T> aggregationType;
+    private final Function<T[], T> aggregator;
+
+    private List<InjectedValue<T>> injections = new ArrayList<InjectedValue<T>>();
+
+    private T aggregation;
+
+    AggregateComponentService(Class<T> aggregationType, Function<T[], T> aggregator) {
+        this.aggregationType = aggregationType;
+        this.aggregator = aggregator;
+    }
+
+    /**
+     * @see Service#start(StartContext)
+     */
+    @SuppressWarnings("unchecked")
+    @Override
+    public void start(StartContext context) throws StartException {
+        ArrayList<T> toAggregate = new ArrayList<>(injections.size());
+        for (InjectedValue<T> current : injections) {
+            toAggregate.add(current.getValue());
+        }
+
+        aggregation = aggregator.apply(toAggregate.toArray((T[])Array.newInstance(aggregationType, toAggregate.size())));
+    }
+
+    /**
+     * @see Service#stop(StopContext)
+     */
+    @Override
+    public void stop(StopContext context) {
+        aggregation = null;
+    }
+
+    Injector<T> newInjector() {
+        InjectedValue<T> injectedValue = new InjectedValue<>();
+        injections.add(injectedValue);
+
+        return injectedValue;
+    }
+
+    /**
+     * @see org.jboss.msc.value.Value#getValue()
+     */
+    @Override
+    public T getValue() throws IllegalStateException, IllegalArgumentException {
+        return aggregation;
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/BaseAddHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/BaseAddHandler.java
new file mode 100644
index 0000000..762d40e
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/BaseAddHandler.java
@@ -0,0 +1,99 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.ELYTRON_TLS_CAPABILITY_NAME;
+
+import java.util.Collections;
+import java.util.Set;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.dmr.ModelNode;
+
+/**
+ * An extension of {@link AbstractAddStepHandler} to ensure all Elytron runtime operations are performed in the required server
+ * states.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class BaseAddHandler extends AbstractAddStepHandler implements ElytronOperationStepHandler {
+
+    private final Set<RuntimeCapability> runtimeCapabilities;
+
+    /**
+     * Constructor of the add handler that takes an array of {@link AttributeDefinition}.
+     *
+     * @param attributes  the {@link AttributeDefinition} instances associated with this resource.
+     */
+    BaseAddHandler(AttributeDefinition... attributes) {
+        super(attributes);
+        this.runtimeCapabilities = Collections.emptySet();
+    }
+
+    /**
+     * Constructor of the add handler that takes a {@link RuntimeCapability} and array of {@link AttributeDefinition}.
+     *
+     * @param runtimeCapability the {@link RuntimeCapability} that will be provided at runtime.
+     * @param attributes the {@link AttributeDefinition} instances associated with this resource.
+     */
+    BaseAddHandler(RuntimeCapability<?> runtimeCapability, AttributeDefinition... attributes) {
+        super(runtimeCapability, attributes);
+        this.runtimeCapabilities = Collections.singleton(runtimeCapability);
+    }
+
+
+
+    /**
+     * Constructor of the add handler that takes a {@link Set} of {@link RuntimeCapability} and array of {@link AttributeDefinition}.
+     *
+     * @param capabilities a {@link Set} of capabilitiies that will be added.
+     * @param attributes the {@link AttributeDefinition} instances associated with this resource.
+     */
+    BaseAddHandler(Set<RuntimeCapability> capabilities, AttributeDefinition... attributes) {
+        super(capabilities, attributes);
+        this.runtimeCapabilities = capabilities;
+    }
+
+
+
+    @Override
+    protected void recordCapabilitiesAndRequirements(OperationContext context, ModelNode operation, Resource resource) throws OperationFailedException {
+        super.recordCapabilitiesAndRequirements(context, operation, resource);
+        final String pathValue = context.getCurrentAddressValue();
+        for (RuntimeCapability r : runtimeCapabilities) {
+            context.registerAdditionalCapabilityRequirement(ELYTRON_TLS_CAPABILITY_NAME, r.isDynamicallyNamed() ? r.getDynamicName(pathValue) : r.getName(), null);
+        }
+    }
+
+    /**
+     * Ensures runtime operations are performed in the usual modes and also for an admin only server.
+     *
+     * @return Returns {@code true} in the existing situations and also for admin-only mode of a normal server.
+     * @see AbstractAddStepHandler#requiresRuntime(OperationContext)
+     */
+    @Override
+    protected boolean requiresRuntime(OperationContext context) {
+        return isServerOrHostController(context);
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CAParsers.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CAParsers.java
new file mode 100644
index 0000000..223813f
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CAParsers.java
@@ -0,0 +1,42 @@
+ /*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.CERTIFICATE_AUTHORITIES;
+import static org.wildfly.extension.elytron.tls.Constants.CERTIFICATE_AUTHORITY;
+import static org.wildfly.extension.elytron.tls.Constants.CERTIFICATE_AUTHORITY_ACCOUNT;
+import static org.wildfly.extension.elytron.tls.Constants.CERTIFICATE_AUTHORITY_ACCOUNTS;
+
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+
+class CAParsers {
+    final PersistentResourceXMLDescription certificateAuthorityParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(CERTIFICATE_AUTHORITY))
+            .setXmlWrapperElement(CERTIFICATE_AUTHORITIES)
+            .addAttribute(CertificateAuthorityDefinition.URL)
+            .addAttribute(CertificateAuthorityDefinition.STAGING_URL)
+            .build();
+
+    final PersistentResourceXMLDescription certificateAuthorityAccountParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(CERTIFICATE_AUTHORITY_ACCOUNT))
+            .setXmlWrapperElement(CERTIFICATE_AUTHORITY_ACCOUNTS)
+            .addAttribute(CertificateAuthorityAccountDefinition.CERTIFICATE_AUTHORITY)
+            .addAttribute(CertificateAuthorityAccountDefinition.CONTACT_URLS)
+            .addAttribute(CertificateAuthorityAccountDefinition.KEY_STORE)
+            .addAttribute(CertificateAuthorityAccountDefinition.ALIAS)
+            .addAttribute(CertificateAuthorityAccountDefinition.CREDENTIAL_REFERENCE)
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Capabilities.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Capabilities.java
new file mode 100644
index 0000000..243c2bf
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Capabilities.java
@@ -0,0 +1,124 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.security.KeyStore;
+import java.security.Provider;
+import java.util.function.Consumer;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.msc.service.ServiceBuilder;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.x500.cert.acme.AcmeAccount;
+import org.wildfly.security.x500.cert.acme.CertificateAuthority;
+
+/**
+ * The capabilities provided by and required by this subsystem.
+ *
+ * The capabilities are same as the ones provided by the Elytron subsystem
+ *
+ * @author <a href="mailto:mmazanek@redhat.com">Martin Mazanek</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+class Capabilities {
+
+    // This has to be at this position, and must not be a lambda, to avoid an init circularity problem on IBM
+    @SuppressWarnings("Convert2Lambda")
+    static final Consumer<ServiceBuilder> COMMON_REQUIREMENTS = new Consumer<ServiceBuilder>() {
+        // unchecked because ServiceBuilder is a raw type
+        @SuppressWarnings("unchecked")
+        public void accept(final ServiceBuilder serviceBuilder) {
+            ElytronTlsSubsystemDefinition.commonRequirements(serviceBuilder);
+        }
+    };
+
+    private static final String WILDFLY_SECURITY_CAPABILITY_BASE = "org.wildfly.security.";
+
+    static final String ELYTRON_TLS_CAPABILITY_NAME = "org.wildfly.extras.elytron-tls";
+    
+    static final RuntimeCapability<Consumer<ServiceBuilder>> ELYTRON_TLS_RUNTIME_CAPABILITY = RuntimeCapability.Builder
+            .of(ELYTRON_TLS_CAPABILITY_NAME, COMMON_REQUIREMENTS)
+            .build();
+
+    static final String CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "certificate-authority-account";
+
+    static final RuntimeCapability<Void> CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY, true, AcmeAccount.class)
+            .build();
+
+    static final String CERTIFICATE_AUTHORITY_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "certificate-authority";
+
+    static final RuntimeCapability<Void> CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(CERTIFICATE_AUTHORITY_CAPABILITY, true, CertificateAuthority.class)
+            .build();
+
+    static final String CREDENTIAL_STORE_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "credential-store";
+
+    /*
+     * A variant of the credential-store capability which also provides access to the underlying
+     * {@code CredentialStore} as a runtime API from a {@code ExceptionFunction<OperationContext, CredentialStore, OperationFailedException>}.
+     */
+    static final String CREDENTIAL_STORE_API_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "credential-store-api";
+
+    static final RuntimeCapability<Void> CREDENTIAL_STORE_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(CREDENTIAL_STORE_CAPABILITY, true, CredentialStore.class)
+            .build();
+
+    static final String KEY_MANAGER_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "key-manager";
+
+    static final RuntimeCapability<Void> KEY_MANAGER_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(KEY_MANAGER_CAPABILITY, true, KeyManager.class)
+            .build();
+
+    static final String KEY_STORE_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "key-store";
+
+    static final RuntimeCapability<Void> KEY_STORE_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(KEY_STORE_CAPABILITY, true, KeyStore.class)
+            .build();
+
+    static final String PROVIDERS_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "providers";
+
+    /*
+     * A variant of the credential-store capability which also provides access to the underlying
+     * {@code CredentialStore} as a runtime API from a {@code ExceptionFunction<OperationContext, Provider[], OperationFailedException>}.
+     */
+    static final String PROVIDERS_API_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "providers-api";
+
+    static final RuntimeCapability<Void> PROVIDERS_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(PROVIDERS_CAPABILITY, true, Provider[].class)
+            .build();
+
+    static final String SSL_CONTEXT_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "ssl-context";
+
+    static final RuntimeCapability<Void> SSL_CONTEXT_RUNTIME_CAPABILITY = RuntimeCapability
+            .Builder.of(SSL_CONTEXT_CAPABILITY, true, SSLContext.class)
+            .build();
+
+    static final String TRUST_MANAGER_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "trust-manager";
+
+    static final RuntimeCapability<Void> TRUST_MANAGER_RUNTIME_CAPABILITY =  RuntimeCapability
+            .Builder.of(TRUST_MANAGER_CAPABILITY, true, TrustManager.class)
+            .build();
+
+
+    static final String EXPRESSION_RESOLVER_CAPABILITY = WILDFLY_SECURITY_CAPABILITY_BASE + "expression-resolver";
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateAuthorityAccountDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateAuthorityAccountDefinition.java
new file mode 100644
index 0000000..c26868d
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateAuthorityAccountDefinition.java
@@ -0,0 +1,487 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2018 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.security.CredentialReference.handleCredentialReferenceUpdate;
+import static org.jboss.as.controller.security.CredentialReference.rollbackCredentialStoreUpdate;
+import static org.wildfly.extension.elytron.tls.AdvancedModifiableKeyStoreDecorator.resetAcmeAccount;
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.getRequiredService;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.commonRequirements;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PATH;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.RELATIVE_TO;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.security.KeyStore;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.ServiceLoader;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AbstractAttributeDefinitionBuilder;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.StringListAttributeDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.ResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+import org.jboss.msc.service.ServiceTarget;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls._private.ElytronTLSMessages;
+import org.wildfly.security.credential.source.CredentialSource;
+import org.wildfly.security.x500.cert.acme.AcmeAccount;
+import org.wildfly.security.x500.cert.acme.AcmeClientSpi;
+import org.wildfly.security.x500.cert.acme.AcmeException;
+import org.wildfly.security.x500.cert.acme.AcmeMetadata;
+import org.wildfly.security.x500.cert.acme.CertificateAuthority;
+
+/**
+ * A {@link ResourceDefinition} for a single certificate authority account.
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+class CertificateAuthorityAccountDefinition extends SimpleResourceDefinition {
+
+    static final StringListAttributeDefinition CONTACT_URLS = new StringListAttributeDefinition.Builder(Constants.CONTACT_URLS)
+            .setRequired(false)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition CERTIFICATE_AUTHORITY = new CertificateAuthorityDefinitionBuilder(Constants.CERTIFICATE_AUTHORITY, ModelType.STRING, true)
+            .setDefaultValue(new ModelNode(CertificateAuthority.LETS_ENCRYPT.getName()))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .setCapabilityReference(CERTIFICATE_AUTHORITY_CAPABILITY, CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY)
+            .build();
+
+    static final SimpleAttributeDefinition KEY_STORE = new SimpleAttributeDefinitionBuilder(Constants.KEY_STORE, ModelType.STRING, false)
+            .setAttributeGroup(Constants.ACCOUNT_KEY)
+            .setMinSize(1)
+            // .setAlternatives(Constants.KEY_STORE_OBJECT)
+            .setRestartAllServices()
+            .setCapabilityReference(KEY_STORE_CAPABILITY, CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY)
+            .build();
+
+    static final ObjectTypeAttributeDefinition KEY_STORE_OBJECT = new ObjectTypeAttributeDefinition.Builder(Constants.KEY_STORE_OBJECT, SSLContextDefinitions.TYPE,
+                PATH, RELATIVE_TO, SSLContextDefinitions.REQUIRED, SSLContextDefinitions.CREDENTIAL_REFERENCE,
+                SSLContextDefinitions.ALIAS_FILTER, KeyStoreDefinition.PROVIDER_NAME, KeyStoreDefinition.PROVIDERS)
+            .setAttributeGroup(Constants.ACCOUNT_KEY)
+            .setMinSize(1)
+            .setAlternatives(Constants.KEY_STORE)
+            .setRestartAllServices()
+            .setCapabilityReference(KEY_STORE_CAPABILITY, CERTIFICATE_AUTHORITY_ACCOUNT_CAPABILITY)
+            .build();
+
+    static final SimpleAttributeDefinition ALIAS = new SimpleAttributeDefinitionBuilder(Constants.ALIAS, ModelType.STRING, false)
+            .setAttributeGroup(Constants.ACCOUNT_KEY)
+            .setMinSize(1)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition CREDENTIAL_REFERENCE = CredentialReference.getAttributeBuilder(true, true)
+            .setAttributeGroup(Constants.ACCOUNT_KEY)
+            .build();
+
+    private static final AttributeDefinition[] ATTRIBUTES = new AttributeDefinition[] { CERTIFICATE_AUTHORITY, CONTACT_URLS, KEY_STORE, /* KEY_STORE_OBJECT, */ ALIAS, CREDENTIAL_REFERENCE };
+
+    static final SimpleAttributeDefinition AGREE_TO_TERMS_OF_SERVICE = new SimpleAttributeDefinitionBuilder(Constants.AGREE_TO_TERMS_OF_SERVICE, ModelType.BOOLEAN, false)
+            .setAllowExpression(true)
+            .build();
+
+    static final SimpleAttributeDefinition STAGING = new SimpleAttributeDefinitionBuilder(Constants.STAGING, ModelType.BOOLEAN, true)
+            .setAllowExpression(true)
+            .setDefaultValue(ModelNode.FALSE)
+            .build();
+
+    private static final AcmeClientSpi acmeClient;
+    static {
+        acmeClient = loadAcmeClient();
+    }
+
+    private static AcmeClientSpi loadAcmeClient() {
+        for (AcmeClientSpi acmeClient : ServiceLoader.load(AcmeClientSpi.class, ElytronTLSMessages.class.getClassLoader())) {
+            return acmeClient;
+        }
+        throw LOGGER.unableToInstatiateAcmeClientSpiImplementation();
+    }
+
+    private static class CertificateAuthorityAttributeDefinition extends SimpleAttributeDefinition {
+
+        CertificateAuthorityAttributeDefinition(AbstractAttributeDefinitionBuilder<?, ? extends CertificateAuthorityAttributeDefinition> builder) {
+            super(builder);
+        }
+
+        @Override
+        public void addCapabilityRequirements(OperationContext context, Resource resource, ModelNode attributeValue) {
+            // Check the existence of certificate authority only if it is not null or LetsEncrypt, since LetsEncrypt does not have to be added
+            if (attributeValue.asStringOrNull() != null && !attributeValue.asString().equalsIgnoreCase(CertificateAuthority.LETS_ENCRYPT.getName())) {
+                super.addCapabilityRequirements(context, resource, attributeValue);
+            }
+        }
+    }
+
+    private static class CertificateAuthorityDefinitionBuilder extends AbstractAttributeDefinitionBuilder<CertificateAuthorityDefinitionBuilder, CertificateAuthorityAttributeDefinition> {
+
+        CertificateAuthorityDefinitionBuilder(String attributeName, ModelType type, boolean optional) {
+            super(attributeName, type, optional);
+        }
+
+        @Override
+        public CertificateAuthorityAttributeDefinition build() {
+            return new CertificateAuthorityAttributeDefinition(this);
+        }
+    }
+
+    private static final AbstractAddStepHandler ADD = new CertificateAuthorityAccountAddHandler();
+
+    private static class CertificateAuthorityAccountAddHandler extends BaseAddHandler {
+
+        private CertificateAuthorityAccountAddHandler() {
+            super(CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY, ATTRIBUTES);
+        }
+
+        @Override
+        protected void populateModel(final OperationContext context, final ModelNode operation, final Resource resource) throws  OperationFailedException {
+            super.populateModel(context, operation, resource);
+            handleCredentialReferenceUpdate(context, resource.getModel());
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, Resource resource) throws OperationFailedException {
+            ModelNode model = resource.getModel();
+            String certificateAuthorityName = CERTIFICATE_AUTHORITY.resolveModelAttribute(context, model).asString();
+            final String alias = ALIAS.resolveModelAttribute(context, model).asString();
+
+            String keyStoreName = KEY_STORE.resolveModelAttribute(context, model).asString();
+            /* final ModelNode keyStoreObject = KEY_STORE_OBJECT.resolveModelAttribute(context, model);
+            if (keyStoreName == null) {
+                if (keyStoreObject == null) {
+                    LOGGER.missingKeyStoreDefinition();
+                }
+                keyStoreName = keyStoreObject.asStringOrNull();
+            } else {
+                if (keyStoreObject != null) {
+                    LOGGER.multipleKeystoreDefinitions();
+                }
+            } */
+            if (keyStoreName == null) {
+                LOGGER.missingKeyStoreDefinition();
+            }
+            final String finalKeyStoreName = keyStoreName;
+            
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = null;
+            if (CREDENTIAL_REFERENCE.resolveModelAttribute(context, operation).isDefined()) {
+                credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, operation, null);
+            }
+            final List<ModelNode> contactUrls = CONTACT_URLS.resolveModelAttribute(context, model).asListOrEmpty();
+            final List<String> contactUrlsList = new ArrayList<>(contactUrls.size());
+            for (ModelNode contactUrl : contactUrls) {
+                contactUrlsList.add(contactUrl.asString());
+            }
+
+            AcmeAccountService acmeAccountService = new AcmeAccountService(certificateAuthorityName, contactUrlsList, alias, finalKeyStoreName);
+            ServiceTarget serviceTarget = context.getServiceTarget();
+            RuntimeCapability<Void> certificateAuthorityAccountRuntimeCapability = CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY.fromBaseCapability(context.getCurrentAddressValue());
+            ServiceName acmeAccountServiceName = certificateAuthorityAccountRuntimeCapability.getCapabilityServiceName(AcmeAccount.class);
+            ServiceBuilder<AcmeAccount> acmeAccountServiceBuilder = serviceTarget.addService(acmeAccountServiceName, acmeAccountService).setInitialMode(ServiceController.Mode.ACTIVE);
+            acmeAccountService.getCredentialSourceSupplierInjector().inject(credentialSourceSupplier);
+
+            String keyStoreCapabilityName = RuntimeCapability.buildDynamicCapabilityName(KEY_STORE_CAPABILITY, keyStoreName);
+            acmeAccountServiceBuilder.addDependency(context.getCapabilityServiceName(keyStoreCapabilityName, KeyStore.class), KeyStore.class, acmeAccountService.getKeyStoreInjector());
+            if (certificateAuthorityName.equalsIgnoreCase(CertificateAuthority.LETS_ENCRYPT.getName())) {
+                commonRequirements(acmeAccountServiceBuilder).install();
+            } else {
+                acmeAccountServiceBuilder.requires(CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY.getCapabilityServiceName(certificateAuthorityName));
+                commonRequirements(acmeAccountServiceBuilder).install();
+            }
+        }
+
+        @Override
+        protected void rollbackRuntime(OperationContext context, final ModelNode operation, final Resource resource) {
+            rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, resource);
+        }
+    }
+
+    private static final OperationStepHandler REMOVE = new TrivialCapabilityServiceRemoveHandler(ADD, CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY);
+
+    private static final ElytronReloadRequiredWriteAttributeHandler WRITE = new ElytronReloadRequiredWriteAttributeHandler(ATTRIBUTES);
+
+    CertificateAuthorityAccountDefinition() {
+        super(new Parameters(PathElement.pathElement(Constants.CERTIFICATE_AUTHORITY_ACCOUNT), ElytronTlsExtension.getResourceDescriptionResolver(Constants.CERTIFICATE_AUTHORITY_ACCOUNT))
+                .setAddHandler(ADD)
+                .setRemoveHandler(REMOVE)
+                .setAddRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+                .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+                .setCapabilities(CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY));
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        for (AttributeDefinition current : ATTRIBUTES) {
+            resourceRegistration.registerReadWriteAttribute(current, null, WRITE);
+        }
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration);
+        ResourceDescriptionResolver resolver = ElytronTlsExtension.getResourceDescriptionResolver(Constants.CERTIFICATE_AUTHORITY_ACCOUNT);
+
+        if (isServerOrHostController(resourceRegistration)) { // server-only operations
+
+            // Create an account with the certificate authority
+            CreateAccountHandler.register(resourceRegistration, resolver);
+
+            // Update an account with the certificate authority
+            UpdateAccountHandler.register(resourceRegistration, resolver);
+
+            // Change the account key
+            ChangeAccountKeyHandler.register(resourceRegistration, resolver);
+
+            // Deactivate the account key
+            DeactivateAccountHandler.register(resourceRegistration, resolver);
+
+            // Get the metadata associated with the certificate authority
+            GetMetadataHandler.register(resourceRegistration, resolver);
+        }
+    }
+
+    static class CreateAccountHandler extends ElytronRuntimeOnlyHandler {
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.CREATE_ACCOUNT, descriptionResolver)
+                            .setParameters(AGREE_TO_TERMS_OF_SERVICE, STAGING)
+                            .setRuntimeOnly()
+                            .build(),
+                    new CertificateAuthorityAccountDefinition.CreateAccountHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            boolean agreeToTermsOfService = AGREE_TO_TERMS_OF_SERVICE.resolveModelAttribute(context, operation).asBoolean();
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+            AcmeAccount acmeAccount = getAcmeAccount(context, staging);
+
+            try {
+                acmeAccount.setTermsOfServiceAgreed(agreeToTermsOfService);
+                boolean created = acmeClient.createAccount(acmeAccount, staging);
+                if (! created) {
+                    throw LOGGER.certificateAuthorityAccountAlreadyExists(Constants.UPDATE_ACCOUNT, Constants.CHANGE_ACCOUNT_KEY);
+                }
+            } catch (AcmeException e) {
+                throw LOGGER.unableToCreateAccountWithCertificateAuthority(e, e.getLocalizedMessage());
+            }
+        }
+    }
+
+    static class UpdateAccountHandler extends ElytronRuntimeOnlyHandler {
+        static final SimpleAttributeDefinition UPDATE_AGREE_TO_TERMS_OF_SERVICE = new SimpleAttributeDefinitionBuilder(Constants.AGREE_TO_TERMS_OF_SERVICE, ModelType.BOOLEAN, true)
+                .setAllowExpression(true)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.UPDATE_ACCOUNT, descriptionResolver)
+                            .setParameters(AGREE_TO_TERMS_OF_SERVICE, STAGING)
+                            .setRuntimeOnly()
+                            .build(),
+                    new CertificateAuthorityAccountDefinition.UpdateAccountHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            Boolean agreeToTermsOfService = UPDATE_AGREE_TO_TERMS_OF_SERVICE.resolveModelAttribute(context, operation).asBooleanOrNull();
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+            AcmeAccount acmeAccount = getAcmeAccount(context, staging);
+
+            try {
+                if (agreeToTermsOfService != null) {
+                    acmeClient.updateAccount(acmeAccount, staging, agreeToTermsOfService.booleanValue(), acmeAccount.getContactUrls());
+                } else {
+                    acmeClient.updateAccount(acmeAccount, staging, acmeAccount.getContactUrls());
+                }
+            } catch (AcmeException e) {
+                throw LOGGER.unableToUpdateAccountWithCertificateAuthority(e, e.getLocalizedMessage());
+            }
+        }
+    }
+
+    static class ChangeAccountKeyHandler extends ElytronRuntimeOnlyHandler {
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.CHANGE_ACCOUNT_KEY, descriptionResolver)
+                            .setParameters(STAGING)
+                            .setRuntimeOnly()
+                            .build(),
+                    new CertificateAuthorityAccountDefinition.ChangeAccountKeyHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+            AcmeAccountService acmeAccountService = getAcmeAccountService(context);
+            AcmeAccount acmeAccount = getAcmeAccount(acmeAccountService, staging);
+
+            try {
+                acmeClient.changeAccountKey(acmeAccount, staging);
+                acmeAccountService.saveCertificateAuthorityAccountKey(context);
+            } catch (AcmeException e) {
+                throw LOGGER.unableToChangeAccountKeyWithCertificateAuthority(e, e.getLocalizedMessage());
+            }
+        }
+    }
+
+    static class DeactivateAccountHandler extends ElytronRuntimeOnlyHandler {
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.DEACTIVATE_ACCOUNT, descriptionResolver)
+                            .setParameters(STAGING)
+                            .setRuntimeOnly()
+                            .build(),
+                    new CertificateAuthorityAccountDefinition.DeactivateAccountHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+            AcmeAccount acmeAccount = getAcmeAccount(context, staging);
+
+            try {
+                acmeClient.deactivateAccount(acmeAccount, staging);
+            } catch (AcmeException e) {
+                throw LOGGER.unableToDeactivateAccountWithCertificateAuthority(e, e.getLocalizedMessage());
+            }
+        }
+    }
+
+    static class GetMetadataHandler extends ElytronRuntimeOnlyHandler {
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(
+                    new SimpleOperationDefinitionBuilder(Constants.GET_METADATA, descriptionResolver)
+                            .setParameters(STAGING)
+                            .setRuntimeOnly()
+                            .build(),
+                    new CertificateAuthorityAccountDefinition.GetMetadataHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            boolean staging = STAGING.resolveModelAttribute(context, operation).asBoolean();
+            AcmeAccount acmeAccount = getAcmeAccount(context, staging);
+
+            try {
+                AcmeMetadata metadata = acmeClient.getMetadata(acmeAccount, staging);
+                if (metadata != null) {
+                    ModelNode result = context.getResult();
+                    if (metadata.getTermsOfServiceUrl() != null) {
+                        result.get(Constants.TERMS_OF_SERVICE).set(new ModelNode(metadata.getTermsOfServiceUrl()));
+                    }
+                    if (metadata.getWebsiteUrl() != null) {
+                        result.get(Constants.WEBSITE).set(new ModelNode(metadata.getWebsiteUrl()));
+                    }
+                    String[] caaIdentitiesArray = metadata.getCAAIdentities();
+                    ModelNode caaIdentities = new ModelNode();
+                    if (caaIdentitiesArray != null && caaIdentitiesArray.length != 0) {
+                        for (int i = 0; i < caaIdentitiesArray.length; i++) {
+                            caaIdentities.add(caaIdentitiesArray[i]);
+                        }
+                        result.get(Constants.CAA_IDENTITIES).set(caaIdentities);
+                    }
+                    result.get(Constants.EXTERNAL_ACCOUNT_REQUIRED).set(metadata.isExternalAccountRequired());
+                }
+            } catch (AcmeException e) {
+                throw LOGGER.unableToGetCertificateAuthorityMetadata(e, e.getLocalizedMessage());
+            }
+        }
+    }
+
+    static ModifiableKeyStoreService getModifiableKeyStoreService(OperationContext context, String keyStoreName) throws OperationFailedException {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+        return getModifiableKeyStoreService(serviceRegistry, keyStoreName);
+    }
+
+    static ModifiableKeyStoreService getModifiableKeyStoreService(ServiceRegistry serviceRegistry, String keyStoreName) throws OperationFailedException {
+        RuntimeCapability<Void> runtimeCapability = KEY_STORE_RUNTIME_CAPABILITY.fromBaseCapability(keyStoreName);
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+
+        ServiceController<KeyStore> serviceContainer = getRequiredService(serviceRegistry, serviceName, KeyStore.class);
+        ServiceController.State serviceState = serviceContainer.getState();
+        if (serviceState != ServiceController.State.UP) {
+            throw LOGGER.requiredServiceNotUp(serviceName, serviceState);
+        }
+
+        return (ModifiableKeyStoreService) serviceContainer.getService();
+    }
+
+    private static AcmeAccountService getAcmeAccountService(OperationContext context) throws OperationFailedException {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+        PathAddress currentAddress = context.getCurrentAddress();
+        RuntimeCapability<Void> runtimeCapability = CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY.fromBaseCapability(currentAddress.getLastElement().getValue());
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+
+        ServiceController<AcmeAccount> serviceContainer = getRequiredService(serviceRegistry, serviceName, AcmeAccount.class);
+        ServiceController.State serviceState = serviceContainer.getState();
+        if (serviceState != ServiceController.State.UP) {
+            throw LOGGER.requiredServiceNotUp(serviceName, serviceState);
+        }
+
+        return (AcmeAccountService) serviceContainer.getService();
+    }
+
+    private static AcmeAccount getAcmeAccount(final OperationContext context, boolean staging) throws OperationFailedException {
+        return getAcmeAccount(getAcmeAccountService(context), staging);
+    }
+
+    private static AcmeAccount getAcmeAccount(AcmeAccountService acmeAccountService, boolean staging) {
+        AcmeAccount acmeAccount = acmeAccountService.getValue();
+        return resetAcmeAccount(acmeAccount, staging);
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateAuthorityDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateAuthorityDefinition.java
new file mode 100644
index 0000000..512a203
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateAuthorityDefinition.java
@@ -0,0 +1,153 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2019 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.getRequiredService;
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.commonRequirements;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.operations.validation.StringLengthValidator;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.Mode;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+import org.jboss.msc.service.ServiceTarget;
+import org.wildfly.security.x500.cert.acme.CertificateAuthority;
+
+/**
+ * A {@link ResourceDefinition} for a single certificate authority.
+ * This resource represents certificate authority that implements <a href="https://tools.ietf.org/html/rfc8555">Automatic Certificate
+ * Management Environment (ACME)</a> specification.
+ *
+ * @author <a href="mailto:dvilkola@redhat.com">Diana Vilkolakova</a>
+ */
+class CertificateAuthorityDefinition extends SimpleResourceDefinition {
+
+    static final SimpleAttributeDefinition URL = new SimpleAttributeDefinitionBuilder(Constants.URL, ModelType.STRING, false)
+            .setValidator(new URLValidator(false))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition STAGING_URL = new SimpleAttributeDefinitionBuilder(Constants.STAGING_URL, ModelType.STRING, true)
+            .setValidator(new URLValidator(false))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    private static class URLValidator extends StringLengthValidator {
+
+        private URLValidator(boolean nullable) {
+            super(1, nullable, false);
+        }
+
+        @Override
+        public void validateParameter(String parameterName, ModelNode value) throws OperationFailedException {
+            super.validateParameter(parameterName, value);
+            String url = value.asString();
+            try {
+                new URL(url);
+            } catch (MalformedURLException e) {
+                throw LOGGER.invalidURL(url, e);
+            }
+        }
+    }
+
+    private static final AttributeDefinition[] ATTRIBUTES = new AttributeDefinition[]{URL, STAGING_URL};
+    private static final AbstractAddStepHandler ADD = new CertificateAuthorityAddHandler();
+
+    private static final OperationStepHandler REMOVE = new TrivialCapabilityServiceRemoveHandler(ADD, CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY);
+    private static final ElytronReloadRequiredWriteAttributeHandler WRITE = new ElytronReloadRequiredWriteAttributeHandler(ATTRIBUTES);
+
+    CertificateAuthorityDefinition() {
+        super(new Parameters(PathElement.pathElement(Constants.CERTIFICATE_AUTHORITY), ElytronTlsExtension.getResourceDescriptionResolver(Constants.CERTIFICATE_AUTHORITY))
+                .setAddHandler(ADD)
+                .setRemoveHandler(REMOVE)
+                .setAddRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+                .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+                .setCapabilities(CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY));
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        for (AttributeDefinition current : ATTRIBUTES) {
+            resourceRegistration.registerReadWriteAttribute(current, null, WRITE);
+        }
+    }
+
+    private static class CertificateAuthorityAddHandler extends BaseAddHandler {
+        private CertificateAuthorityAddHandler() {
+            super(CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY, ATTRIBUTES);
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, ModelNode model) throws OperationFailedException {
+            final String certificateAuthorityName = context.getCurrentAddressValue();
+
+            // Creation of certificate authority with name "LetsEncrypt" is not allowed, because it is used internally as a fallback.
+            if (certificateAuthorityName.equalsIgnoreCase(CertificateAuthority.LETS_ENCRYPT.getName())) {
+                throw LOGGER.letsEncryptNameNotAllowed();
+            }
+            commonRequirements(installService(context, model)).setInitialMode(Mode.ACTIVE).install();
+        }
+
+        ServiceBuilder<CertificateAuthority> installService(OperationContext context, ModelNode model) {
+            ServiceTarget serviceTarget = context.getServiceTarget();
+            TrivialService<CertificateAuthority> certificateAuthorityTrivialService = new TrivialService<>(getValueSupplier(context, model));
+            return serviceTarget.addService(CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY.getCapabilityServiceName(context.getCurrentAddressValue()), certificateAuthorityTrivialService);
+        }
+
+        protected TrivialService.ValueSupplier<CertificateAuthority> getValueSupplier(OperationContext context, ModelNode model) {
+            return () -> {
+                String certificateAuthorityResourceName = context.getCurrentAddress().getLastElement().getValue();
+                return new CertificateAuthority(certificateAuthorityResourceName,
+                        model.get(Constants.URL).asString(),
+                        model.get(Constants.STAGING_URL).asStringOrNull());
+            };
+        }
+    }
+
+    static Service<CertificateAuthority> getCertificateAuthorityService(ServiceRegistry serviceRegistry, String certificateAuthorityName) {
+        RuntimeCapability<Void> runtimeCapability = CERTIFICATE_AUTHORITY_RUNTIME_CAPABILITY.fromBaseCapability(certificateAuthorityName);
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+        ServiceController<CertificateAuthority> serviceContainer = getRequiredService(serviceRegistry, serviceName, CertificateAuthority.class);
+        return serviceContainer.getService();
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateChainAttributeDefinitions.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateChainAttributeDefinitions.java
new file mode 100644
index 0000000..ad49240
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CertificateChainAttributeDefinitions.java
@@ -0,0 +1,214 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.ISO_8601_FORMAT;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.X509Certificate;
+import java.text.SimpleDateFormat;
+
+import org.jboss.as.controller.ObjectListAttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.wildfly.common.iteration.ByteIterator;
+
+/**
+ * Class to contain the attribute definitions for certificates and their chains.
+ *
+ * Also contains utility methods to convert from the {@link Certificate} to the {@link ModelNode} representation.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class CertificateChainAttributeDefinitions {
+
+    private static final String SHA_1 = "SHA-1";
+
+    private static final String SHA_256 = "SHA-256";
+
+    private static final SimpleAttributeDefinition TYPE = new SimpleAttributeDefinitionBuilder(Constants.TYPE, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.ALGORITHM, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition FORMAT = new SimpleAttributeDefinitionBuilder(Constants.FORMAT, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition PUBLIC_KEY = new SimpleAttributeDefinitionBuilder(Constants.PUBLIC_KEY, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition SHA_1_DIGEST = new SimpleAttributeDefinitionBuilder(Constants.SHA_1_DIGEST, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition SHA_256_DIGEST = new SimpleAttributeDefinitionBuilder(Constants.SHA_256_DIGEST, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition ENCODED = new SimpleAttributeDefinitionBuilder(Constants.ENCODED, ModelType.STRING).build();
+
+    /*
+     * X509 Certificate Specific Attributes
+     */
+
+    private static final SimpleAttributeDefinition SUBJECT = new SimpleAttributeDefinitionBuilder(Constants.SUBJECT, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition ISSUER = new SimpleAttributeDefinitionBuilder(Constants.ISSUER, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition NOT_BEFORE = new SimpleAttributeDefinitionBuilder(Constants.NOT_BEFORE, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition NOT_AFTER = new SimpleAttributeDefinitionBuilder(Constants.NOT_AFTER, ModelType.STRING)
+            .setRequired(false)
+            .build();
+
+    private static final SimpleAttributeDefinition SERIAL_NUMBER = new SimpleAttributeDefinitionBuilder(Constants.SERIAL_NUMBER, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition SIGNATURE_ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.SIGNATURE_ALGORITHM, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition SIGNATURE = new SimpleAttributeDefinitionBuilder(Constants.SIGNATURE, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition VERSION = new SimpleAttributeDefinitionBuilder(Constants.VERSION, ModelType.STRING)
+        .setRequired(false)
+        .build();
+
+    // TODO - Consider adding some of the more detailed fields from X509Certificate
+
+    static final ObjectTypeAttributeDefinition CERTIFICATE = new ObjectTypeAttributeDefinition.Builder(Constants.CERTIFICATE,
+            TYPE, ALGORITHM, FORMAT, PUBLIC_KEY, SHA_1_DIGEST, SHA_256_DIGEST, ENCODED,
+            SUBJECT, ISSUER, NOT_BEFORE, NOT_AFTER, SERIAL_NUMBER, SIGNATURE_ALGORITHM, SIGNATURE, VERSION)
+        .setStorageRuntime()
+        .build();
+
+    static ObjectListAttributeDefinition getNamedCertificateList(final String name) {
+        return new ObjectListAttributeDefinition.Builder(name, CERTIFICATE)
+                .setRequired(false)
+                .setStorageRuntime()
+                .build();
+    }
+
+    static void writeCertificate(final ModelNode certificateModel, final Certificate certificate) throws CertificateEncodingException, NoSuchAlgorithmException {
+        writeCertificate(certificateModel, certificate, true);
+    }
+
+    static void writeCertificate(final ModelNode certificateModel, final Certificate certificate, final boolean verbose) throws CertificateEncodingException, NoSuchAlgorithmException {
+       certificateModel.get(Constants.TYPE).set(certificate.getType());
+
+        PublicKey publicKey = certificate.getPublicKey();
+        certificateModel.get(Constants.ALGORITHM).set(publicKey.getAlgorithm());
+        certificateModel.get(Constants.FORMAT).set(publicKey.getFormat());
+        if (verbose) {
+            certificateModel.get(Constants.PUBLIC_KEY).set(encodedHexString(publicKey.getEncoded()));
+        }
+
+        byte[] encodedCertificate = certificate.getEncoded();
+        certificateModel.get(Constants.SHA_1_DIGEST).set(encodedHexString(digest(SHA_1, encodedCertificate)));
+        certificateModel.get(Constants.SHA_256_DIGEST).set(encodedHexString(digest(SHA_256, encodedCertificate)));
+        if (verbose) {
+            certificateModel.get(Constants.ENCODED).set(encodedHexString(encodedCertificate));
+        }
+
+        if (certificate instanceof X509Certificate) {
+            writeX509Certificate(certificateModel, (X509Certificate) certificate);
+        }
+    }
+
+    private static void writeX509Certificate(final ModelNode certificateModel, final X509Certificate certificate) throws CertificateEncodingException, NoSuchAlgorithmException {
+        SimpleDateFormat sdf = new SimpleDateFormat(ISO_8601_FORMAT);
+
+        certificateModel.get(Constants.SUBJECT).set(certificate.getSubjectX500Principal().getName());
+        certificateModel.get(Constants.ISSUER).set(certificate.getIssuerX500Principal().getName());
+        certificateModel.get(Constants.NOT_BEFORE).set(sdf.format(certificate.getNotBefore()));
+        certificateModel.get(Constants.NOT_AFTER).set(sdf.format(certificate.getNotAfter()));
+        certificateModel.get(Constants.SERIAL_NUMBER).set(delimit(certificate.getSerialNumber().toString(16).toCharArray()));
+        certificateModel.get(Constants.SIGNATURE_ALGORITHM).set(certificate.getSigAlgName());
+        certificateModel.get(Constants.SIGNATURE).set(encodedHexString(certificate.getSignature()));
+        certificateModel.get(Constants.VERSION).set("v" + certificate.getVersion());
+    }
+
+    /**
+     * Populate the supplied response with the model representation of the certificates.
+     *
+     * @param result the response to populate.
+     * @param certificates the certificates to add to the response.
+     * @throws CertificateEncodingException
+     * @throws NoSuchAlgorithmException
+     */
+    static void writeCertificates(final ModelNode result, final Certificate[] certificates) throws CertificateEncodingException, NoSuchAlgorithmException {
+        writeCertificates(result, certificates, true);
+    }
+
+    /**
+     * Populate the supplied response with the model representation of the certificates.
+     *
+     * @param result the response to populate.
+     * @param certificates the certificates to add to the response.
+     * @param verbose mode of output.
+     * @throws CertificateEncodingException
+     * @throws NoSuchAlgorithmException
+     */
+    static void writeCertificates(final ModelNode result, final Certificate[] certificates, final boolean verbose) throws CertificateEncodingException, NoSuchAlgorithmException {
+        if (certificates != null) {
+            for (Certificate current : certificates) {
+                ModelNode certificate = new ModelNode();
+                writeCertificate(certificate, current, verbose);
+                result.add(certificate);
+            }
+        }
+    }
+
+    private static byte[] digest(final String algorithm, final byte[] encoded) throws NoSuchAlgorithmException {
+        MessageDigest digest = MessageDigest.getInstance(algorithm);
+
+        return digest.digest(encoded);
+    }
+
+    private static String encodedHexString(byte[] encoded) {
+        return delimit(ByteIterator.ofBytes(encoded).hexEncode().drainToString().toCharArray());
+    }
+
+    private static String delimit(final char[] chars) {
+        StringBuilder sb = new StringBuilder();
+        int offset = 1;
+        if (chars.length % 2 != 0) {
+            sb.append('0');
+            offset++;
+        }
+
+        for (int i = 0; i < chars.length; i++) {
+            sb.append(chars[i]);
+            if (i + 1 < chars.length && (i + offset) % 2 == 0) {
+                sb.append(':');
+            }
+        }
+        return sb.toString();
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ClassLoadingAttributeDefinitions.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ClassLoadingAttributeDefinitions.java
new file mode 100644
index 0000000..dcf72cc
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ClassLoadingAttributeDefinitions.java
@@ -0,0 +1,66 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.StringListAttributeDefinition;
+import org.jboss.dmr.ModelType;
+import org.jboss.modules.Module;
+import org.jboss.modules.ModuleIdentifier;
+import org.jboss.modules.ModuleLoadException;
+
+/**
+ * The common attribute definitions for specifying classes to be loaded by the subsystem.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class ClassLoadingAttributeDefinitions {
+
+    static final SimpleAttributeDefinition MODULE = new SimpleAttributeDefinitionBuilder(Constants.MODULE, ModelType.STRING, true)
+        .setAttributeGroup(Constants.CLASS_LOADING)
+        .setAllowExpression(false)
+        .setMinSize(1)
+        .setRestartAllServices()
+        .build();
+
+    static final SimpleAttributeDefinition CLASS_NAME = new SimpleAttributeDefinitionBuilder(Constants.CLASS_NAME, ModelType.STRING, false)
+        .setAttributeGroup(Constants.CLASS_LOADING)
+        .setAllowExpression(false)
+        .setMinSize(1)
+        .setRestartAllServices()
+        .build();
+
+    static final StringListAttributeDefinition CLASS_NAMES = new StringListAttributeDefinition.Builder(Constants.CLASS_NAMES)
+        .setAttributeGroup(Constants.CLASS_LOADING)
+        .setAllowExpression(false)
+        .setRequired(false)
+        .setRestartAllServices()
+        .build();
+
+    static ClassLoader resolveClassLoader(String module) throws ModuleLoadException {
+        Module current = Module.getCallerModule();
+        if (module != null && current != null) {
+            ModuleIdentifier mi = ModuleIdentifier.fromString(module);
+            current = current.getModule(mi);
+        }
+
+        return current != null ? current.getClassLoader() : ClassLoadingAttributeDefinitions.class.getClassLoader();
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Constants.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Constants.java
new file mode 100644
index 0000000..e1ac8dd
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Constants.java
@@ -0,0 +1,267 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+interface Constants {
+    String ACCOUNT_KEY = "account-key";
+    String ACTIVE_SESSION_COUNT = "active-session-count";
+    String ADD_ALIAS = "add-alias";
+    String AGREE_TO_TERMS_OF_SERVICE = "agree-to-terms-of-service";
+    String AGGREGATE_PROVIDERS = "aggregate-providers";
+    String ALIAS = "alias";
+    String ALIAS_ATTRIBUTE = "alias-attribute";
+    String ALIAS_FILTER = "alias-filter";
+    String ALGORITHM = "algorithm";
+    String APPLICATION_BUFFER_SIZE = "application-buffer-size";
+    String APPLICATION_CONTEXT = "application-context";
+    String ARGUMENT = "argument";
+    String AUTHENTICATION_OPTIONAL = "authentication-optional";
+
+    String CAA_IDENTITIES = "caa-identities";
+    String CERTIFICATE = "certificate";
+    String CERTIFICATE_ATTRIBUTE = "certificate-attribute";
+    String CERTIFICATE_AUTHORITY = "certificate-authority";
+    String CERTIFICATE_AUTHORITIES = "certificate-authorities";
+    String CERTIFICATE_AUTHORITY_ACCOUNT = "certificate-authority-account";
+    String CERTIFICATE_AUTHORITY_ACCOUNTS = "certificate-authority-accounts";
+    String CERTIFICATE_CHAIN = "certificate-chain";
+    String CERTIFICATE_CHAIN_ATTRIBUTE = "certificate-chain-attribute";
+    String CERTIFICATE_CHAIN_ENCODING = "certificate-chain-encoding";
+    String CERTIFICATE_TYPE = "certificate-type";
+    String CERTIFICATE_REVOCATION_LIST = "certificate-revocation-list";
+    String CERTIFICATE_REVOCATION_LISTS = "certificate-revocation-lists";
+    String CHANGE_ACCOUNT_KEY = "change-account-key";
+    String CHANGE_ALIAS = "change-alias";
+    String CIPHER_SUITE = "cipher-suite";
+    String CIPHER_SUITE_FILTER = "cipher-suite-filter";
+    String CIPHER_SUITE_NAMES = "cipher-suite-names";
+    String CLASS_LOADING = "class-loading";
+    String CLASS_NAME = "class-name";
+    String CLASS_NAMES = "class-names";
+    String CLEAR_TEXT = "clear-text";
+    String CLIENT_SSL_CONTEXT = "client-ssl-context";
+    String CLIENT_SSL_CONTEXTS = "client-ssl-contexts";
+    String CONFIGURATION = "configuration";
+    String CONTACT_URLS = "contact-urls";
+    String CREATE = "create";
+    String CREATE_ACCOUNT = "create-account";
+    String CREATE_EXPRESSION = "create-expression";
+    String CREATION_DATE = "creation-date";
+    String CREATION_TIME = "creation-time";
+    String CREDENTIAL_STORE = "credential-store";
+    String CREDENTIAL_STORES = "credential-stores";
+    String CRITICAL = "critical";
+    String CUSTOM_PERMISSION_MAPPER = "custom-permission-mapper";
+
+    String DAYS_TO_EXPIRY = "days-to-expiry";
+    String DEACTIVATE_ACCOUNT = "deactivate-account";
+    String DEFAULT_ALIAS = "default-alias";
+    String DEFAULT_RESOLVER = "default-resolver";
+    String DEFAULT_SSL_CONTEXT = "default-ssl-context";
+    String DESCRIPTION = "description";
+    String DISALLOWED_PROVIDERS = "disallowed-providers";
+    String DISTINGUISHED_NAME = "distinguished-name";
+    String DOMAIN_NAMES = "domain-names";
+
+    String ENCODED = "encoded";
+    String ENCRYPTION = "encryption";
+    String ENTRY_TYPE = "entry-type";
+    String EXPIRATION = "expiration";
+    String EXPORT_CERTIFICATE = "export-certificate";
+    String EXPORT_SECRET_KEY = "export-secret-key";
+    String EXPRESSION = "expression";
+    String EXPRESSION_RESOLVER = "expression-resolver";
+    String EXTERNAL_ACCOUNT_REQUIRED = "external-account-required";
+    String EXTENSION = "extension";
+    String EXTENSIONS = "extensions";
+
+    String FILE = "file";
+    String FILTER_ALIAS = "filter-alias";
+    String FILTER_CERTIFICATE = "filter-certificate";
+    String FILTER_ITERATE = "filter-iterate";
+    String FILTERING_KEY_STORE = "filtering-key-store";
+    String FINAL_PROVIDERS = "final-providers";
+    String FLAG = "flag";
+    String FORMAT = "format";
+
+    String GENERATE_CERTIFICATE_SIGNING_REQUEST = "generate-certificate-signing-request";
+    String GENERATE_KEY_PAIR = "generate-key-pair";
+    String GENERATE_SECRET_KEY = "generate-secret-key";
+    String GENERATE_SELF_SIGNED_CERTIFICATE_HOST = "generate-self-signed-certificate-host";
+    String GET_METADATA = "get-metadata";
+
+    String HOST_NAME = "host-name";
+
+    String IMPLEMENTATION = "implementation";
+    String IMPLEMENTATION_PROPERTIES = "implementation-properties";
+    String IMPORT_CERTIFICATE = "import-certificate";
+    String IMPORT_SECRET_KEY = "import-secret-key";
+    String INDEX = "index";
+    String INFO = "info";
+    String INIT = "init";
+    String INITIAL_PROVIDERS = "initial-providers";
+    String INVALIDATE = "invalidate";
+    String ISSUER = "issuer";
+
+    String JASPI_CONFIGURATION = "jaspi-configuration";
+
+    String KEY = "key";
+    String KEY_ATTRIBUTE = "key-attribute";
+    String KEY_TYPE = "key-type";
+    String KEY_MANAGER = "key-manager";
+    String KEY_MANAGER_OBJECT = "key-manager-object";
+    String KEY_MANAGERS = "key-managers";
+    String KEY_SIZE = "key-size";
+    String KEY_STORE = "key-store";
+    String KEY_STORE_OBJECT = "key-store-object";
+    String KEY_STORES = "key-stores";
+
+    String LAST_ACCESSED_TIME = "last-accessed-time";
+    String LAYER = "layer";
+    String LDAP_KEY_STORE = "ldap-key-store";
+    String LOAD = "load";
+    String LOAD_SERVICES = "load-services";
+    String LOADED_PROVIDER = "loaded-provider";
+    String LOADED_PROVIDERS = "loaded-providers";
+    String LOCAL_CERTIFICATES = "local-certificates";
+    String LOCAL_PRINCIPAL = "local-principal";
+    String LOCATION = "location";
+
+    String MAXIMUM_CERT_PATH = "maximum-cert-path";
+    String MAXIMUM_SESSION_CACHE_SIZE = "maximum-session-cache-size";
+    String MECHANISM_CONFIGURATIONS = "mechanism-configurations";
+    String MECHANISM_NAME = "mechanism-name";
+    String MODIFIABLE = "modifiable";
+    String MODIFIABLE_KEY_STORE = "modifiable-key-store";
+    String MODIFIED = "modified";
+    String MODULE = "module";
+
+    String NAME = "name";
+    String NEED_CLIENT_AUTH = "need-client-auth";
+    String NEW_ALIAS = "new-alias";
+    String NEW_ITEM_ATTRIBUTES = "new-item-attributes";
+    String NEW_ITEM_TEMPLATE = "new-item-template";
+    String NEW_ITEM_PATH = "new-item-path";
+    String NEW_ITEM_RDN = "new-item-rdn";
+    String NOT_AFTER = "not-after";
+    String NOT_BEFORE = "not-before";
+
+    String OBTAIN_CERTIFICATE = "obtain-certificate";
+    String OCSP = "ocsp";
+    String ONLY_LEAF_CERT = "only-leaf-cert";
+    String OPERATIONS = "operations";
+    String OTHER_PROVIDERS = "other-providers";
+    String OPTIONS = "options";
+    String OR = "or";
+
+    String PACKET_BUFFER_SIZE = "packet-buffer-size";
+    String PATH = "path";
+    String PEER_CERTIFICATES = "peer-certificates";
+    String PEER_HOST = "peer-host";
+    String PEER_PORT = "peer-port";
+    String PEER_PRINCIPAL = "peer-principal";
+    String PEM = "pem";
+    String POPULATE = "populate";
+    String PREFER_CRLS = "prefer-crls";
+    String PREFIX = "prefix";
+    String PROPERTY = "property";
+    String PROPERTY_LIST = "property-list";
+    String PROTOCOL = "protocol";
+    String PROTOCOLS = "protocols";
+    String PROVIDER = "provider";
+    String PROVIDER_LOADER = "provider-loader";
+    String PROVIDER_NAME = "provider-name";
+    String PROVIDER_REGISTRATION = "provider-registration";
+    String PROVIDERS = "providers";
+    String PUBLIC_KEY = "public-key";
+
+    String READ_ALIAS = "read-alias";
+    String READ_ALIASES = "read-aliases";
+    String REASON = "reason";
+    String RECURSIVE = "recursive";
+    String RELATIVE_TO = "relative-to";
+    String RELOAD = "reload";
+    String RELOAD_CERTIFICATE_REVOCATION_LIST = "reload-certificate-revocation-list";
+    String REMOVE_ALIAS = "remove-alias";
+    String REQUIRED = "required";
+    String RESOLVER = "resolver";
+    String RESOLVERS = "resolvers";
+    String RESPONDER = "responder";
+    String RESPONDER_CERTIFICATE = "responder-certificate";
+    String RESPONDER_KEYSTORE = "responder-keystore";
+    String RESPONDER_KEYSTORE_OBJECT = "responder-keystore-object";
+    String REVOKE_CERTIFICATE = "revoke-certificate";
+
+    String SASL_AUTHENTICATION_FACTORY = "sasl-authentication-factory";
+    String SEARCH_PATH = "search-path";
+    String SEARCH_RECURSIVE = "search-recursive";
+    String SEARCH_TIME_LIMIT = "search-time-limit";
+    String SECURITY_PROPERTIES = "security-properties";
+    String SECURITY_PROPERTY = "security-property";
+    String SECRET_KEY = "secret-key";
+    String SECRET_KEY_CREDENTIAL_STORE = "secret-key-credential-store";
+    String SECRET_VALUE = "secret-value";
+    String SERIAL_NUMBER = "serial-number";
+    String SERVER_AUTH_MODULES = "server-auth-modules";
+    String SERVER_SSL_CONTEXT = "server-ssl-context";
+    String SERVER_SSL_CONTEXTS = "server-ssl-contexts";
+    String SERVER_SSL_SNI_CONTEXT = "server-ssl-sni-context";
+    String SERVER_SSL_SNI_CONTEXTS = "server-ssl-sni-contexts";
+    String SESSION_TIMEOUT = "session-timeout";
+    String SET_SECRET = "set-secret";
+    String SERVICE = "service";
+    String SERVICES = "services";
+    String SHA_1_DIGEST = "sha-1-digest";
+    String SHA_256_DIGEST = "sha-256-digest";
+    String SHOULD_RENEW_CERTIFICATE = "should-renew-certificate";
+    String SIGNATURE = "signature";
+    String SIGNATURE_ALGORITHM = "signature-algorithm";
+    String SIZE = "size";
+    String SSL_CONTEXT_REGISTRATION = "ssl-context-registration";
+    String SSL_SESSION = "ssl-session";
+    String SOFT_FAIL = "soft-fail";
+    String STAGING = "staging";
+    String STAGING_URL = "staging-url";
+    String STATE = "state";
+    String STORE = "store";
+    String SUBJECT = "subject";
+    String SYNCHRONIZED = "synchronized";
+
+    String TERMS_OF_SERVICE = "terms-of-service";
+    String TLS = "tls";
+    String TRUST_CACERTS = "trust-cacerts";
+    String TRUST_MANAGER = "trust-manager";
+    String TRUST_MANAGER_OBJECT = "trust-manager-object";
+    String TRUST_MANAGERS = "trust-managers";
+    String TYPE = "type";
+
+    String UPDATE_ACCOUNT = "update-account";
+    String URL = "url";
+    String USE_CIPHER_SUITES_ORDER = "use-cipher-suites-order";
+
+    String VALID = "valid";
+    String VALIDATE = "validate";
+    String VALIDITY = "validity";
+    String VALUE = "value";
+    String VERBOSE = "verbose";
+    String VERSION = "version";
+
+    String WANT_CLIENT_AUTH = "want-client-auth";
+    String WEBSITE = "website";
+    String WRAP = "wrap";
+}
+
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CredentialStoreResourceDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CredentialStoreResourceDefinition.java
new file mode 100644
index 0000000..f0038aa
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CredentialStoreResourceDefinition.java
@@ -0,0 +1,643 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.security.CredentialReference.getCredentialSource;
+import static org.jboss.as.controller.security.CredentialReference.handleCredentialReferenceUpdate;
+import static org.jboss.as.controller.security.CredentialReference.rollbackCredentialStoreUpdate;
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_API_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_API_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathName;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathResolver;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.io.File;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+import java.security.Provider;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.function.Supplier;
+import java.util.logging.Level;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.CapabilityServiceBuilder;
+import org.jboss.as.controller.ModelVersion;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleMapAttributeDefinition;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.controller.services.path.PathManagerService;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.StartException;
+import org.wildfly.common.function.ExceptionFunction;
+import org.wildfly.common.function.ExceptionRunnable;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PathResolver;
+import org.wildfly.security.EmptyProvider;
+import org.wildfly.security.auth.server.IdentityCredentials;
+import org.wildfly.security.credential.Credential;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.credential.source.CredentialSource;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.credential.store.CredentialStore.CredentialSourceProtectionParameter;
+import org.wildfly.security.credential.store.CredentialStoreException;
+import org.wildfly.security.credential.store.impl.KeyStoreCredentialStore;
+
+/**
+ * A {@link ResourceDefinition} for a CredentialStore.
+ *
+ * @author <a href="mailto:pskopek@redhat.com">Peter Skopek</a>
+ */
+final class CredentialStoreResourceDefinition extends AbstractCredentialStoreResourceDefinition {
+
+    // KeyStore backed credential store supported attributes
+    private static final String CS_KEY_STORE_TYPE_ATTRIBUTE = "keyStoreType";
+    private static final List<String> filebasedKeystoreTypes = Collections.unmodifiableList(Arrays.asList("JKS", "JCEKS", "PKCS12"));
+
+    static final SimpleAttributeDefinition LOCATION = new SimpleAttributeDefinitionBuilder(Constants.LOCATION, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .setDeprecated(ModelVersion.create(13))
+            .setAlternatives(Constants.PATH)
+            .build();
+
+    static final SimpleAttributeDefinition MODIFIABLE = new SimpleAttributeDefinitionBuilder(Constants.MODIFIABLE, ModelType.BOOLEAN, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setDefaultValue(ModelNode.TRUE)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition CREATE = new SimpleAttributeDefinitionBuilder(Constants.CREATE, ModelType.BOOLEAN, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(false)
+            .setDefaultValue(ModelNode.FALSE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleMapAttributeDefinition IMPLEMENTATION_PROPERTIES = new SimpleMapAttributeDefinition.Builder(Constants.IMPLEMENTATION_PROPERTIES, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition CREDENTIAL_REFERENCE = CredentialReference.getAttributeDefinition(true);
+
+    static final SimpleAttributeDefinition TYPE = new SimpleAttributeDefinitionBuilder(Constants.TYPE, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition PROVIDER_NAME = new SimpleAttributeDefinitionBuilder(Constants.PROVIDER_NAME, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition PROVIDERS = new SimpleAttributeDefinitionBuilder(Constants.PROVIDERS, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .setCapabilityReference(PROVIDERS_CAPABILITY, CREDENTIAL_STORE_CAPABILITY)
+            .build();
+
+    static final SimpleAttributeDefinition OTHER_PROVIDERS = new SimpleAttributeDefinitionBuilder(Constants.OTHER_PROVIDERS, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .setCapabilityReference(PROVIDERS_CAPABILITY, CREDENTIAL_STORE_CAPABILITY)
+            .build();
+
+    static final SimpleAttributeDefinition RELATIVE_TO = new SimpleAttributeDefinitionBuilder(Constants.RELATIVE_TO, ModelType.STRING, true)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setAttributeGroup(Constants.FILE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition PATH = new SimpleAttributeDefinitionBuilder(Constants.PATH, ModelType.STRING, true)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .setAttributeGroup(Constants.FILE)
+            .setRestartAllServices()
+            .setAlternatives(Constants.LOCATION)
+            .build();
+
+    // Resource Resolver
+    private static final StandardResourceDescriptionResolver RESOURCE_RESOLVER = ElytronTlsExtension.getResourceDescriptionResolver(Constants.CREDENTIAL_STORE);
+
+    // Operations parameters
+
+
+    static final SimpleAttributeDefinition KEY_SIZE = new SimpleAttributeDefinitionBuilder(Constants.KEY_SIZE, ModelType.INT, true)
+            .setMinSize(1)
+            .setDefaultValue(new ModelNode(256))
+            .setAllowedValues(128, 192, 256)
+            .build();
+
+    static final SimpleAttributeDefinition ADD_ENTRY_TYPE;
+    static final SimpleAttributeDefinition REMOVE_ENTRY_TYPE;
+
+    static {
+        String[] addEntryTypes = new String[] { PasswordCredential.class.getCanonicalName() };
+        ADD_ENTRY_TYPE = new SimpleAttributeDefinitionBuilder(Constants.ENTRY_TYPE, ModelType.STRING, true)
+                .setAllowedValues(addEntryTypes)
+                .build();
+        String[] removeEntryTypes = new String[] { PasswordCredential.class.getCanonicalName(), PasswordCredential.class.getSimpleName(),
+                                                   SecretKeyCredential.class.getCanonicalName(), SecretKeyCredential.class.getSimpleName()};
+        REMOVE_ENTRY_TYPE = new SimpleAttributeDefinitionBuilder(Constants.ENTRY_TYPE, ModelType.STRING, true)
+                .setAllowedValues(removeEntryTypes)
+                .setDefaultValue(new ModelNode(PasswordCredential.class.getSimpleName()))
+                .build();
+    }
+
+    static final SimpleAttributeDefinition SECRET_VALUE = new SimpleAttributeDefinitionBuilder(Constants.SECRET_VALUE, ModelType.STRING, true)
+            .setMinSize(0)
+            .build();
+
+    // Operations
+
+    private static final SimpleOperationDefinition ADD_ALIAS = new SimpleOperationDefinitionBuilder(Constants.ADD_ALIAS, OPERATION_RESOLVER)
+            .setParameters(ALIAS, ADD_ENTRY_TYPE, SECRET_VALUE)
+            .setRuntimeOnly()
+            .build();
+
+    private static final SimpleOperationDefinition REMOVE_ALIAS = new SimpleOperationDefinitionBuilder(Constants.REMOVE_ALIAS, OPERATION_RESOLVER)
+            .setParameters(ALIAS, REMOVE_ENTRY_TYPE)
+            .setRuntimeOnly()
+            .build();
+
+    private static final SimpleOperationDefinition SET_SECRET = new SimpleOperationDefinitionBuilder(Constants.SET_SECRET, OPERATION_RESOLVER)
+            .setParameters(ALIAS, ADD_ENTRY_TYPE, SECRET_VALUE)
+            .setRuntimeOnly()
+            .build();
+
+    private static final SimpleOperationDefinition GENERATE_SECRET_KEY = new SimpleOperationDefinitionBuilder(Constants.GENERATE_SECRET_KEY, OPERATION_RESOLVER)
+            .setParameters(ALIAS, KEY_SIZE)
+            .setRuntimeOnly()
+            .build();
+
+    private static final AttributeDefinition[] CONFIG_ATTRIBUTES = new AttributeDefinition[] {LOCATION, PATH, CREATE, MODIFIABLE, IMPLEMENTATION_PROPERTIES, CREDENTIAL_REFERENCE, TYPE, PROVIDER_NAME, PROVIDERS, OTHER_PROVIDERS, RELATIVE_TO};
+
+    private static final CredentialStoreAddHandler ADD = new CredentialStoreAddHandler();
+    private static final OperationStepHandler REMOVE = new TrivialCapabilityServiceRemoveHandler(ADD, CREDENTIAL_STORE_RUNTIME_CAPABILITY);
+
+
+    CredentialStoreResourceDefinition() {
+        super(new SimpleResourceDefinition.Parameters(PathElement.pathElement(Constants.CREDENTIAL_STORE), RESOURCE_RESOLVER)
+                .setAddHandler(ADD)
+                .setRemoveHandler(REMOVE)
+                .setAddRestartLevel(OperationEntry.Flag.RESTART_NONE)
+                .setRemoveRestartLevel(OperationEntry.Flag.RESTART_NONE)
+                .setCapabilities(CREDENTIAL_STORE_RUNTIME_CAPABILITY)
+        );
+    }
+
+    @Override
+    protected AttributeDefinition[] getAttributeDefinitions() {
+        return CONFIG_ATTRIBUTES;
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration); // Always needed to register add / remove.
+
+        boolean isServerOrHostController = isServerOrHostController(resourceRegistration);
+        Map<String, CredentialStoreRuntimeOperation> operationMethods = new HashMap<>();
+
+        operationMethods.put(Constants.READ_ALIASES, this::readAliasesOperation);
+        if (isServerOrHostController) {
+            operationMethods.put(Constants.ADD_ALIAS, this::addAliasOperation);
+            operationMethods.put(Constants.REMOVE_ALIAS, this::removeAliasOperation);
+            operationMethods.put(Constants.SET_SECRET, this::setSecretOperation);
+            operationMethods.put(Constants.EXPORT_SECRET_KEY, this::exportSecretKeyOperation);
+            operationMethods.put(Constants.GENERATE_SECRET_KEY, this::generateSecretKeyOperation);
+            operationMethods.put(Constants.IMPORT_SECRET_KEY, this::importSecretKeyOperation);
+        }
+
+        OperationStepHandler operationHandler = new CredentialStoreRuntimeHandler(operationMethods);
+        resourceRegistration.registerOperationHandler(READ_ALIASES, operationHandler); // MAPPED
+        if (isServerOrHostController) {
+            resourceRegistration.registerOperationHandler(ADD_ALIAS, operationHandler); // Mapped
+            resourceRegistration.registerOperationHandler(REMOVE_ALIAS, operationHandler); // Mapped
+            resourceRegistration.registerOperationHandler(SET_SECRET, operationHandler); // Mapped
+            resourceRegistration.registerOperationHandler(GENERATE_SECRET_KEY, operationHandler);
+            resourceRegistration.registerOperationHandler(EXPORT_SECRET_KEY, operationHandler);
+            resourceRegistration.registerOperationHandler(IMPORT_SECRET_KEY, operationHandler);
+            resourceRegistration.registerOperationHandler(RELOAD, RELOAD_HANDLER);
+        }
+    }
+
+    /*
+     * Operation Handler Methods
+     */
+
+    void addAliasOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        try {
+            try {
+                String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+                String entryType = ADD_ENTRY_TYPE.resolveModelAttribute(context, operation).asStringOrNull();
+                String secretValue = SECRET_VALUE.resolveModelAttribute(context, operation).asStringOrNull();
+                if (entryType == null || entryType.equals(PasswordCredential.class.getCanonicalName())) {
+                    if (credentialStore.exists(alias, PasswordCredential.class)) {
+                        throw LOGGER.credentialAlreadyExists(alias, PasswordCredential.class.getName());
+                    }
+                    storeSecret(credentialStore, alias, secretValue);
+                } else {
+                    String credentialStoreName = CredentialStoreResourceDefinition.credentialStoreName(operation);
+                    throw LOGGER.credentialStoreEntryTypeNotSupported(credentialStoreName, entryType);
+                }
+            } catch (CredentialStoreException e) {
+                throw LOGGER.unableToCompleteOperation(e, dumpCause(e));
+            }
+        } catch (RuntimeException e) {
+            throw new OperationFailedException(e);
+        }
+    }
+
+    void removeAliasOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        String entryType = REMOVE_ENTRY_TYPE.resolveModelAttribute(context, operation).asString();
+        Class<? extends Credential> credentialType = fromEntryType(entryType);
+
+        super.removeAliasOperation(context, operation, credentialStore, credentialType);
+    }
+
+    void setSecretOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        try {
+            try {
+                String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+                String entryType = ADD_ENTRY_TYPE.resolveModelAttribute(context, operation).asStringOrNull();
+                String secretValue = SECRET_VALUE.resolveModelAttribute(context, operation).asStringOrNull();
+
+                if (entryType == null || entryType.equals(PasswordCredential.class.getCanonicalName())) {
+                    if ( ! credentialStore.exists(alias, PasswordCredential.class)) {
+                        throw LOGGER.credentialDoesNotExist(alias, PasswordCredential.class.getName());
+                    }
+                    storeSecret(credentialStore, alias, secretValue);
+                    context.addResponseWarning(Level.WARNING, LOGGER.reloadDependantServices());
+                } else {
+                    String credentialStoreName = CredentialStoreResourceDefinition.credentialStoreName(operation);
+                    throw LOGGER.credentialStoreEntryTypeNotSupported(credentialStoreName, entryType);
+                }
+            } catch (CredentialStoreException e) {
+                throw LOGGER.unableToCompleteOperation(e, dumpCause(e));
+            }
+        } catch (RuntimeException e) {
+            throw new OperationFailedException(e);
+        }
+    }
+
+    protected void generateSecretKeyOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        final int keySize = KEY_SIZE.resolveModelAttribute(context, operation).asInt();
+
+        generateSecretKeyOperation(context, operation, credentialStore, keySize);
+    }
+
+    static String credentialStoreName(ModelNode operation) {
+        String credentialStoreName = null;
+        PathAddress pa = PathAddress.pathAddress(operation.require(ModelDescriptionConstants.OP_ADDR));
+        for (int i = pa.size() - 1; i > 0; i--) {
+            PathElement pe = pa.getElement(i);
+            if (Constants.CREDENTIAL_STORE.equals(pe.getKey())) {
+                credentialStoreName = pe.getValue();
+                break;
+            }
+        }
+
+        if (credentialStoreName == null) {
+            throw LOGGER.operationAddressMissingKey(Constants.CREDENTIAL_STORE);
+        }
+
+        return credentialStoreName;
+    }
+
+    private static Class<? extends Credential> fromEntryType(final String entryTyoe) {
+        if (PasswordCredential.class.getCanonicalName().equals(entryTyoe) || PasswordCredential.class.getSimpleName().equals(entryTyoe)) {
+            return PasswordCredential.class;
+        } else if (SecretKeyCredential.class.getCanonicalName().equals(entryTyoe) || SecretKeyCredential.class.getSimpleName().equals(entryTyoe)) {
+            return SecretKeyCredential.class;
+        }
+
+        return null;
+    }
+
+    private static class CredentialStoreAddHandler extends DoohickeyAddHandler<CredentialStore> {
+
+        private CredentialStoreAddHandler() {
+            super(CREDENTIAL_STORE_RUNTIME_CAPABILITY, CONFIG_ATTRIBUTES, CREDENTIAL_STORE_API_CAPABILITY);
+        }
+
+        @Override
+        protected void populateModel(final OperationContext context, final ModelNode operation, final Resource resource) throws  OperationFailedException {
+            super.populateModel(context, operation, resource);
+            handleCredentialReferenceUpdate(context, resource.getModel());
+        }
+
+        @Override
+        protected ElytronDoohickey<CredentialStore> createDoohickey(PathAddress resourceAddress) {
+            return new CredentialStoreDoohickey(resourceAddress);
+        }
+
+        @Override
+        protected void rollbackRuntime(OperationContext context, final ModelNode operation, final Resource resource) {
+            rollbackCredentialStoreUpdate(CREDENTIAL_REFERENCE, context, resource);
+        }
+    }
+
+    static class CredentialStoreDoohickey extends AbstractCredentialStoreDoohickey {
+
+        private final String name;
+        private volatile String location;
+        private volatile boolean modifiable;
+        private volatile String type;
+        private volatile String providers;
+        private volatile String otherProviders;
+        private volatile String providerName;
+        private volatile String relativeTo;
+        private volatile Map<String, String> credentialStoreAttributes;
+        private volatile ModelNode model; // It would be nice to eliminate but credential reference performs resolution
+                                          // and use of values in a single step.
+
+        private volatile ExceptionRunnable<GeneralSecurityException> reloader;
+
+        protected CredentialStoreDoohickey(PathAddress resourceAddress) {
+            super(resourceAddress);
+            this.name = resourceAddress.getLastElement().getValue();
+        }
+
+        @Override
+        protected void resolveRuntime(ModelNode model, OperationContext context) throws OperationFailedException {
+            location = PATH.resolveModelAttribute(context, model).asStringOrNull();
+            if (location == null) {
+                location = LOCATION.resolveModelAttribute(context, model).asStringOrNull();
+            }
+            credentialStoreAttributes = new HashMap<>();
+            modifiable =  MODIFIABLE.resolveModelAttribute(context, model).asBoolean();
+            credentialStoreAttributes.put(Constants.MODIFIABLE, Boolean.toString(modifiable));
+            boolean create = CREATE.resolveModelAttribute(context, model).asBoolean();
+            credentialStoreAttributes.put(Constants.CREATE, Boolean.toString(create));
+            ModelNode implAttrModel = IMPLEMENTATION_PROPERTIES.resolveModelAttribute(context, model);
+            if (implAttrModel.isDefined()) {
+                for (String s : implAttrModel.keys()) {
+                    credentialStoreAttributes.put(s, implAttrModel.require(s).asString());
+                }
+            }
+            type = TYPE.resolveModelAttribute(context, model).asStringOrNull();
+            providers = PROVIDERS.resolveModelAttribute(context, model).asStringOrNull();
+            otherProviders = OTHER_PROVIDERS.resolveModelAttribute(context, model).asStringOrNull();
+            providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+            relativeTo = RELATIVE_TO.resolveModelAttribute(context, model).asStringOrNull();
+            if (type == null || type.equals(KeyStoreCredentialStore.KEY_STORE_CREDENTIAL_STORE)) {
+                credentialStoreAttributes.putIfAbsent(CS_KEY_STORE_TYPE_ATTRIBUTE, "JCEKS");
+            }
+
+            String implAttrKeyStoreType = credentialStoreAttributes.get(CS_KEY_STORE_TYPE_ATTRIBUTE);
+            if (location == null && implAttrKeyStoreType != null && filebasedKeystoreTypes.contains(implAttrKeyStoreType.toUpperCase(Locale.ENGLISH))) {
+                throw LOGGER.filebasedKeystoreLocationMissing(implAttrKeyStoreType);
+            }
+            this.model = model;
+        }
+
+        @Override
+        protected ExceptionSupplier<CredentialStore, StartException> prepareServiceSupplier(OperationContext context,
+                CapabilityServiceBuilder<?> serviceBuilder) throws OperationFailedException {
+
+            final Supplier<PathManagerService> pathManager;
+            if (relativeTo != null) {
+                pathManager = serviceBuilder.requires(PathManagerService.SERVICE_NAME);
+                serviceBuilder.requires(pathName(relativeTo));
+            } else {
+                pathManager = null;
+            }
+
+            final Supplier<Provider[]> providerSupplier;
+            if (providers != null) {
+                String providersCapabilityName = RuntimeCapability.buildDynamicCapabilityName(PROVIDERS_CAPABILITY, providers);
+                ServiceName providerLoaderServiceName = context.getCapabilityServiceName(providersCapabilityName,
+                        Provider[].class);
+
+                providerSupplier = serviceBuilder.requires(providerLoaderServiceName);
+            } else {
+                providerSupplier = null;
+            }
+
+            final Supplier<Provider[]> otherProviderSupplier;
+            if (otherProviders != null) {
+                String providersCapabilityName = RuntimeCapability.buildDynamicCapabilityName(PROVIDERS_CAPABILITY,
+                        otherProviders);
+                ServiceName otherProvidersLoaderServiceName = context.getCapabilityServiceName(providersCapabilityName,
+                        Provider[].class);
+
+                otherProviderSupplier = serviceBuilder.requires(otherProvidersLoaderServiceName);
+            } else {
+                otherProviderSupplier = null;
+            }
+
+            ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = CredentialReference
+                    .getCredentialSourceSupplier(context, CredentialStoreResourceDefinition.CREDENTIAL_REFERENCE, model,
+                            serviceBuilder);
+
+            return new ExceptionSupplier<CredentialStore, StartException>() {
+
+                @Override
+                public CredentialStore get() throws StartException {
+                    try {
+                        if (location != null) {
+                            PathResolver pathResolver = pathResolver();
+                            pathResolver.path(location);
+                            if (relativeTo != null) {
+                                pathResolver.relativeTo(relativeTo, pathManager.get());
+                            }
+                            File resolved = pathResolver.resolve();
+                            pathResolver.clear();
+                            credentialStoreAttributes.put(Constants.LOCATION, resolved.getAbsolutePath());
+                        } else {
+                            credentialStoreAttributes.put(Constants.LOCATION, null);
+                        }
+
+                        LOGGER.tracef("starting CredentialStore:  name = %s", name);
+
+                        CredentialStore cs = getCredentialStoreInstance(providerSupplier != null ? providerSupplier.get() : null);
+                        Provider[] otherProvidersArr = otherProviderSupplier != null ? otherProviderSupplier.get() : null;
+                        if (LOGGER.isTraceEnabled()) {
+                            LOGGER.tracef(
+                                    "initializing CredentialStore:  name = %s  type = %s  provider = %s  otherProviders = %s  attributes = %s",
+                                    name, type, providerName, Arrays.toString(otherProvidersArr), credentialStoreAttributes);
+                        }
+
+                        CredentialSourceProtectionParameter credentialSource = resolveCredentialStoreProtectionParameter(name,
+                                credentialSourceSupplier != null ? credentialSourceSupplier.get() : null);
+                        reloader = new ExceptionRunnable<GeneralSecurityException>() {
+
+                            @Override
+                            public void run() throws GeneralSecurityException {
+                                synchronized (EmptyProvider.getInstance()) {
+                                    cs.initialize(credentialStoreAttributes, credentialSource, otherProvidersArr);
+                                }
+                            }
+                        };
+                        reloader.run();
+
+                        return cs;
+                    } catch (Exception e) {
+                        throw LOGGER.unableToStartService(e);
+                    }
+                }
+
+            };
+
+        }
+
+        @Override
+        protected CredentialStore createImmediately(OperationContext foreignContext) throws OperationFailedException {
+            File resolvedPath = null;
+            if (location != null) {
+                resolvedPath = resolveRelativeToImmediately(location, relativeTo, foreignContext);
+                credentialStoreAttributes.put(Constants.LOCATION, resolvedPath.getAbsolutePath());
+            }
+
+            Provider[] providers = null;
+            if (this.providers != null) {
+                ExceptionFunction<OperationContext, Provider[], OperationFailedException> providerApi = foreignContext
+                        .getCapabilityRuntimeAPI(PROVIDERS_API_CAPABILITY, this.providers, ExceptionFunction.class);
+                providers = providerApi.apply(foreignContext);
+            }
+
+            Provider[] otherProviders;
+            if (this.otherProviders != null) {
+                ExceptionFunction<OperationContext, Provider[], OperationFailedException> providerApi = foreignContext
+                        .getCapabilityRuntimeAPI(PROVIDERS_API_CAPABILITY, this.otherProviders, ExceptionFunction.class);
+                otherProviders = providerApi.apply(foreignContext);
+            } else {
+                otherProviders = null;
+            }
+
+            CredentialSource credentialSource = getCredentialSource(foreignContext, CREDENTIAL_REFERENCE, model);
+
+            try {
+                CredentialStore credentialStore = getCredentialStoreInstance(providers);
+
+                CredentialSourceProtectionParameter protectionParamter = resolveCredentialStoreProtectionParameter(name, credentialSource);
+                reloader = new ExceptionRunnable<GeneralSecurityException>() {
+
+                    @Override
+                    public void run() throws GeneralSecurityException {
+                        synchronized (EmptyProvider.getInstance()) {
+                            credentialStore.initialize(credentialStoreAttributes, protectionParamter, otherProviders);
+                        }
+                    }
+                };
+                reloader.run();
+
+                return credentialStore;
+            } catch (GeneralSecurityException | IOException e) {
+                throw LOGGER.unableToInitialiseCredentialStore(e);
+            }
+
+        }
+
+        @Override
+        protected void reload(OperationContext context) throws GeneralSecurityException, OperationFailedException {
+            if (reloader != null) {
+                reloader.run();
+            } else {
+                super.apply(context);
+            }
+        }
+
+        private CredentialStore getCredentialStoreInstance(Provider[] injectedProviders) throws CredentialStoreException, NoSuchAlgorithmException, NoSuchProviderException {
+            String resolvedType = type != null ? type : KeyStoreCredentialStore.KEY_STORE_CREDENTIAL_STORE;
+            if (providerName != null) {
+                // directly specified provider
+                return CredentialStore.getInstance(resolvedType, providerName);
+            }
+
+            if (LOGGER.isTraceEnabled()) {
+                LOGGER.tracef("obtaining CredentialStore %s from providers %s", name, Arrays.toString(injectedProviders));
+            }
+            if (injectedProviders != null) {
+                // injected provider list, select the first provider with corresponding type
+                for (Provider p : injectedProviders) {
+                    try {
+                        return CredentialStore.getInstance(resolvedType, p);
+                    } catch (NoSuchAlgorithmException ignore) {
+                    }
+                }
+
+                throw LOGGER.providerLoaderCannotSupplyProvider(providers, resolvedType);
+            } else {
+                // default provider
+                return CredentialStore.getInstance(resolvedType);
+            }
+        }
+
+        private static CredentialSourceProtectionParameter resolveCredentialStoreProtectionParameter(String name, CredentialSource cs) throws IOException {
+            if (cs != null) {
+                Credential credential = cs.getCredential(PasswordCredential.class);
+
+                LOGGER.tracef("resolving CredentialStore %s ProtectionParameter from %s", name, credential);
+                return credentialToCredentialSourceProtectionParameter(credential);
+            } else {
+                throw LOGGER.credentialStoreProtectionParameterCannotBeResolved(name);
+            }
+        }
+
+        private static CredentialSourceProtectionParameter credentialToCredentialSourceProtectionParameter(Credential credential) {
+            return new CredentialSourceProtectionParameter(IdentityCredentials.NONE.withCredential(credential));
+        }
+
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CredentialStoresParser.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CredentialStoresParser.java
new file mode 100644
index 0000000..3a69521
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/CredentialStoresParser.java
@@ -0,0 +1,52 @@
+ /*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.CREDENTIAL_STORE;
+import static org.wildfly.extension.elytron.tls.Constants.CREDENTIAL_STORES;
+import static org.wildfly.extension.elytron.tls.Constants.SECRET_KEY_CREDENTIAL_STORE;
+
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+
+public class CredentialStoresParser {
+
+    final PersistentResourceXMLDescription credentialStoreParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(CREDENTIAL_STORE))
+            .setUseElementsForGroups(false)
+            .addAttribute(CredentialStoreResourceDefinition.IMPLEMENTATION_PROPERTIES)
+            .addAttribute(CredentialStoreResourceDefinition.CREDENTIAL_REFERENCE)
+            .addAttribute(CredentialStoreResourceDefinition.TYPE)
+            .addAttribute(CredentialStoreResourceDefinition.PROVIDER_NAME)
+            .addAttribute(CredentialStoreResourceDefinition.PROVIDERS)
+            .addAttribute(CredentialStoreResourceDefinition.OTHER_PROVIDERS)
+            .addAttribute(CredentialStoreResourceDefinition.RELATIVE_TO)
+            .addAttribute(CredentialStoreResourceDefinition.LOCATION)
+            .addAttribute(CredentialStoreResourceDefinition.PATH)
+            .addAttribute(CredentialStoreResourceDefinition.MODIFIABLE)
+            .addAttribute(CredentialStoreResourceDefinition.CREATE)
+            .build();
+
+    final PersistentResourceXMLDescription secretKeyCredentialStoreParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(SECRET_KEY_CREDENTIAL_STORE))
+            .setUseElementsForGroups(false)
+            .addAttributes(SecretKeyCredentialStoreDefinition.CONFIG_ATTRIBUTES)
+            .build();
+
+    final PersistentResourceXMLDescription credentialStoresParser_1_0 = PersistentResourceXMLDescription.decorator(CREDENTIAL_STORES)
+            .addChild(credentialStoreParser_1_0)
+            .addChild(secretKeyCredentialStoreParser_1_0)
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/DefaultSSLContextService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/DefaultSSLContextService.java
new file mode 100644
index 0000000..4282810
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/DefaultSSLContextService.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.RESTORE_DEFAULT_SSL_CONTEXT;
+import static org.wildfly.extension.elytron.tls.SecurityActions.doPrivileged;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivilegedAction;
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+
+import javax.net.ssl.SSLContext;
+
+import org.jboss.msc.Service;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+
+/**
+ * A simple {@link Service} to take an {@link SSLContext} and register it as the process wide default.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class DefaultSSLContextService implements Service {
+
+    static final ServiceName SERVICE_NAME = ElytronTlsExtension.BASE_SERVICE_NAME.append(Constants.SSL_CONTEXT_REGISTRATION);
+
+    private static final boolean RESTORE_SSL_CONTEXT = doPrivileged((PrivilegedAction<Boolean>) () -> Boolean.getBoolean(RESTORE_DEFAULT_SSL_CONTEXT));
+
+    private final Supplier<SSLContext> defaultSSLContextSupplier;
+    private final Consumer<SSLContext> valueConsumer;
+
+    DefaultSSLContextService(Supplier<SSLContext> defaultSSLContextSupplier, Consumer<SSLContext> valueConsumer) {
+        this.defaultSSLContextSupplier = defaultSSLContextSupplier;
+        this.valueConsumer = valueConsumer;
+    }
+
+    @Override
+    public void start(StartContext context) throws StartException {
+        final SSLContext sslContext = defaultSSLContextSupplier.get();
+        doPrivileged((PrivilegedAction<Void>) () -> {
+            SSLContext.setDefault(sslContext);
+            return null;
+        });
+        valueConsumer.accept(sslContext);
+    }
+
+    @Override
+    public void stop(StopContext context) {
+        // We can't set the default back to 'null' as that would cause a NullPointerException.
+        // For the purpose of testing we may want to restore the default.
+        if (RESTORE_SSL_CONTEXT) {
+            try {
+                final SSLContext defaultSSLContext = SSLContext.getInstance("Default");
+                doPrivileged((PrivilegedAction<Void>) () -> {
+                    SSLContext.setDefault(defaultSSLContext);
+                    return null;
+                });
+            } catch (NoSuchAlgorithmException e) {
+                LOGGER.debug(e);
+            }
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/DoohickeyAddHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/DoohickeyAddHandler.java
new file mode 100644
index 0000000..b68bb92
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/DoohickeyAddHandler.java
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.commonRequirements;
+
+import java.util.function.Consumer;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.CapabilityServiceBuilder;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceController.Mode;
+import org.wildfly.common.function.ExceptionFunction;
+
+/**
+ * An add handler which makes use of a {@code Doohickey} to coordinate making a resource available
+ * both as an MSC service and as a runtime API.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+abstract class DoohickeyAddHandler<T> extends BaseAddHandler {
+
+    private final RuntimeCapability<?> runtimeCapability;
+    private final String apiCapabilityName;
+
+    public DoohickeyAddHandler(RuntimeCapability<?> runtimeCapability, AttributeDefinition[] configAttributes, String apiCapabilityName) {
+        super(runtimeCapability, configAttributes);
+        this.runtimeCapability =  runtimeCapability;
+        this.apiCapabilityName = apiCapabilityName;
+    }
+
+    @Override
+    protected void recordCapabilitiesAndRequirements(OperationContext context, ModelNode operation, Resource resource)
+            throws OperationFailedException {
+        super.recordCapabilitiesAndRequirements(context, operation, resource);
+
+        if (requiresRuntime(context)) {
+            // Just add one capability to allow access to the CredentialStore using the runtime API.
+            ElytronDoohickey<T> elytronDoohickey = createDoohickey(context.getCurrentAddress());
+
+            context.registerCapability(RuntimeCapability.Builder
+                    .<ExceptionFunction<OperationContext, T, OperationFailedException>> of(apiCapabilityName, true,
+                            elytronDoohickey)
+                    .build().fromBaseCapability(context.getCurrentAddressValue()));
+        }
+    }
+
+    @Override
+    protected void performRuntime(OperationContext context, ModelNode operation, Resource resource) throws OperationFailedException {
+        final String name = context.getCurrentAddressValue();
+        ExceptionFunction<OperationContext, T, OperationFailedException> runtimeApi = context.getCapabilityRuntimeAPI(apiCapabilityName,
+                name, ExceptionFunction.class);
+
+        ElytronDoohickey<T> doohickey = (ElytronDoohickey<T>) runtimeApi;
+        doohickey.resolveRuntime(context); // Must call parent 'resolveRuntime' as it handles the synchronization.
+
+        CapabilityServiceBuilder<?> serviceBuilder = context.getCapabilityServiceTarget().addCapability(runtimeCapability);
+
+        Consumer<T> valueConsumer = serviceBuilder.provides(runtimeCapability);
+        doohickey.prepareService(context, serviceBuilder);
+
+        final TrivialService<T> trivialService = new TrivialService<>(doohickey::get, valueConsumer);
+
+        commonRequirements(serviceBuilder.setInitialMode(Mode.ACTIVE).setInstance(trivialService), true, dependOnProviderRegistration()).install();
+    }
+
+    protected boolean dependOnProviderRegistration() {
+        return true;
+    }
+
+    protected Mode getInitialMode() {
+        return Mode.ACTIVE;
+    }
+
+    protected abstract ElytronDoohickey<T> createDoohickey(final PathAddress resourceAddress);
+
+}
\ No newline at end of file
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronDoohickey.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronDoohickey.java
new file mode 100644
index 0000000..4b624db
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronDoohickey.java
@@ -0,0 +1,204 @@
+/*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.common.Assert.checkNotNullParam;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathResolver;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.io.File;
+import java.util.ArrayDeque;
+import java.util.Deque;
+import java.util.Iterator;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+import org.jboss.as.controller.CapabilityServiceBuilder;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.services.path.PathManager;
+import org.jboss.as.controller.services.path.PathManagerService;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.StartException;
+import org.wildfly.common.function.ExceptionFunction;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PathResolver;
+
+/**
+ * The {@code Doohickey} is the central point for resource initialisation allowing a resource to be
+ * initialised for it's runtime API, as a service or a combination of them both.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+abstract class ElytronDoohickey<T> implements ExceptionFunction<OperationContext, T, OperationFailedException> {
+
+    private static final ThreadLocal<Deque<PathAddress>> CALL_STACK = new ThreadLocal() {
+        @Override
+        protected Deque<PathAddress> initialValue() {
+            return new ArrayDeque<>();
+        }
+    };
+
+    /*
+     * As each Thread tracks the addresses of the relevent resources we could likely implement some form of
+     * deadlock detection that does not rely on taking a global lock.
+     */
+
+    private static final Lock GLOBAL_LOCK = new ReentrantLock();
+
+    private final PathAddress resourceAddress;
+
+    private volatile boolean modelResolved = false;
+    private volatile ExceptionSupplier<T, StartException> serviceValueSupplier;
+
+    private volatile T value;
+
+    protected ElytronDoohickey(final PathAddress resourceAddress) {
+        this.resourceAddress = checkNotNullParam("resourceAddress", resourceAddress);
+    }
+
+    @Override
+    public final T apply(final OperationContext foreignContext) throws OperationFailedException {
+        // The apply method is assumed to be called from the runtime API - i.e. MSC dependencies are not available.
+        if (value == null) {
+            GLOBAL_LOCK.lock();
+            try {
+                checkCycle();
+                try {
+                    if (value == null) {
+                        if (foreignContext == null) {
+                            // If a caller that can't provide an OperationContext needs to initialize,
+                            // there's a programming bug as this object should be initialized
+                            // before any call paths are executed that don't come through
+                            // the OperationStepHandlers that provide a context.
+                            throw LOGGER.illegalNonManagementInitialization(getClass());
+                        }
+                        resolveRuntime(foreignContext, true);
+                        value = createImmediately(foreignContext);
+                    }
+                } finally {
+                    CALL_STACK.get().removeFirst();
+                }
+            } finally {
+                GLOBAL_LOCK.unlock();
+            }
+        }
+
+        return value;
+    }
+
+    public final T get() throws StartException {
+        // The get method is assumed to be called as part of the MSC lifecycle.
+        if (value == null) {
+            GLOBAL_LOCK.lock();
+            try {
+                checkCycle();
+                try {
+                    if (value == null) {
+                        value = serviceValueSupplier.get();
+                    }
+                } finally {
+                    CALL_STACK.get().removeFirst();
+                }
+            } catch (OperationFailedException e) {
+                throw new StartException(e);
+            } finally {
+                GLOBAL_LOCK.unlock();
+            }
+        }
+
+        return value;
+    }
+
+    public final void prepareService(OperationContext context, CapabilityServiceBuilder<?> serviceBuilder) throws OperationFailedException {
+        // If we know we have been initialised i.e. an early expression resolution do we want to skip the service wiring?
+        serviceValueSupplier = prepareServiceSupplier(context, serviceBuilder);
+    }
+
+    public final void resolveRuntime(final OperationContext foreignContext) throws OperationFailedException {
+        resolveRuntime(foreignContext, false);
+    }
+
+    private final void resolveRuntime(final OperationContext foreignContext, final boolean skipCycleCheck) throws OperationFailedException {
+        // The OperationContext may not be foreign but treat it as though it is.
+        if (!modelResolved) {
+            if (value == null) {
+                GLOBAL_LOCK.lock();
+                try {
+                    if (!skipCycleCheck) {
+                        checkCycle();
+                    }
+                    try {
+                        if (!modelResolved) {
+                            ModelNode model = foreignContext.readResourceFromRoot(resourceAddress).getModel();
+                            resolveRuntime(model, foreignContext);
+                            modelResolved = true;
+                        }
+                    } finally {
+                        if (!skipCycleCheck) {
+                            CALL_STACK.get().removeFirst();
+                        }
+                    }
+                } finally {
+                    GLOBAL_LOCK.unlock();
+                }
+            }
+        }
+    }
+
+    protected File resolveRelativeToImmediately(String path, String relativeTo, OperationContext foreignContext) {
+        PathResolver pathResolver = pathResolver();
+        pathResolver.path(path);
+        if (relativeTo != null) {
+            PathManager pathManager = (PathManager) foreignContext.getServiceRegistry(false)
+                    .getRequiredService(PathManagerService.SERVICE_NAME).getValue();
+            pathResolver.relativeTo(relativeTo, pathManager);
+        }
+        File resolved = pathResolver.resolve();
+        pathResolver.clear();
+
+        return resolved;
+    }
+
+    private void checkCycle() throws OperationFailedException {
+        Deque<PathAddress> currentStack = CALL_STACK.get();
+        if (currentStack.contains(resourceAddress)) {
+            StringBuilder sb = new StringBuilder();
+            Iterator<PathAddress> iterator = currentStack.descendingIterator();
+            boolean foundStart = false;
+            while (iterator.hasNext()) {
+                PathAddress current = iterator.next();
+                foundStart = foundStart || current.equals(resourceAddress);
+                if (foundStart) {
+                    sb.append('{').append(current.toString()).append("}->");
+                }
+            }
+            sb.append('{').append(resourceAddress.toString()).append('}');
+
+            throw LOGGER.cycleDetected(sb.toString());
+        }
+        currentStack.addFirst(resourceAddress);
+    }
+
+    protected abstract void resolveRuntime(ModelNode model, OperationContext context) throws OperationFailedException;
+
+    protected abstract ExceptionSupplier<T, StartException> prepareServiceSupplier(OperationContext context, CapabilityServiceBuilder<?> serviceBuilder) throws OperationFailedException;
+
+    protected abstract T createImmediately(OperationContext foreignContext) throws OperationFailedException;
+
+}
\ No newline at end of file
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronOperationStepHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronOperationStepHandler.java
new file mode 100644
index 0000000..a37f00e
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronOperationStepHandler.java
@@ -0,0 +1,45 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.ProcessType;
+import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
+
+/**
+ * An {@link OperationStepHandler} which adds the ability to check whether or not the operation is running on a server
+ * or host controller.
+ *
+ * @author <a href="mailto:jperkins@redhat.com">James R. Perkins</a>
+ */
+interface ElytronOperationStepHandler extends OperationStepHandler {
+
+    /**
+     * Checks if the context is running on a {@linkplain ProcessType#isServer() server} or on a host controller. This
+     * will return {@code true} even if the server is running in {@link org.jboss.as.controller.RunningMode#ADMIN_ONLY}.
+     *
+     * @param context the current operation context
+     *
+     * @return {@code true} if the current context is a server or a host controller
+     */
+    default boolean isServerOrHostController(final OperationContext context) {
+        return context.getProcessType().isServer() || !ModelDescriptionConstants.PROFILE.equals(context.getCurrentAddress().getElement(0).getKey());
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronReloadRequiredWriteAttributeHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronReloadRequiredWriteAttributeHandler.java
new file mode 100644
index 0000000..6b39b3a
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronReloadRequiredWriteAttributeHandler.java
@@ -0,0 +1,83 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017, Red Hat Middleware LLC, and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ *
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.security.CredentialReference.applyCredentialReferenceUpdateToRuntime;
+import static org.jboss.as.controller.security.CredentialReference.handleCredentialReferenceUpdate;
+import static org.jboss.as.controller.security.CredentialReference.rollbackCredentialStoreUpdate;
+
+import java.util.Collection;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.ReloadRequiredWriteAttributeHandler;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.dmr.ModelNode;
+
+/**
+ * @author <a href="mailto:thofman@redhat.com">Tomas Hofman</a>
+ */
+class ElytronReloadRequiredWriteAttributeHandler extends ReloadRequiredWriteAttributeHandler implements ElytronOperationStepHandler {
+    ElytronReloadRequiredWriteAttributeHandler(final AttributeDefinition... definitions) {
+        super(definitions);
+    }
+
+    ElytronReloadRequiredWriteAttributeHandler(final Collection<AttributeDefinition> definitions) {
+        super(definitions);
+    }
+
+    @Override
+    protected void finishModelStage(OperationContext context, ModelNode operation, String attributeName, ModelNode newValue,
+                                    ModelNode oldValue, Resource resource) throws OperationFailedException {
+        super.finishModelStage(context, operation, attributeName, newValue, oldValue, resource);
+        if (attributeName.equals(CredentialReference.CREDENTIAL_REFERENCE)) {
+            handleCredentialReferenceUpdate(context, resource.getModel().get(attributeName), attributeName);
+        }
+    }
+
+    @Override
+    protected boolean applyUpdateToRuntime(OperationContext context, ModelNode operation, String attributeName, ModelNode resolvedValue,
+                                           ModelNode currentValue, HandbackHolder<Void> handbackHolder) throws OperationFailedException {
+        boolean requiresReload = false;
+        if (attributeName.equals(CredentialReference.CREDENTIAL_REFERENCE)) {
+            requiresReload = applyCredentialReferenceUpdateToRuntime(context, operation, resolvedValue, currentValue, attributeName);
+
+        }
+        return super.applyUpdateToRuntime(context, operation, attributeName, resolvedValue, currentValue, handbackHolder) || requiresReload;
+    }
+
+    @Override
+    protected boolean requiresRuntime(final OperationContext context) {
+        return isServerOrHostController(context);
+    }
+
+    @Override
+    protected void revertUpdateToRuntime(OperationContext context, ModelNode operation, String attributeName, ModelNode valueToRestore, ModelNode resolvedValue, Void handback) throws OperationFailedException {
+        if (attributeName.equals(CredentialReference.CREDENTIAL_REFERENCE)) {
+            rollbackCredentialStoreUpdate(getAttributeDefinition(attributeName), context, resolvedValue);
+        }
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronRuntimeOnlyHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronRuntimeOnlyHandler.java
new file mode 100644
index 0000000..6cc8d4e
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronRuntimeOnlyHandler.java
@@ -0,0 +1,36 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import org.jboss.as.controller.AbstractRuntimeOnlyHandler;
+import org.jboss.as.controller.OperationContext;
+
+/**
+ * Extends the {@link AbstractRuntimeOnlyHandler} only {@linkplain #requiresRuntime(OperationContext) requiring the runtime step }
+ * if {@link #isServerOrHostController(OperationContext)} returns {@code true}.
+ *
+ * @author <a href="mailto:jperkins@redhat.com">James R. Perkins</a>
+ */
+abstract class ElytronRuntimeOnlyHandler extends AbstractRuntimeOnlyHandler implements ElytronOperationStepHandler {
+
+    @Override
+    protected boolean requiresRuntime(OperationContext context) {
+        return isServerOrHostController(context);
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsExtension.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsExtension.java
new file mode 100644
index 0000000..d123afb
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsExtension.java
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUBSYSTEM;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+import javax.net.ssl.SSLContext;
+
+import org.jboss.as.controller.Extension;
+import org.jboss.as.controller.ExtensionContext;
+import org.jboss.as.controller.ModelVersion;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.SubsystemRegistration;
+import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.extension.ExpressionResolverExtension;
+import org.jboss.as.controller.operations.common.GenericSubsystemDescribeHandler;
+import org.jboss.as.controller.parsing.ExtensionParsingContext;
+import org.jboss.as.controller.registry.ImmutableManagementResourceRegistration;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.server.deployment.AttachmentKey;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+
+/**
+ * @author <a href="mailto:mmazanek@redhat.com">Martin Mazanek</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class ElytronTlsExtension implements Extension {
+
+    /**
+     * The namespaces used for the TLS subsystem.
+     */
+
+    public static final String NAMESPACE_1_0 = "urn:wildfly:elytron-tls-subsystem:1.0";
+
+    public static final String CURRENT_NAMESPACE = NAMESPACE_1_0;
+
+    private static final ElytronTlsSubsystemParser_1_0 CURRENT_PARSER = new ElytronTlsSubsystemParser_1_0();
+
+    /**
+     * The name of our subsystem within the model.
+     */
+    public static final String SUBSYSTEM_NAME = "elytron-tls";
+
+    protected static final PathElement SUBSYSTEM_PATH = PathElement.pathElement(SUBSYSTEM, SUBSYSTEM_NAME);
+
+    static final ServiceName BASE_SERVICE_NAME = ServiceName.of(SUBSYSTEM_NAME);
+
+    public static final AttachmentKey<SSLContext> SSL_CONTEXT_KEY = AttachmentKey.create(SSLContext.class);
+
+    private static final String RESOURCE_NAME = ElytronTlsExtension.class.getPackage().getName() + ".LocalDescriptions";
+
+    protected static final ModelVersion VERSION_1_0_0 = ModelVersion.create(1, 0, 0);
+    private static final ModelVersion CURRENT_MODEL_VERSION = VERSION_1_0_0;
+
+    static final String ISO_8601_FORMAT = "yyyy-MM-dd'T'HH:mm:ss.SSSZ";
+
+    static StandardResourceDescriptionResolver getResourceDescriptionResolver(final String... keyPrefix) {
+        return getResourceDescriptionResolver(false, keyPrefix);
+
+    }
+
+    static StandardResourceDescriptionResolver getResourceDescriptionResolver(final boolean useUnprefixedChildTypes, final String... keyPrefix) {
+        StringBuilder prefix = new StringBuilder(ElytronTlsExtension.SUBSYSTEM_NAME);
+        for (String kp : keyPrefix) {
+            prefix.append('.').append(kp);
+        }
+        return new StandardResourceDescriptionResolver(prefix.toString(), RESOURCE_NAME, ElytronTlsExtension.class.getClassLoader(), true, useUnprefixedChildTypes);
+    }
+
+    static boolean isServerOrHostController(ImmutableManagementResourceRegistration resourceRegistration) {
+        return resourceRegistration.getProcessType().isServer() || !ModelDescriptionConstants.PROFILE.equals(resourceRegistration.getPathAddress().getElement(0).getKey());
+    }
+
+    @Override
+    public void initialize(ExtensionContext extensionContext) {
+        final SubsystemRegistration sr =  extensionContext.registerSubsystem(SUBSYSTEM_NAME, CURRENT_MODEL_VERSION);
+
+        AtomicReference<ExpressionResolverExtension> resolverRef = new AtomicReference<>();
+        final ManagementResourceRegistration root = sr.registerSubsystemModel(new ElytronTlsSubsystemDefinition(resolverRef));
+        root.registerOperationHandler(GenericSubsystemDescribeHandler.DEFINITION, GenericSubsystemDescribeHandler.INSTANCE, false);
+        sr.registerXMLElementWriter(CURRENT_PARSER);
+
+        extensionContext.registerExpressionResolverExtension(resolverRef::get, ExpressionResolverResourceDefinition.INITIAL_PATTERN, false);
+    }
+
+    @SuppressWarnings("unchecked")
+    static <T> ServiceController<T> getRequiredService(ServiceRegistry serviceRegistry, ServiceName serviceName, Class<T> serviceType) {
+        ServiceController<?> controller = serviceRegistry.getRequiredService(serviceName);
+        return (ServiceController<T>) controller;
+    }
+
+    @Override
+    public void initializeParsers(ExtensionParsingContext extensionParsingContext) {
+        extensionParsingContext.setSubsystemXmlMapping(SUBSYSTEM_NAME, CURRENT_NAMESPACE, CURRENT_PARSER);
+    }
+
+    static public String getCurrentXsdPath() {
+        StringBuilder xsdPath = new StringBuilder("schema/elytron-tls-subsystem_");
+        String pathVersionNumber = CURRENT_NAMESPACE.split(":")[3].replace('.', '_');
+        return xsdPath.append(pathVersionNumber).append(".xsd").toString();
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystemDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystemDefinition.java
new file mode 100644
index 0000000..b78f5fa
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystemDefinition.java
@@ -0,0 +1,346 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.OperationContext.Stage.RUNTIME;
+import static org.jboss.as.server.deployment.Phase.CONFIGURE_DEFAULT_SSL_CONTEXT;
+import static org.jboss.as.server.deployment.Phase.CONFIGURE_MODULE;
+import static org.jboss.as.server.deployment.Phase.DEPENDENCIES;
+import static org.jboss.as.server.deployment.Phase.STRUCTURE;
+import static org.wildfly.extension.elytron.tls.Capabilities.ELYTRON_TLS_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.SSL_CONTEXT_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+
+import java.security.Provider;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+
+import javax.net.ssl.SSLContext;
+
+import org.jboss.as.controller.AbstractBoottimeAddStepHandler;
+import org.jboss.as.controller.AbstractRemoveStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.AttributeMarshaller;
+import org.jboss.as.controller.AttributeParser;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationContext.AttachmentKey;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PersistentResourceDefinition;
+import org.jboss.as.controller.PropertiesAttributeDefinition;
+import org.jboss.as.controller.ReloadRequiredWriteAttributeHandler;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.StringListAttributeDefinition;
+import org.jboss.as.controller.extension.ExpressionResolverExtension;
+import org.jboss.as.controller.operations.validation.StringLengthValidator;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.server.AbstractDeploymentChainStep;
+import org.jboss.as.server.DeploymentProcessorTarget;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.Mode;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+import org.jboss.msc.service.ServiceTarget;
+import org.wildfly.extension.elytron.tls._private.ElytronTLSMessages;
+import org.wildfly.extension.elytron.tls.deployment.DependencyProcessor;
+import org.wildfly.extension.elytron.tls.expression.DeploymentExpressionResolverProcessor;
+import org.wildfly.security.Version;
+
+/**
+ * Top level {@link PersistentResourceDefinition} for the Elytron TLS subsystem.
+ *
+ * @author <a href="mailto:kabir.khan@jboss.com">Kabir Khan</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class ElytronTlsSubsystemDefinition extends PersistentResourceDefinition {
+
+    /**
+     * System property which if set to {@code true} will cause the JVM wide default {@link SSLContext} to be restored when the subsystem shuts down.
+     *
+     * This property is only for use by test cases.
+     */
+    static final String RESTORE_DEFAULT_SSL_CONTEXT = ElytronTlsSubsystemDefinition.class.getPackage().getName() + ".restore-default-ssl-context";
+
+    static final PropertiesAttributeDefinition SECURITY_PROPERTIES = new PropertiesAttributeDefinition.Builder(Constants.SECURITY_PROPERTIES, true)
+            .build();
+
+    private static final AttachmentKey<SecurityPropertyService> SECURITY_PROPERTY_SERVICE_KEY = AttachmentKey.create(SecurityPropertyService.class);
+
+
+    static final SimpleAttributeDefinition DEFAULT_SSL_CONTEXT = new SimpleAttributeDefinitionBuilder(Constants.DEFAULT_SSL_CONTEXT, ModelType.STRING, true)
+            .setCapabilityReference(SSL_CONTEXT_CAPABILITY, ELYTRON_TLS_RUNTIME_CAPABILITY)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition INITIAL_PROVIDERS = new SimpleAttributeDefinitionBuilder(Constants.INITIAL_PROVIDERS, ModelType.STRING, true)
+            .setCapabilityReference(PROVIDERS_CAPABILITY, ELYTRON_TLS_RUNTIME_CAPABILITY)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition FINAL_PROVIDERS = new SimpleAttributeDefinitionBuilder(Constants.FINAL_PROVIDERS, ModelType.STRING, true)
+            .setCapabilityReference(PROVIDERS_CAPABILITY, ELYTRON_TLS_RUNTIME_CAPABILITY)
+            .setRestartAllServices()
+            .build();
+
+    static final StringListAttributeDefinition DISALLOWED_PROVIDERS = new StringListAttributeDefinition.Builder(Constants.DISALLOWED_PROVIDERS)
+            .setRequired(false)
+            .setAttributeParser(AttributeParser.STRING_LIST)
+            .setAttributeMarshaller(AttributeMarshaller.STRING_LIST)
+            .setRestartJVM()
+            .setElementValidator(new StringLengthValidator(1))
+            .setAllowExpression(true)
+            .build();
+
+    private final AtomicReference<ExpressionResolverExtension> resolverRef;
+
+    public ElytronTlsSubsystemDefinition(AtomicReference<ExpressionResolverExtension> resolverRef) {
+        super(
+                new SimpleResourceDefinition.Parameters(
+                        ElytronTlsExtension.SUBSYSTEM_PATH,
+                        ElytronTlsExtension.getResourceDescriptionResolver())
+                .setAddHandler(new ElytronTlsAdd())
+                .setRemoveHandler(new ElytronTlsRemove())
+                .setCapabilities(ELYTRON_TLS_RUNTIME_CAPABILITY)
+        );
+        this.resolverRef = resolverRef;
+    }
+
+    @Override
+    public void registerChildren(ManagementResourceRegistration resourceRegistration) {
+        final boolean serverOrHostController = isServerOrHostController(resourceRegistration);
+
+        // Expression Resolver
+        resourceRegistration.registerSubModel(ExpressionResolverResourceDefinition.getExpressionResolverDefinition(resourceRegistration.getPathAddress(), resolverRef));
+
+        // Provider Loader
+        resourceRegistration.registerSubModel(ProviderDefinitions.getAggregateProvidersDefinition());
+        resourceRegistration.registerSubModel(ProviderDefinitions.getProviderLoaderDefinition(serverOrHostController));
+
+        // Credential Store Block
+        resourceRegistration.registerSubModel(new CredentialStoreResourceDefinition());
+        resourceRegistration.registerSubModel(new SecretKeyCredentialStoreDefinition());
+
+        // TLS Builders
+        resourceRegistration.registerSubModel(AdvancedModifiableKeyStoreDecorator.wrap(new KeyStoreDefinition()));
+        resourceRegistration.registerSubModel(SSLContextDefinitions.getKeyManagerDefinition());
+        resourceRegistration.registerSubModel(SSLContextDefinitions.getTrustManagerDefinition());
+        resourceRegistration.registerSubModel(new CertificateAuthorityDefinition());
+        resourceRegistration.registerSubModel(new CertificateAuthorityAccountDefinition());
+        resourceRegistration.registerSubModel(SSLContextDefinitions.getClientSSLContextDefinition(serverOrHostController));
+        resourceRegistration.registerSubModel(SSLContextDefinitions.getServerSSLContextDefinition(serverOrHostController));
+    }
+    @Override
+    public Collection<AttributeDefinition> getAttributes() {
+        return Collections.emptyList();
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        OperationStepHandler writeHandler = new ReloadRequiredWriteAttributeHandler(INITIAL_PROVIDERS, FINAL_PROVIDERS, DISALLOWED_PROVIDERS);
+        resourceRegistration.registerReadWriteAttribute(SECURITY_PROPERTIES, null, new SecurityPropertiesWriteHandler(SECURITY_PROPERTIES));
+        resourceRegistration.registerReadWriteAttribute(DEFAULT_SSL_CONTEXT, null, new ElytronWriteAttributeHandler<Void>(DEFAULT_SSL_CONTEXT) {
+            @Override
+            protected boolean applyUpdateToRuntime(OperationContext context, ModelNode operation, String attributeName,
+                                                   ModelNode resolvedValue, ModelNode currentValue,
+                                                   HandbackHolder<Void> handbackHolder) throws OperationFailedException {
+                if (!resolvedValue.isDefined() && currentValue.isDefined()) {
+                    // We can not capture the existing default as by doing so we would trigger it's initialisation which
+                    // could fail in a variety of ways as well as the wasted initialisation, if the attribute is being
+                    // changed from defined to undefined the only option is to completely restart the process.
+                    context.restartRequired();
+                    return false;
+                }
+                return true;
+            }
+
+            @Override
+            protected void revertUpdateToRuntime(OperationContext context, ModelNode operation, String attributeName,
+                                                 ModelNode valueToRestore, ModelNode valueToRevert,
+                                                 Void handback) throws OperationFailedException {}
+
+        });
+        resourceRegistration.registerReadWriteAttribute(INITIAL_PROVIDERS, null, writeHandler);
+        resourceRegistration.registerReadWriteAttribute(FINAL_PROVIDERS, null, writeHandler);
+        resourceRegistration.registerReadWriteAttribute(DISALLOWED_PROVIDERS, null, writeHandler);
+    }
+
+    @Override
+    public void registerAdditionalRuntimePackages(ManagementResourceRegistration resourceRegistration) {
+    }
+
+    static <T> ServiceBuilder<T> commonRequirements(ServiceBuilder<T> serviceBuilder) {
+        return commonRequirements(serviceBuilder, true, true);
+    }
+
+    static <T> ServiceBuilder<T> commonRequirements(ServiceBuilder<T> serviceBuilder, boolean dependOnProperties, boolean dependOnProviderRegistration) {
+        if (dependOnProperties) serviceBuilder.requires(SecurityPropertyService.SERVICE_NAME);
+        if (dependOnProviderRegistration) serviceBuilder.requires(ProviderRegistrationService.SERVICE_NAME);
+        return serviceBuilder;
+    }
+
+    private static void installService(ServiceName serviceName, Service<?> service, ServiceTarget serviceTarget) {
+        serviceTarget.addService(serviceName, service)
+            .setInitialMode(Mode.ACTIVE)
+            .install();
+    }
+
+    private static SecurityPropertyService uninstallSecurityPropertyService(OperationContext context) {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+
+        ServiceController<?> service = serviceRegistry.getService(SecurityPropertyService.SERVICE_NAME);
+        if (service != null) {
+            Object serviceImplementation = service.getService();
+            context.removeService(service);
+            if (serviceImplementation != null && serviceImplementation instanceof SecurityPropertyService) {
+                return (SecurityPropertyService) serviceImplementation;
+            }
+        }
+
+        return null;
+    }
+
+    private static class ElytronTlsAdd extends AbstractBoottimeAddStepHandler implements ElytronOperationStepHandler  {
+
+        private ElytronTlsAdd() {
+            super(INITIAL_PROVIDERS, FINAL_PROVIDERS, DISALLOWED_PROVIDERS, SECURITY_PROPERTIES, DEFAULT_SSL_CONTEXT);
+        }
+
+        @Override
+        protected void populateModel(ModelNode operation, ModelNode model) throws OperationFailedException {
+            Version.getVersion();
+            super.populateModel(operation, model);
+        }
+
+        @Override
+        protected void performBoottime(OperationContext context, ModelNode operation, ModelNode model) throws OperationFailedException {
+            Map<String,String> securityProperties = SECURITY_PROPERTIES.unwrap(context, model);
+            final String defaultSSLContext = DEFAULT_SSL_CONTEXT.resolveModelAttribute(context, model).asStringOrNull();
+
+            ServiceTarget target = context.getServiceTarget();
+            installService(SecurityPropertyService.SERVICE_NAME, new SecurityPropertyService(securityProperties), target);
+
+            List<String> disallowedProviders = DISALLOWED_PROVIDERS.unwrap(context, operation);
+            ProviderRegistrationService prs = new ProviderRegistrationService(disallowedProviders);
+            ServiceBuilder<Void> builder = target.addService(ProviderRegistrationService.SERVICE_NAME, prs)
+                .setInitialMode(Mode.ACTIVE);
+
+            String initialProviders = INITIAL_PROVIDERS.resolveModelAttribute(context, model).asStringOrNull();
+            if (initialProviders != null) {
+                builder.addDependency(
+                        context.getCapabilityServiceName(PROVIDERS_CAPABILITY, initialProviders, Provider[].class),
+                        Provider[].class, prs.getInitialProivders());
+            }
+
+            String finalProviders = FINAL_PROVIDERS.resolveModelAttribute(context, model).asStringOrNull();
+            if (finalProviders != null) {
+                builder.addDependency(
+                        context.getCapabilityServiceName(PROVIDERS_CAPABILITY, finalProviders, Provider[].class),
+                        Provider[].class, prs.getFinalProviders());
+            }
+            builder.install();
+
+            if (defaultSSLContext != null) {
+                ServiceBuilder<?> serviceBuilder = target
+                        .addService(DefaultSSLContextService.SERVICE_NAME)
+                        .setInitialMode(Mode.ACTIVE);
+                Supplier<SSLContext> defaultSSLContextSupplier = serviceBuilder.requires(
+                        context.getCapabilityServiceName(SSL_CONTEXT_CAPABILITY, defaultSSLContext, SSLContext.class));
+                Consumer<SSLContext> valueConsumer = serviceBuilder.provides(DefaultSSLContextService.SERVICE_NAME);
+
+                DefaultSSLContextService defaultSSLContextService = new DefaultSSLContextService(defaultSSLContextSupplier, valueConsumer);
+                serviceBuilder.setInstance(defaultSSLContextService).install();
+            }
+
+            if (context.isNormalServer()) {
+                context.addStep(new AbstractDeploymentChainStep() {
+                    @Override
+                    public void execute(DeploymentProcessorTarget processorTarget) {
+                        final int DEPENDENCIES_ELYTRON_TLS = 0x0C60;
+                        final int STRUCTURE_ELYTRON_TLS_EXPRESSION_RESOLVER = 0x0490;
+
+                        processorTarget.addDeploymentProcessor(ElytronTlsExtension.SUBSYSTEM_NAME, STRUCTURE, STRUCTURE_ELYTRON_TLS_EXPRESSION_RESOLVER, new DeploymentExpressionResolverProcessor());
+                        processorTarget.addDeploymentProcessor(ElytronTlsExtension.SUBSYSTEM_NAME, DEPENDENCIES, DEPENDENCIES_ELYTRON_TLS, new DependencyProcessor());
+                        if (defaultSSLContext != null) {
+                            processorTarget.addDeploymentProcessor(ElytronTlsExtension.SUBSYSTEM_NAME, CONFIGURE_MODULE, CONFIGURE_DEFAULT_SSL_CONTEXT, new SSLContextDependencyProcessor());
+                        }
+                    }
+                }, RUNTIME);
+            }
+
+            ElytronTLSMessages.LOGGER.activatingSubsystem();
+        }
+
+        @Override
+        protected void rollbackRuntime(OperationContext context, ModelNode operation, Resource resource) {
+            uninstallSecurityPropertyService(context);
+            context.removeService(ProviderRegistrationService.SERVICE_NAME);
+        }
+
+        @Override
+        protected boolean requiresRuntime(final OperationContext context) {
+            return isServerOrHostController(context);
+        }
+    }
+
+    private static class ElytronTlsRemove extends AbstractRemoveStepHandler implements ElytronOperationStepHandler {
+        private ElytronTlsRemove() {
+            super(ELYTRON_TLS_RUNTIME_CAPABILITY);
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, ModelNode model) throws OperationFailedException {
+            if (context.isResourceServiceRestartAllowed()) {
+                SecurityPropertyService securityPropertyService = uninstallSecurityPropertyService(context);
+                if (securityPropertyService != null) {
+                    context.attach(SECURITY_PROPERTY_SERVICE_KEY, securityPropertyService);
+                }
+                context.removeService(ProviderRegistrationService.SERVICE_NAME);
+            } else {
+                context.reloadRequired();
+            }
+        }
+
+        @Override
+        protected void recoverServices(OperationContext context, ModelNode operation, ModelNode model)
+                throws OperationFailedException {
+            ServiceTarget target = context.getServiceTarget();
+            SecurityPropertyService securityPropertyService = context.getAttachment(SECURITY_PROPERTY_SERVICE_KEY);
+            if (securityPropertyService != null) {
+                installService(SecurityPropertyService.SERVICE_NAME, securityPropertyService, target);
+            }
+            List<String> providers = DISALLOWED_PROVIDERS.unwrap(context, model);
+            installService(ProviderRegistrationService.SERVICE_NAME, new ProviderRegistrationService(providers), target);
+        }
+
+        protected boolean requiresRuntime(final OperationContext context) {
+            return isServerOrHostController(context);
+        }
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystemParser_1_0.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystemParser_1_0.java
new file mode 100644
index 0000000..45c6a80
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystemParser_1_0.java
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.SECURITY_PROPERTY;
+import static org.wildfly.extension.elytron.tls.Constants.TLS;
+
+import org.jboss.as.controller.AttributeMarshallers;
+import org.jboss.as.controller.AttributeParsers;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+import org.jboss.as.controller.PersistentResourceXMLParser;
+
+/**
+ * A parser for the Elytron TLS subsystem.
+ * 
+ * @author <a href="mailto:kabir.khan@jboss.com">Kabir Khan</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class ElytronTlsSubsystemParser_1_0 extends PersistentResourceXMLParser {
+
+    PersistentResourceXMLDescription getServerSSLContextParser() {
+        return new SSLContextParsers().serverSslContextParser_1_0;
+    }
+
+    PersistentResourceXMLDescription getClientSSLContextParser() {
+        return new SSLContextParsers().clientSslContextParser_1_0;
+    }
+
+    PersistentResourceXMLDescription getKeyStoreParser() {
+        return new KeyStoreParser().keyStoreParser_1_0;
+    }
+    PersistentResourceXMLDescription getCredentialStoresParser() {
+        return new CredentialStoresParser().credentialStoresParser_1_0;
+    }
+
+    PersistentResourceXMLDescription getKeyManagerParser() {
+        return new ManagerParsers().keyManagerParser_1_0;
+    }
+    PersistentResourceXMLDescription getTrustManagerParser() {
+        return new ManagerParsers().trustManagerParser_1_0;
+    }
+    
+    PersistentResourceXMLDescription getCertificateAuthorityParser() {
+        return new CAParsers().certificateAuthorityParser_1_0;
+    }
+    PersistentResourceXMLDescription getCertificateAuthorityAccountParser() {
+        return new CAParsers().certificateAuthorityAccountParser_1_0;
+    }
+
+    PersistentResourceXMLDescription getProviderParser() {
+        return new ProviderParser().providerParser_1_0;
+    }
+
+    PersistentResourceXMLDescription getExpressionResolverParser() {
+        return new ExpressionResolverParser().expressionResolverParser_1_0;
+    }
+
+    String getNameSpace() {
+        return ElytronTlsExtension.NAMESPACE_1_0;
+    }
+
+    PersistentResourceXMLDescription getTlsParser() {
+        return PersistentResourceXMLDescription.decorator(TLS)
+                .addChild(getKeyStoreParser())
+                .addChild(getKeyManagerParser())
+                .addChild(getTrustManagerParser())
+                .addChild(getServerSSLContextParser())
+                .addChild(getClientSSLContextParser())
+                .addChild(getCertificateAuthorityParser())
+                .addChild(getCertificateAuthorityAccountParser())
+                .build();
+    }
+
+    @Override
+    public PersistentResourceXMLDescription getParserDescription() {
+        return PersistentResourceXMLDescription.builder(ElytronTlsExtension.SUBSYSTEM_PATH, getNameSpace())
+                .addAttribute(ElytronTlsSubsystemDefinition.INITIAL_PROVIDERS)
+                .addAttribute(ElytronTlsSubsystemDefinition.FINAL_PROVIDERS)
+                .addAttribute(ElytronTlsSubsystemDefinition.DISALLOWED_PROVIDERS)
+                .addAttribute(ElytronTlsSubsystemDefinition.SECURITY_PROPERTIES,
+                        new AttributeParsers.PropertiesParser(null, SECURITY_PROPERTY, true),
+                        new AttributeMarshallers.PropertiesAttributeMarshaller(null, SECURITY_PROPERTY, true))
+                .addAttribute(ElytronTlsSubsystemDefinition.DEFAULT_SSL_CONTEXT)
+                .addChild(getProviderParser())
+                .addChild(getTlsParser())
+                .addChild(getCredentialStoresParser())
+                .addChild(getExpressionResolverParser())
+                .build();
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronWriteAttributeHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronWriteAttributeHandler.java
new file mode 100644
index 0000000..5472895
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ElytronWriteAttributeHandler.java
@@ -0,0 +1,45 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.util.Collection;
+
+import org.jboss.as.controller.AbstractWriteAttributeHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+
+/**
+ * Extends the {@link AbstractWriteAttributeHandler} overriding the {@link #requiresRuntime(OperationContext)}.
+ *
+ * @author <a href="mailto:jperkins@redhat.com">James R. Perkins</a>
+ */
+abstract class ElytronWriteAttributeHandler<V> extends AbstractWriteAttributeHandler<V> implements ElytronOperationStepHandler {
+    protected ElytronWriteAttributeHandler(final AttributeDefinition... definitions) {
+        super(definitions);
+    }
+
+    protected ElytronWriteAttributeHandler(final Collection<AttributeDefinition> definitions) {
+        super(definitions);
+    }
+
+    @Override
+    protected boolean requiresRuntime(final OperationContext context) {
+        return isServerOrHostController(context);
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ExpressionResolverParser.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ExpressionResolverParser.java
new file mode 100644
index 0000000..2a6a31a
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ExpressionResolverParser.java
@@ -0,0 +1,34 @@
+ /*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.ENCRYPTION;
+import static org.wildfly.extension.elytron.tls.Constants.EXPRESSION;
+import static org.wildfly.extension.elytron.tls.Constants.EXPRESSION_RESOLVER;
+
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+
+class ExpressionResolverParser {
+    final PersistentResourceXMLDescription expressionResolverParser_1_0 = PersistentResourceXMLDescription.builder(
+            PathElement.pathElement(EXPRESSION, ENCRYPTION))
+            .setXmlElementName(EXPRESSION_RESOLVER)
+            .addAttribute(ExpressionResolverResourceDefinition.RESOLVERS)
+            .addAttribute(ExpressionResolverResourceDefinition.DEFAULT_RESOLVER)
+            .addAttribute(ExpressionResolverResourceDefinition.PREFIX)
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ExpressionResolverResourceDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ExpressionResolverResourceDefinition.java
new file mode 100644
index 0000000..6ebb5a4
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ExpressionResolverResourceDefinition.java
@@ -0,0 +1,273 @@
+/*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.EXPRESSION_RESOLVER_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.regex.Pattern;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AbstractRemoveStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.AttributeMarshaller;
+import org.jboss.as.controller.AttributeParser;
+import org.jboss.as.controller.ObjectListAttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.extension.ExpressionResolverExtension;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.wildfly.extension.elytron.tls.expression.ElytronExpressionResolver;
+import org.wildfly.extension.elytron.tls.expression.ElytronExpressionResolver.ResolverConfiguration;
+import org.wildfly.extension.elytron.tls.expression.ExpressionResolverRuntimeHandler;
+
+/**
+ * The {@link ResourceDefinition} for the expression resolver resource.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class ExpressionResolverResourceDefinition extends SimpleResourceDefinition {
+
+    public static final Pattern INITIAL_PATTERN = Pattern.compile("\\$\\{.+::.*:.+}");
+
+    // Resource Resolver
+    private static final StandardResourceDescriptionResolver RESOURCE_RESOLVER =
+            ElytronTlsExtension.getResourceDescriptionResolver(Constants.EXPRESSION, Constants.ENCRYPTION);
+
+    /*
+     * As this resource is attempting to make available an ExpressionResolver for use at runtime we need all values to be known before
+     * first use so the use of expressions is disabled on this resource.
+     */
+
+    private static final SimpleAttributeDefinition NAME = new SimpleAttributeDefinitionBuilder(Constants.NAME, ModelType.STRING, false)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    private static final SimpleAttributeDefinition CREDENTIAL_STORE = new SimpleAttributeDefinitionBuilder(Constants.CREDENTIAL_STORE, ModelType.STRING, false)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .setCapabilityReference(CREDENTIAL_STORE_CAPABILITY, EXPRESSION_RESOLVER_CAPABILITY)
+            .build();
+
+    private static final SimpleAttributeDefinition SECRET_KEY = new SimpleAttributeDefinitionBuilder(Constants.SECRET_KEY, ModelType.STRING, false)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    private static final ObjectTypeAttributeDefinition RESOLVER = new ObjectTypeAttributeDefinition.Builder(Constants.RESOLVER, NAME, CREDENTIAL_STORE, SECRET_KEY)
+            .setRequired(true)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectListAttributeDefinition RESOLVERS = new ObjectListAttributeDefinition.Builder(Constants.RESOLVERS, RESOLVER)
+            .setRequired(true)
+            .setMinSize(1)
+            .setAttributeParser(AttributeParser.UNWRAPPED_OBJECT_LIST_PARSER)
+            .setAttributeMarshaller(AttributeMarshaller.UNWRAPPED_OBJECT_LIST_MARSHALLER)
+            .build();
+
+    static final SimpleAttributeDefinition DEFAULT_RESOLVER = new SimpleAttributeDefinitionBuilder(Constants.DEFAULT_RESOLVER, ModelType.STRING, true)
+            .setAllowExpression(false)
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition PREFIX = new SimpleAttributeDefinitionBuilder(Constants.PREFIX, ModelType.STRING, true)
+            .setAllowExpression(false)
+            .setDefaultValue(new ModelNode("ENC"))
+            .setMinSize(1)
+            .setRestartAllServices()
+            .build();
+
+    private static final AttributeDefinition[] ATTRIBUTES = new AttributeDefinition[] {RESOLVERS, DEFAULT_RESOLVER, PREFIX};
+
+    // Operation and Parameters
+
+    static final SimpleAttributeDefinition RESOLVER_PARAM = new SimpleAttributeDefinitionBuilder(Constants.RESOLVER, ModelType.STRING, true)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleAttributeDefinition CLEAR_TEXT = new SimpleAttributeDefinitionBuilder(Constants.CLEAR_TEXT, ModelType.STRING, false)
+            .setMinSize(1)
+            .build();
+
+    static final SimpleOperationDefinition CREATE_EXPRESSION = new SimpleOperationDefinitionBuilder(Constants.CREATE_EXPRESSION, RESOURCE_RESOLVER)
+            .setParameters(RESOLVER_PARAM, CLEAR_TEXT)
+            .setRuntimeOnly()
+            .build();
+
+    ExpressionResolverResourceDefinition(OperationStepHandler add, OperationStepHandler remove,
+                                         RuntimeCapability<ExpressionResolverExtension> expressionResolverRuntimeCapability) {
+        super(new Parameters(PathElement.pathElement(Constants.EXPRESSION, Constants.ENCRYPTION),
+                RESOURCE_RESOLVER)
+                .setAddHandler(add)
+                .setRemoveHandler(remove)
+                .setAddRestartLevel(OperationEntry.Flag.RESTART_ALL_SERVICES)
+                .setRemoveRestartLevel(OperationEntry.Flag.RESTART_ALL_SERVICES)
+                .setCapabilities(expressionResolverRuntimeCapability));
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        OperationStepHandler write = new ElytronReloadRequiredWriteAttributeHandler(ATTRIBUTES);
+        for (AttributeDefinition current : ATTRIBUTES) {
+            resourceRegistration.registerReadWriteAttribute(current, null, write);
+        }
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration); // Needed for add / remove.
+        if (isServerOrHostController(resourceRegistration)) {
+            resourceRegistration.registerOperationHandler(CREATE_EXPRESSION, new CreateExpressionHandler());
+        }
+    }
+
+    static void configureExpressionResolver(PathAddress resourceAddress, ElytronExpressionResolver expressionResolver, OperationContext context) throws OperationFailedException {
+        // The OperationContext could be for any resource across the management model.
+        ModelNode expressionEncryption = context.readResourceFromRoot(resourceAddress).getModel();
+
+        String prefix = PREFIX.resolveModelAttribute(context, expressionEncryption).asString();
+
+        String defaultResolver = DEFAULT_RESOLVER.resolveModelAttribute(context, expressionEncryption).asStringOrNull();
+
+        Map<String, ResolverConfiguration> resolverConfigurations = new HashMap<>();
+        for (ModelNode currentResolver : RESOLVERS.resolveModelAttribute(context, expressionEncryption).asList()) {
+            String name = NAME.resolveModelAttribute(context, currentResolver).asString();
+            String credentialStoreName = CREDENTIAL_STORE.resolveModelAttribute(context, currentResolver).asString();
+            String alias = SECRET_KEY.resolveModelAttribute(context, currentResolver).asString();
+
+            resolverConfigurations.put(name, new ResolverConfiguration(credentialStoreName, alias));
+        }
+
+        expressionResolver.setPrefix(prefix)
+            .setDefaultResolver(defaultResolver)
+            .setResolverConfigurations(resolverConfigurations);
+    }
+
+    static ResourceDefinition getExpressionResolverDefinition(PathAddress parentAddress, AtomicReference<ExpressionResolverExtension> resolverRef) {
+        final PathAddress resourceAddress = parentAddress.append(PathElement.pathElement(Constants.EXPRESSION, Constants.ENCRYPTION));
+
+        ElytronExpressionResolver expressionResolver = new ElytronExpressionResolver(
+                (e, c) -> configureExpressionResolver(resourceAddress, e, c));
+        RuntimeCapability<ExpressionResolverExtension> expressionResolverRuntimeCapability =  RuntimeCapability
+                .Builder.<ExpressionResolverExtension>of(EXPRESSION_RESOLVER_CAPABILITY, false, expressionResolver)
+                .build();
+
+        AbstractAddStepHandler add = new ExpressionResolverAddHandler(expressionResolverRuntimeCapability, resolverRef);
+        OperationStepHandler remove = new ExpressionResolverRemoveHandler(expressionResolverRuntimeCapability, resolverRef);
+
+        return new ExpressionResolverResourceDefinition(add, remove, expressionResolverRuntimeCapability);
+    }
+
+    private static class ExpressionResolverAddHandler extends BaseAddHandler {
+
+        private final ElytronExpressionResolver expressionResolver;
+        private final AtomicReference<ExpressionResolverExtension> resolverRef;
+
+        ExpressionResolverAddHandler(RuntimeCapability<ExpressionResolverExtension> expressionResolverRuntimeCapability,
+                                     AtomicReference<ExpressionResolverExtension> resolverRef) {
+            super(expressionResolverRuntimeCapability, ATTRIBUTES);
+            this.expressionResolver = (ElytronExpressionResolver) expressionResolverRuntimeCapability.getRuntimeAPI();
+            this.resolverRef = resolverRef;
+        }
+
+        @Override
+        protected void populateModel(final OperationContext context, final ModelNode operation, final Resource resource) throws OperationFailedException {
+            super.populateModel(context, operation, resource);
+            resolverRef.set(expressionResolver);
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, Resource resource) throws OperationFailedException {
+
+            ExpressionResolverRuntimeHandler.initializeResolver(context);
+        }
+
+    }
+
+    private static class ExpressionResolverRemoveHandler extends AbstractRemoveStepHandler implements ElytronOperationStepHandler {
+
+        private final ElytronExpressionResolver expressionResolver;
+        private final AtomicReference<ExpressionResolverExtension> resolverRef;
+
+        ExpressionResolverRemoveHandler(RuntimeCapability<ExpressionResolverExtension> expressionResolverRuntimeCapability,
+                                        AtomicReference<ExpressionResolverExtension> resolverRef) {
+            super(expressionResolverRuntimeCapability);
+            this.expressionResolver = (ElytronExpressionResolver) expressionResolverRuntimeCapability.getRuntimeAPI();
+            this.resolverRef = resolverRef;
+        }
+
+        @Override
+        protected boolean requiresRuntime(final OperationContext context) {
+            return isServerOrHostController(context);
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, ModelNode model) {
+            if (context.isResourceServiceRestartAllowed()) {
+                resolverRef.set(null);
+            }
+        }
+
+        @Override
+        protected void recoverServices(OperationContext context, ModelNode operation, ModelNode model) throws OperationFailedException {
+            resolverRef.set(this.expressionResolver);
+        }
+
+    }
+
+    private static class CreateExpressionHandler extends ElytronRuntimeOnlyHandler {
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            String resolver = RESOLVER_PARAM.resolveModelAttribute(context, operation).asStringOrNull();
+            String clearText = CLEAR_TEXT.resolveModelAttribute(context, operation).asString();
+
+            ElytronExpressionResolver expressionResolver = (ElytronExpressionResolver) context.getCapabilityRuntimeAPI(EXPRESSION_RESOLVER_CAPABILITY, ExpressionResolverExtension.class);
+            String expression = expressionResolver.createExpression(resolver, clearText, context);
+
+            context.getResult().get(Constants.EXPRESSION).set(expression);
+        }
+
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/FileAttributeDefinitions.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/FileAttributeDefinitions.java
new file mode 100644
index 0000000..ee69e01
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/FileAttributeDefinitions.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.io.File;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
+import org.jboss.as.controller.services.path.PathEntry;
+import org.jboss.as.controller.services.path.PathManager;
+import org.jboss.as.controller.services.path.PathManager.Callback.Handle;
+import org.jboss.as.controller.services.path.PathManager.Event;
+import org.jboss.as.controller.services.path.PathManager.PathEventContext;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceName;
+
+/**
+ * A holder for {@link AttributeDefinition} instances related to file locations.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class FileAttributeDefinitions {
+
+    static final SimpleAttributeDefinition PATH = new SimpleAttributeDefinitionBuilder(Constants.PATH, ModelType.STRING, true)
+            .setAllowExpression(true)
+            .setMinSize(1)
+            .setAttributeGroup(Constants.FILE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition RELATIVE_TO = new SimpleAttributeDefinitionBuilder(Constants.RELATIVE_TO, ModelType.STRING, true)
+            .setMinSize(1)
+            .setAttributeGroup(Constants.FILE)
+            .setRequires(Constants.PATH)
+            .setRestartAllServices()
+            .build();
+
+    static ServiceName pathName(String relativeTo) {
+        return ServiceName.JBOSS.append(ModelDescriptionConstants.SERVER, ModelDescriptionConstants.PATH, relativeTo);
+    }
+
+    static PathResolver pathResolver() {
+        return new PathResolver();
+    }
+
+    static class PathResolver {
+
+        private String path;
+        private String relativeTo;
+        private PathManager pathManager;
+
+        private Handle callbackHandle;
+
+        PathResolver path(String path) {
+            this.path = path;
+
+            return this;
+        }
+
+        PathResolver relativeTo(String relativeTo, PathManager pathManager) {
+            this.relativeTo = relativeTo;
+            this.pathManager = pathManager;
+            return this;
+        }
+
+
+        File resolve() {
+            if (relativeTo != null) {
+                File resolvedPath = new File(pathManager.resolveRelativePathEntry(path, relativeTo));
+                callbackHandle = pathManager.registerCallback(relativeTo, new org.jboss.as.controller.services.path.PathManager.Callback() {
+
+                    @Override
+                    public void pathModelEvent(PathEventContext eventContext, String name) {
+                        if (eventContext.isResourceServiceRestartAllowed() == false) {
+                            eventContext.reloadRequired();
+                        }
+                    }
+
+                    @Override
+                    public void pathEvent(Event event, PathEntry pathEntry) {
+                        // Service dependencies should trigger a stop and start.
+                    }
+                }, Event.REMOVED, Event.UPDATED);
+
+                return resolvedPath;
+            } else {
+                return new File(path);
+            }
+        }
+
+        void clear() {
+            if (callbackHandle != null) {
+                callbackHandle.remove();
+                callbackHandle = null;
+            }
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreDefinition.java
new file mode 100644
index 0000000..7fa44ca
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreDefinition.java
@@ -0,0 +1,367 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP;
+import static org.jboss.as.controller.security.CredentialReference.handleCredentialReferenceUpdate;
+import static org.jboss.as.controller.security.CredentialReference.rollbackCredentialStoreUpdate;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.ISO_8601_FORMAT;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.getRequiredService;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.commonRequirements;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PATH;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.RELATIVE_TO;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathName;
+import static org.wildfly.extension.elytron.tls.ProviderAttributeDefinition.LOADED_PROVIDER;
+import static org.wildfly.extension.elytron.tls.ProviderAttributeDefinition.populateProvider;
+import static org.wildfly.extension.elytron.tls.ServiceStateDefinition.STATE;
+import static org.wildfly.extension.elytron.tls.ServiceStateDefinition.populateResponse;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.Provider;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.controller.services.path.PathManager;
+import org.jboss.as.controller.services.path.PathManagerService;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.Mode;
+import org.jboss.msc.service.ServiceController.State;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceTarget;
+import org.wildfly.extension.elytron.tls.KeyStoreService.LoadKey;
+
+/**
+ * A {@link ResourceDefinition} for a single {@link KeyStore}.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+final class KeyStoreDefinition extends SimpleResourceDefinition {
+
+    static final ServiceUtil<KeyStore> KEY_STORE_UTIL = ServiceUtil.newInstance(KEY_STORE_RUNTIME_CAPABILITY, Constants.KEY_STORE, KeyStore.class);
+
+    static final SimpleAttributeDefinition TYPE = new SimpleAttributeDefinitionBuilder(Constants.TYPE, ModelType.STRING, true)
+        .setAttributeGroup(Constants.IMPLEMENTATION)
+        .setAllowExpression(true)
+        .setMinSize(1)
+        .setRestartAllServices()
+        .build();
+
+    static final SimpleAttributeDefinition PROVIDER_NAME = new SimpleAttributeDefinitionBuilder(Constants.PROVIDER_NAME, ModelType.STRING, true)
+        .setAttributeGroup(Constants.IMPLEMENTATION)
+        .setAllowExpression(true)
+        .setMinSize(1)
+        .setRestartAllServices()
+        .build();
+
+    static final SimpleAttributeDefinition PROVIDERS = new SimpleAttributeDefinitionBuilder(Constants.PROVIDERS, ModelType.STRING, true)
+        .setAttributeGroup(Constants.IMPLEMENTATION)
+        .setMinSize(1)
+        .setRestartAllServices()
+        .setCapabilityReference(PROVIDERS_CAPABILITY, KEY_STORE_CAPABILITY)
+        .build();
+
+    static final ObjectTypeAttributeDefinition CREDENTIAL_REFERENCE = CredentialReference.getAttributeDefinition(true);
+
+    static final SimpleAttributeDefinition REQUIRED = new SimpleAttributeDefinitionBuilder(Constants.REQUIRED, ModelType.BOOLEAN, true)
+        .setDefaultValue(ModelNode.FALSE)
+        .setAllowExpression(true)
+        .setAttributeGroup(Constants.FILE)
+        .setRequires(Constants.PATH)
+        .setRestartAllServices()
+        .build();
+
+    static final SimpleAttributeDefinition ALIAS_FILTER = new SimpleAttributeDefinitionBuilder(Constants.ALIAS_FILTER, ModelType.STRING, true)
+        .setAllowExpression(true)
+        .setMinSize(1)
+        .setRestartAllServices()
+        .build();
+
+    // Resource Resolver
+
+    private static final StandardResourceDescriptionResolver RESOURCE_RESOLVER = ElytronTlsExtension.getResourceDescriptionResolver(Constants.KEY_STORE);
+
+    // Runtime Attributes
+
+    private static final SimpleAttributeDefinition SIZE = new SimpleAttributeDefinitionBuilder(Constants.SIZE, ModelType.INT)
+        .setStorageRuntime()
+        .build();
+
+    private static final SimpleAttributeDefinition SYNCHRONIZED = new SimpleAttributeDefinitionBuilder(Constants.SYNCHRONIZED, ModelType.STRING)
+        .setStorageRuntime()
+        .build();
+
+    private static final SimpleAttributeDefinition MODIFIED = new SimpleAttributeDefinitionBuilder(Constants.MODIFIED, ModelType.BOOLEAN)
+        .setStorageRuntime()
+        .build();
+
+    // Operations
+
+    private static final SimpleOperationDefinition LOAD = new SimpleOperationDefinitionBuilder(Constants.LOAD, RESOURCE_RESOLVER)
+        .setRuntimeOnly()
+        .build();
+
+    private static final SimpleOperationDefinition STORE = new SimpleOperationDefinitionBuilder(Constants.STORE, RESOURCE_RESOLVER)
+        .setRuntimeOnly()
+        .build();
+
+    private static final AttributeDefinition[] CONFIG_ATTRIBUTES = new AttributeDefinition[] { TYPE, PROVIDER_NAME, PROVIDERS, CREDENTIAL_REFERENCE, PATH, RELATIVE_TO, REQUIRED, ALIAS_FILTER };
+
+    private static final KeyStoreAddHandler ADD = new KeyStoreAddHandler();
+    private static final OperationStepHandler REMOVE = new TrivialCapabilityServiceRemoveHandler(ADD, KEY_STORE_RUNTIME_CAPABILITY);
+    private static final ElytronReloadRequiredWriteAttributeHandler WRITE = new ElytronReloadRequiredWriteAttributeHandler(CONFIG_ATTRIBUTES);
+
+    KeyStoreDefinition() {
+        super(new Parameters(PathElement.pathElement(Constants.KEY_STORE), RESOURCE_RESOLVER)
+            .setAddHandler(ADD)
+            .setRemoveHandler(REMOVE)
+            .setAddRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setCapabilities(KEY_STORE_RUNTIME_CAPABILITY));
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        for (AttributeDefinition current : CONFIG_ATTRIBUTES) {
+            resourceRegistration.registerReadWriteAttribute(current, null, WRITE);
+        }
+
+        if (isServerOrHostController(resourceRegistration)) {
+            resourceRegistration.registerReadOnlyAttribute(STATE, new ElytronRuntimeOnlyHandler() {
+
+                @Override
+                protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+                    ServiceName keyStoreName = KEY_STORE_UTIL.serviceName(operation);
+                    ServiceController<?> serviceController = context.getServiceRegistry(false).getRequiredService(keyStoreName);
+
+                    populateResponse(context.getResult(), serviceController);
+                }
+
+            });
+
+            resourceRegistration.registerReadOnlyAttribute(SIZE, new KeyStoreRuntimeOnlyHandler(false) {
+
+                @Override
+                protected void performRuntime(ModelNode result, ModelNode operation, KeyStoreService keyStoreService) throws OperationFailedException {
+                    try {
+                        result.set(keyStoreService.getValue().size());
+                    } catch (KeyStoreException e) {
+                        throw LOGGER.unableToAccessKeyStore(e);
+                    }
+                }
+            });
+
+            resourceRegistration.registerReadOnlyAttribute(SYNCHRONIZED, new KeyStoreRuntimeOnlyHandler(false) {
+
+                @Override
+                protected void performRuntime(ModelNode result, ModelNode operation, KeyStoreService keyStoreService) throws OperationFailedException {
+                    SimpleDateFormat sdf = new SimpleDateFormat(ISO_8601_FORMAT);
+                    result.set(sdf.format(new Date(keyStoreService.timeSynched())));
+                }
+            });
+
+            resourceRegistration.registerReadOnlyAttribute(MODIFIED, new KeyStoreRuntimeOnlyHandler(false) {
+
+                @Override
+                protected void performRuntime(ModelNode result, ModelNode operation, KeyStoreService keyStoreService) throws OperationFailedException {
+                    result.set(keyStoreService.isModified());
+                }
+            });
+
+            resourceRegistration.registerReadOnlyAttribute(LOADED_PROVIDER, new KeyStoreRuntimeOnlyHandler(false) {
+
+                @Override
+                protected void performRuntime(ModelNode result, ModelNode operation, KeyStoreService keyStoreService)
+                        throws OperationFailedException {
+                    populateProvider(result, keyStoreService.getValue().getProvider(), false);
+                }
+            });
+        }
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration);
+        resourceRegistration.registerOperationHandler(LOAD, PersistanceHandler.INSTANCE);
+        if (isServerOrHostController(resourceRegistration)) {
+            resourceRegistration.registerOperationHandler(STORE, PersistanceHandler.INSTANCE);
+        }
+    }
+
+    private static class KeyStoreAddHandler extends BaseAddHandler {
+
+        private KeyStoreAddHandler() {
+            super(KEY_STORE_RUNTIME_CAPABILITY, CONFIG_ATTRIBUTES);
+        }
+
+        @Override
+        protected void populateModel(final OperationContext context, final ModelNode operation, final Resource resource) throws  OperationFailedException {
+            super.populateModel(context, operation, resource);
+            handleCredentialReferenceUpdate(context, resource.getModel());
+        }
+
+        @Override
+        protected void performRuntime(OperationContext context, ModelNode operation, Resource resource) throws OperationFailedException {
+            ModelNode model = resource.getModel();
+            String providers = PROVIDERS.resolveModelAttribute(context, model).asStringOrNull();
+            String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+            String type = TYPE.resolveModelAttribute(context, model).asStringOrNull();
+            String path = PATH.resolveModelAttribute(context, model).asStringOrNull();
+            String relativeTo = null;
+            boolean required;
+            String aliasFilter = ALIAS_FILTER.resolveModelAttribute(context, model).asStringOrNull();
+
+            final KeyStoreService keyStoreService;
+            if (path != null) {
+                relativeTo = RELATIVE_TO.resolveModelAttribute(context, model).asStringOrNull();
+                required = REQUIRED.resolveModelAttribute(context, model).asBoolean();
+                keyStoreService = KeyStoreService.createFileBasedKeyStoreService(providerName, type, relativeTo, path, required, aliasFilter);
+            } else {
+                if (type == null) {
+                    throw LOGGER.filelessKeyStoreMissingType();
+                }
+                keyStoreService = KeyStoreService.createFileLessKeyStoreService(providerName, type, aliasFilter);
+            }
+
+            ServiceTarget serviceTarget = context.getServiceTarget();
+            RuntimeCapability<Void> runtimeCapability = KEY_STORE_RUNTIME_CAPABILITY.fromBaseCapability(context.getCurrentAddressValue());
+            ServiceName serviceName = runtimeCapability.getCapabilityServiceName(KeyStore.class);
+            ServiceBuilder<KeyStore> serviceBuilder = serviceTarget.addService(serviceName, keyStoreService).setInitialMode(Mode.ACTIVE);
+
+            serviceBuilder.addDependency(PathManagerService.SERVICE_NAME, PathManager.class, keyStoreService.getPathManagerInjector());
+            if (relativeTo != null) {
+                serviceBuilder.requires(pathName(relativeTo));
+            }
+
+            if (providers != null) {
+                String providersCapabilityName = RuntimeCapability.buildDynamicCapabilityName(PROVIDERS_CAPABILITY, providers);
+                ServiceName providerLoaderServiceName = context.getCapabilityServiceName(providersCapabilityName, Provider[].class);
+                serviceBuilder.addDependency(providerLoaderServiceName, Provider[].class, keyStoreService.getProvidersInjector());
+            }
+
+            keyStoreService.getCredentialSourceSupplierInjector()
+                    .inject(CredentialReference.getCredentialSourceSupplier(context, KeyStoreDefinition.CREDENTIAL_REFERENCE, model, serviceBuilder));
+
+            commonRequirements(serviceBuilder).install();
+        }
+
+        @Override
+        protected void rollbackRuntime(OperationContext context, final ModelNode operation, final Resource resource) {
+            rollbackCredentialStoreUpdate(KeyStoreDefinition.CREDENTIAL_REFERENCE, context, resource);
+        }
+    }
+
+    /*
+     * Runtime Attribute and Operation Handlers
+     */
+
+    abstract static class KeyStoreRuntimeOnlyHandler extends ElytronRuntimeOnlyHandler {
+
+        private final boolean serviceMustBeUp;
+        private final boolean writeAccess;
+
+        KeyStoreRuntimeOnlyHandler(final boolean serviceMustBeUp, final boolean writeAccess) {
+            this.serviceMustBeUp = serviceMustBeUp;
+            this.writeAccess = writeAccess;
+        }
+
+        KeyStoreRuntimeOnlyHandler(final boolean serviceMustBeUp) {
+            this(serviceMustBeUp, false);
+        }
+
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            ServiceName keyStoreName = KEY_STORE_UTIL.serviceName(operation);
+
+            ServiceController<KeyStore> serviceContainer = getRequiredService(context.getServiceRegistry(writeAccess), keyStoreName, KeyStore.class);
+            State serviceState;
+            if ((serviceState = serviceContainer.getState()) != State.UP) {
+                if (serviceMustBeUp) {
+                    throw LOGGER.requiredServiceNotUp(keyStoreName, serviceState);
+                }
+                return;
+            }
+
+            performRuntime(context.getResult(), context, operation, (KeyStoreService) serviceContainer.getService());
+        }
+
+        protected void performRuntime(ModelNode result, ModelNode operation,  KeyStoreService keyStoreService) throws OperationFailedException {}
+
+        protected void performRuntime(ModelNode result, OperationContext context, ModelNode operation,  KeyStoreService keyStoreService) throws OperationFailedException {
+            performRuntime(result, operation, keyStoreService);
+        }
+
+    }
+
+    private static class PersistanceHandler extends KeyStoreRuntimeOnlyHandler {
+
+        private static final PersistanceHandler INSTANCE = new PersistanceHandler();
+
+        private PersistanceHandler() {
+            super(true, true);
+        }
+
+        @Override
+        protected void performRuntime(ModelNode result, OperationContext context, ModelNode operation, final KeyStoreService keyStoreService) throws OperationFailedException {
+            String operationName = operation.require(OP).asString();
+            switch (operationName) {
+                case Constants.LOAD:
+                    final LoadKey loadKey = keyStoreService.load();
+                    context.completeStep((context1, operation1) -> keyStoreService.revertLoad(loadKey));
+                    break;
+                case Constants.STORE:
+                    keyStoreService.save();
+                    break;
+                default:
+                    throw LOGGER.invalidOperationName(operationName, Constants.LOAD,
+                            Constants.STORE);
+            }
+
+        }
+
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreParser.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreParser.java
new file mode 100644
index 0000000..505dcfa
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreParser.java
@@ -0,0 +1,40 @@
+ /*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.KEY_STORE;
+import static org.wildfly.extension.elytron.tls.Constants.KEY_STORES;
+
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+import org.jboss.as.controller.security.CredentialReference;
+
+class KeyStoreParser {
+
+    final PersistentResourceXMLDescription keyStoreParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(KEY_STORE))
+            .setXmlWrapperElement(KEY_STORES)
+            .addAttribute(KeyStoreDefinition.TYPE)
+            .addAttribute(KeyStoreDefinition.PROVIDER_NAME)
+            .addAttribute(KeyStoreDefinition.PROVIDERS)
+            .addAttribute(KeyStoreDefinition.CREDENTIAL_REFERENCE)
+            .addAttribute(KeyStoreDefinition.ALIAS_FILTER)
+            .addAttribute(KeyStoreDefinition.REQUIRED)
+            .addAttribute(FileAttributeDefinitions.PATH)
+            .addAttribute(FileAttributeDefinitions.RELATIVE_TO)
+            .addAttribute(CredentialReference.getAttributeDefinition())
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreService.java
new file mode 100644
index 0000000..5cd87b0
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/KeyStoreService.java
@@ -0,0 +1,410 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathResolver;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+import static org.wildfly.security.provider.util.ProviderUtil.findProvider;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.MessageDigest;
+import java.security.Provider;
+import java.security.Security;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateExpiredException;
+import java.security.cert.CertificateNotYetValidException;
+import java.security.cert.X509Certificate;
+import java.time.Instant;
+import java.time.ZonedDateTime;
+import java.util.Date;
+import java.util.Enumeration;
+import java.util.TimeZone;
+import java.util.function.Supplier;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.services.path.PathManager;
+import org.jboss.logging.Logger;
+import org.jboss.msc.inject.Injector;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+import org.jboss.msc.value.InjectedValue;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.common.iteration.ByteIterator;
+import org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PathResolver;
+import org.wildfly.security.EmptyProvider;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.source.CredentialSource;
+import org.wildfly.security.keystore.AliasFilter;
+import org.wildfly.security.keystore.AtomicLoadKeyStore;
+import org.wildfly.security.keystore.FilteringKeyStore;
+import org.wildfly.security.keystore.KeyStoreUtil;
+import org.wildfly.security.keystore.ModifyTrackingKeyStore;
+import org.wildfly.security.keystore.UnmodifiableKeyStore;
+import org.wildfly.security.password.interfaces.ClearPassword;
+import org.wildfly.security.x500.cert.SelfSignedX509CertificateAndSigningKey;
+
+/**
+ * A {@link Service} responsible for a single {@link KeyStore} instance.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class KeyStoreService implements ModifiableKeyStoreService {
+
+    private static final String GENERATED_CERTIFICATE_ALIAS = "server";
+    private static final String GENERATED_CERTIFICATE_KEY_ALGORITHM = "RSA";
+    private static final int GENERATED_CERTIFICATE_KEY_SIZE = 2048;
+    private static final String GENERATED_CERTIFICATE_SIGNATURE_ALGORITHM = "SHA256withRSA";
+    private static final int HEX_DELIMITER = ':';
+    private static final String COMMON_NAME_PREFIX = "CN=";
+
+    private final String provider;
+    private final String type;
+    private final String path;
+    private final String relativeTo;
+    private final boolean required;
+    private final String aliasFilter;
+
+    private final InjectedValue<PathManager> pathManager = new InjectedValue<>();
+    private final InjectedValue<Provider[]> providers = new InjectedValue<>();
+    private final InjectedValue<ExceptionSupplier<CredentialSource, Exception>> credentialSourceSupplier = new InjectedValue<>();
+
+    private PathResolver pathResolver;
+    private File resolvedPath;
+
+    private volatile long synched;
+    private volatile AtomicLoadKeyStore keyStore = null;
+    private volatile ModifyTrackingKeyStore trackingKeyStore = null;
+    private volatile KeyStore unmodifiableKeyStore = null;
+
+    private KeyStoreService(String provider, String type, String relativeTo, String path, boolean required, String aliasFilter) {
+        this.provider = provider;
+        this.type = type;
+        this.relativeTo = relativeTo;
+        this.path = path;
+        this.required = required;
+        this.aliasFilter = aliasFilter;
+    }
+
+    static KeyStoreService createFileLessKeyStoreService(String provider, String type, String aliasFilter) {
+        return new KeyStoreService(provider, type, null, null, false, aliasFilter);
+    }
+
+    static KeyStoreService createFileBasedKeyStoreService(String provider, String type, String relativeTo, String path, boolean required, String aliasFilter) {
+        return new KeyStoreService(provider, type, relativeTo, path, required, aliasFilter);
+    }
+
+    /*
+     * Service Lifecycle Related Methods
+     */
+
+    @Override
+    public void start(StartContext startContext) throws StartException {
+        try {
+            AtomicLoadKeyStore keyStore = null;
+
+            if (type != null) {
+                Provider provider = resolveProvider();
+                keyStore = AtomicLoadKeyStore.newInstance(type, provider);
+            }
+
+            if (path != null) {
+                pathResolver = pathResolver();
+                resolvedPath = getResolvedPath(pathResolver, path, relativeTo);
+            }
+
+            synched = System.currentTimeMillis();
+            if (resolvedPath != null && ! resolvedPath.exists()) {
+                if (required) {
+                    if (type == null) {
+                        throw LOGGER.nonexistingKeyStoreMissingType();
+                    } else {
+                        throw LOGGER.keyStoreFileNotExists(resolvedPath.getAbsolutePath());
+                    }
+                } else {
+                    LOGGER.keyStoreFileNotExistsButIgnored(resolvedPath.getAbsolutePath());
+                }
+            }
+
+            try (FileInputStream is = (resolvedPath != null && resolvedPath.exists()) ? new FileInputStream(resolvedPath) : null) {
+                char[] password = resolvePassword();
+
+                LOGGER.tracef(
+                        "starting:  type = %s  provider = %s  path = %s  resolvedPath = %s  password = %b  aliasFilter = %s",
+                        type, provider, path, resolvedPath, password != null, aliasFilter
+                );
+
+                if (is != null) {
+                    if (type != null) {
+                        keyStore.load(is, password);
+                    } else {
+                        Provider[] resolvedProviders = providers.getOptionalValue();
+                        if (resolvedProviders == null) {
+                            resolvedProviders = Security.getProviders();
+                        }
+                        final Provider[] finalProviders = resolvedProviders;
+                        KeyStore detected = KeyStoreUtil.loadKeyStore(() -> finalProviders, this.provider, is, resolvedPath.getPath(), password);
+
+                        if (detected == null) {
+                            throw LOGGER.unableToDetectKeyStore(resolvedPath.getPath());
+                        }
+
+                        keyStore = AtomicLoadKeyStore.atomize(detected);
+                    }
+                } else {
+                    if (keyStore == null) {
+                        String defaultType = KeyStore.getDefaultType();
+                        LOGGER.debugf(
+                                "KeyStore: provider = %s  path = %s  resolvedPath = %s  password = %b  aliasFilter = %s does not exist. New keystore of %s type will be created.",
+                                provider, path, resolvedPath, password != null, aliasFilter, defaultType
+                        );
+                        keyStore = AtomicLoadKeyStore.newInstance(defaultType);
+                    }
+
+                    synchronized (EmptyProvider.getInstance()) {
+                        keyStore.load(null, password);
+                    }
+                }
+                checkCertificatesValidity(keyStore);
+            }
+
+            this.keyStore = keyStore;
+            KeyStore intermediate = aliasFilter != null ? FilteringKeyStore.filteringKeyStore(keyStore, AliasFilter.fromString(aliasFilter)) :  keyStore;
+            this.trackingKeyStore = ModifyTrackingKeyStore.modifyTrackingKeyStore(intermediate);
+            this.unmodifiableKeyStore = UnmodifiableKeyStore.unmodifiableKeyStore(intermediate);
+        } catch (Exception e) {
+            throw LOGGER.unableToStartService(e);
+        }
+    }
+
+    private Provider resolveProvider() throws StartException {
+        Provider[] candidates = providers.getOptionalValue();
+        Supplier<Provider[]> providersSupplier = () -> candidates == null ? Security.getProviders() : candidates;
+        Provider identified = findProvider(providersSupplier, provider, KeyStore.class, type);
+        if (identified == null) {
+            throw LOGGER.noSuitableProvider(type);
+        }
+        return identified;
+    }
+
+    private AtomicLoadKeyStore.LoadKey load(AtomicLoadKeyStore keyStore) throws Exception {
+        try (InputStream is = resolvedPath != null ? new FileInputStream(resolvedPath) : null) {
+            AtomicLoadKeyStore.LoadKey loadKey = keyStore.revertibleLoad(is, resolvePassword());
+            checkCertificatesValidity(keyStore);
+            return loadKey;
+        }
+    }
+
+    private void checkCertificatesValidity(KeyStore keyStore) throws KeyStoreException {
+        if (LOGGER.isEnabled(Logger.Level.WARN)) {
+            Enumeration<String> aliases = keyStore.aliases();
+            while (aliases.hasMoreElements()) {
+                String alias = aliases.nextElement();
+                Certificate certificate = keyStore.getCertificate(alias);
+                if (certificate != null && certificate instanceof X509Certificate) {
+                    try {
+                        ((X509Certificate) certificate).checkValidity();
+                    } catch (CertificateExpiredException | CertificateNotYetValidException e) {
+                        LOGGER.certificateNotValid(alias, e);
+                    }
+                }
+            }
+        }
+    }
+
+    @Override
+    public void stop(StopContext stopContext) {
+        LOGGER.tracef(
+                "stopping:  keyStore = %s  unmodifiableKeyStore = %s  trackingKeyStore = %s  pathResolver = %s",
+                keyStore, unmodifiableKeyStore, trackingKeyStore, pathResolver
+        );
+        keyStore = null;
+        unmodifiableKeyStore = null;
+        trackingKeyStore = null;
+        if (pathResolver != null) {
+            pathResolver.clear();
+            pathResolver = null;
+        }
+    }
+
+    @Override
+    public KeyStore getValue() throws IllegalStateException, IllegalArgumentException {
+        return unmodifiableKeyStore;
+    }
+
+    public KeyStore getModifiableValue() {
+        return trackingKeyStore;
+    }
+
+    Injector<PathManager> getPathManagerInjector() {
+        return pathManager;
+    }
+
+    Injector<Provider[]> getProvidersInjector() {
+        return providers;
+    }
+
+    Injector<ExceptionSupplier<CredentialSource, Exception>> getCredentialSourceSupplierInjector() {
+        return credentialSourceSupplier;
+    }
+
+    String getResolvedAbsolutePath() {
+        return resolvedPath != null ? resolvedPath.getAbsolutePath() : null;
+    }
+
+    /*
+     * OperationStepHandler Access Methods
+     */
+
+    long timeSynched() {
+        return synched;
+    }
+
+    LoadKey load() throws OperationFailedException {
+        try {
+            LOGGER.tracef("reloading KeyStore from file [%s]", resolvedPath);
+            AtomicLoadKeyStore.LoadKey loadKey = load(keyStore);
+            long originalSynced = synched;
+            synched = System.currentTimeMillis();
+            boolean originalModified = trackingKeyStore.isModified();
+            trackingKeyStore.setModified(false);
+            return new LoadKey(loadKey, originalSynced, originalModified);
+        } catch (Exception e) {
+            throw LOGGER.unableToCompleteOperation(e, e.getLocalizedMessage());
+        }
+    }
+
+    void revertLoad(final LoadKey loadKey) {
+        LOGGER.trace("reverting load of KeyStore");
+        keyStore.revert(loadKey.loadKey);
+        synched = loadKey.modifiedTime;
+        trackingKeyStore.setModified(loadKey.modified);
+    }
+
+    void save() throws OperationFailedException {
+        if (resolvedPath == null) {
+            throw LOGGER.cantSaveWithoutFile(path);
+        }
+        LOGGER.tracef("saving KeyStore to the file [%s]", resolvedPath);
+        try (FileOutputStream fos = new FileOutputStream(resolvedPath)) {
+            keyStore.store(fos, resolvePassword());
+            synched = System.currentTimeMillis();
+            trackingKeyStore.setModified(false);
+        } catch (Exception e) {
+            throw LOGGER.unableToCompleteOperation(e, e.getLocalizedMessage());
+        }
+    }
+
+    boolean isModified() {
+        return trackingKeyStore.isModified();
+    }
+
+    char[] resolveKeyPassword(final ExceptionSupplier<CredentialSource, Exception> keyPasswordCredentialSourceSupplier) throws Exception {
+        if (keyPasswordCredentialSourceSupplier == null) {
+            // use the key-store password if no key password is provided
+            return resolvePassword();
+        }
+        CredentialSource cs = keyPasswordCredentialSourceSupplier.get();
+        String path = resolvedPath != null ? resolvedPath.getPath() : "null";
+        if (cs == null) throw LOGGER.keyPasswordCannotBeResolved(path);
+        PasswordCredential credential = cs.getCredential(PasswordCredential.class);
+        if (credential == null) throw LOGGER.keyPasswordCannotBeResolved(path);
+        ClearPassword password = credential.getPassword(ClearPassword.class);
+        if (password == null) throw LOGGER.keyPasswordCannotBeResolved(path);
+        return password.getPassword();
+    }
+
+    private char[] resolvePassword() throws Exception {
+        ExceptionSupplier<CredentialSource, Exception> sourceSupplier = credentialSourceSupplier.getValue();
+        CredentialSource cs = sourceSupplier != null ? sourceSupplier.get() : null;
+        String path = resolvedPath != null ? resolvedPath.getPath() : "null";
+        if (cs == null) throw LOGGER.keyStorePasswordCannotBeResolved(path);
+        PasswordCredential credential = cs.getCredential(PasswordCredential.class);
+        if (credential == null) throw LOGGER.keyStorePasswordCannotBeResolved(path);
+        ClearPassword password = credential.getPassword(ClearPassword.class);
+        if (password == null) throw LOGGER.keyStorePasswordCannotBeResolved(path);
+
+        return password.getPassword();
+    }
+
+    File getResolvedPath(PathResolver pathResolver, String path, String relativeTo) {
+        pathResolver.path(path);
+        if (relativeTo != null) {
+            pathResolver.relativeTo(relativeTo, pathManager.getValue());
+        }
+        return pathResolver.resolve();
+    }
+
+    void generateAndSaveSelfSignedCertificate(String host, char[] password) {
+        try {
+            if (shouldAutoGenerateSelfSignedCertificate(host)) {
+                // generate certificate
+                Date from = new Date();
+                Date to = new Date(from.getTime() + (1000L * 60L * 60L * 24L * 365L * 10L));
+                SelfSignedX509CertificateAndSigningKey selfSignedCertificateAndSigningKey = SelfSignedX509CertificateAndSigningKey.builder()
+                        .setDn(new X500Principal(COMMON_NAME_PREFIX + host))
+                        .setNotValidAfter(ZonedDateTime.ofInstant(Instant.ofEpochMilli(to.getTime()), TimeZone.getDefault().toZoneId()))
+                        .setNotValidBefore(ZonedDateTime.ofInstant(Instant.ofEpochMilli(from.getTime()), TimeZone.getDefault().toZoneId()))
+                        .setKeyAlgorithmName(GENERATED_CERTIFICATE_KEY_ALGORITHM)
+                        .setKeySize(GENERATED_CERTIFICATE_KEY_SIZE)
+                        .setSignatureAlgorithmName(GENERATED_CERTIFICATE_SIGNATURE_ALGORITHM)
+                        .build();
+                X509Certificate selfSignedCertificate = selfSignedCertificateAndSigningKey.getSelfSignedCertificate();
+                keyStore.setKeyEntry(GENERATED_CERTIFICATE_ALIAS, selfSignedCertificateAndSigningKey.getSigningKey(), password == null ? resolvePassword() : password,
+                        new X509Certificate[]{selfSignedCertificate});
+                LOGGER.selfSignedCertificateHasBeenCreated(resolvedPath.getAbsolutePath(), getShaFingerprint(selfSignedCertificate, "SHA-1"), getShaFingerprint(selfSignedCertificate, "SHA-256"));
+                save();
+            }
+        } catch (Exception e) {
+            throw LOGGER.failedToStoreGeneratedSelfSignedCertificate(e);
+        }
+    }
+
+    boolean shouldAutoGenerateSelfSignedCertificate(String host) {
+        return host != null && resolvedPath != null && ! resolvedPath.exists();
+    }
+
+    private static String getShaFingerprint(X509Certificate certificate, String algorithm) throws Exception {
+        MessageDigest md = MessageDigest.getInstance(algorithm);
+        md.update(certificate.getEncoded());
+        byte[] digest = md.digest();
+        return ByteIterator.ofBytes(digest).hexEncode().drainToString(HEX_DELIMITER, 2);
+    }
+
+    static class LoadKey {
+        private final AtomicLoadKeyStore.LoadKey loadKey;
+        private final long modifiedTime;
+        private final boolean modified;
+
+        LoadKey(AtomicLoadKeyStore.LoadKey loadKey, long modifiedTime, boolean modified) {
+            this.loadKey = loadKey;
+            this.modifiedTime = modifiedTime;
+            this.modified = modified;
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ManagerParsers.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ManagerParsers.java
new file mode 100644
index 0000000..163f96c
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ManagerParsers.java
@@ -0,0 +1,57 @@
+ /*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.KEY_MANAGER;
+import static org.wildfly.extension.elytron.tls.Constants.KEY_MANAGERS;
+import static org.wildfly.extension.elytron.tls.Constants.TRUST_MANAGER;
+import static org.wildfly.extension.elytron.tls.Constants.TRUST_MANAGERS;
+
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+import org.jboss.as.controller.security.CredentialReference;
+
+class ManagerParsers {
+
+    final PersistentResourceXMLDescription keyManagerParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(KEY_MANAGER))
+            .setXmlWrapperElement(KEY_MANAGERS)
+            .addAttribute(SSLContextDefinitions.ALGORITHM)
+            .addAttribute(SSLContextDefinitions.KEY_STORE)
+        //     .addAttribute(SSLContextDefinitions.KEY_STORE_OBJECT)
+            .addAttribute(SSLContextDefinitions.ALIAS_FILTER)
+            .addAttribute(SSLContextDefinitions.PROVIDERS)
+            .addAttribute(SSLContextDefinitions.PROVIDER_NAME)
+            .addAttribute(CredentialReference.getAttributeDefinition())
+            .addAttribute(SSLContextDefinitions.GENERATE_SELF_SIGNED_CERTIFICATE_HOST) // new
+            .build();
+
+    final PersistentResourceXMLDescription trustManagerParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(TRUST_MANAGER))
+            .setXmlWrapperElement(TRUST_MANAGERS)
+            .addAttribute(SSLContextDefinitions.ALGORITHM)
+            .addAttribute(SSLContextDefinitions.KEY_STORE)
+        //     .addAttribute(SSLContextDefinitions.KEY_STORE_OBJECT)
+            .addAttribute(SSLContextDefinitions.ALIAS_FILTER)
+            .addAttribute(SSLContextDefinitions.PROVIDERS)
+            .addAttribute(SSLContextDefinitions.PROVIDER_NAME)
+            .addAttribute(SSLContextDefinitions.CERTIFICATE_REVOCATION_LIST)
+            .addAttribute(SSLContextDefinitions.OCSP)
+            .addAttribute(SSLContextDefinitions.ONLY_LEAF_CERT)
+            .addAttribute(SSLContextDefinitions.SOFT_FAIL)
+            .addAttribute(SSLContextDefinitions.MAXIMUM_CERT_PATH)
+            .addAttribute(SSLContextDefinitions.CERTIFICATE_REVOCATION_LISTS)
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ModifiableKeyStoreDecorator.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ModifiableKeyStoreDecorator.java
new file mode 100644
index 0000000..a67ec39
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ModifiableKeyStoreDecorator.java
@@ -0,0 +1,286 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.CertificateChainAttributeDefinitions.writeCertificate;
+import static org.wildfly.extension.elytron.tls.CertificateChainAttributeDefinitions.writeCertificates;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.ISO_8601_FORMAT;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.getRequiredService;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Enumeration;
+
+import org.jboss.as.controller.DelegatingResourceDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.ResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+import org.wildfly.common.Assert;
+import org.wildfly.security.keystore.PasswordEntry;
+
+/**
+ * A {@link DelegatingResourceDefinition} that decorates a {@link KeyStore} resource
+ * with alias manipulation operations definitions.
+ *
+ * @author <a href="mailto:jkalina@redhat.com">Jan Kalina</a>
+ */
+class ModifiableKeyStoreDecorator extends DelegatingResourceDefinition {
+
+    static ResourceDefinition wrap(ResourceDefinition resourceDefinition) {
+        return new ModifiableKeyStoreDecorator(resourceDefinition);
+    }
+
+    ModifiableKeyStoreDecorator(ResourceDefinition resourceDefinition) {
+        setDelegate(resourceDefinition);
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration);
+        ResourceDescriptionResolver resolver = ElytronTlsExtension.getResourceDescriptionResolver(Constants.MODIFIABLE_KEY_STORE);
+        ReadAliasesHandler.register(resourceRegistration, resolver);
+        ReadAliasHandler.register(resourceRegistration, resolver);
+
+        if (isServerOrHostController(resourceRegistration)) { // server-only operations
+            RemoveAliasHandler.register(resourceRegistration, resolver);
+        }
+    }
+
+    static class ReadAliasesHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition RECURSIVE = new SimpleAttributeDefinitionBuilder(Constants.RECURSIVE, ModelType.BOOLEAN, true)
+                .setAllowExpression(false)
+                .setDefaultValue(ModelNode.FALSE)
+                .build();
+
+        static final SimpleAttributeDefinition VERBOSE = new SimpleAttributeDefinitionBuilder(Constants.VERBOSE, ModelType.BOOLEAN, true)
+                .setAllowExpression(false)
+                .setDefaultValue(ModelNode.TRUE)
+                .setRequires(RECURSIVE.getName())
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            SimpleOperationDefinition READ_ALIASES = new SimpleOperationDefinitionBuilder(Constants.READ_ALIASES, descriptionResolver)
+                    .setParameters(RECURSIVE,VERBOSE)
+                    .setReadOnly()
+                    .setRuntimeOnly()
+                    .build();
+            resourceRegistration.registerOperationHandler(READ_ALIASES, new ReadAliasesHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            final KeyStore keyStore = getKeyStore(context);
+
+            try {
+                final ModelNode result = context.getResult();
+                final Enumeration<String> aliases = keyStore.aliases();
+                final boolean verbose = VERBOSE.resolveModelAttribute(context, operation).asBoolean();
+                final boolean recursive = RECURSIVE.resolveModelAttribute(context, operation).asBoolean();
+                ModelNode aliasNode = null;
+                String alias = null;
+                while (aliases.hasMoreElements()) {
+                    alias = aliases.nextElement();
+                    if(recursive) {
+                        aliasNode = result.get(alias);
+                        ReadAliasHandler.readAlias(keyStore, alias, verbose, aliasNode);
+                    } else {
+                        result.add(alias);
+                    }
+                }
+            } catch (KeyStoreException | NoSuchAlgorithmException | CertificateEncodingException e) {
+                throw new OperationFailedException(e);
+            }
+        }
+    }
+
+    static class ReadAliasHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition ALIAS = new SimpleAttributeDefinitionBuilder(Constants.ALIAS, ModelType.STRING, false)
+                .setAllowExpression(false)
+                .build();
+
+        static final SimpleAttributeDefinition VERBOSE = new SimpleAttributeDefinitionBuilder(Constants.VERBOSE, ModelType.BOOLEAN, true)
+                .setAllowExpression(false)
+                .setDefaultValue(ModelNode.TRUE)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            SimpleOperationDefinition READ_ALIAS = new SimpleOperationDefinitionBuilder(Constants.READ_ALIAS, descriptionResolver)
+                    .setParameters(ALIAS, VERBOSE)
+                    .setReadOnly()
+                    .setRuntimeOnly()
+                    .build();
+            resourceRegistration.registerOperationHandler(READ_ALIAS, new ReadAliasHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            final String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            final boolean verbose = VERBOSE.resolveModelAttribute(context, operation).asBoolean();
+            KeyStore keyStore = getKeyStore(context);
+
+            try {
+                ModelNode result = context.getResult();
+                readAlias(keyStore,alias,verbose,result);
+            } catch (KeyStoreException | NoSuchAlgorithmException | CertificateEncodingException e) {
+                throw new OperationFailedException(e);
+            }
+        }
+
+        private static String getEntryType(KeyStore keyStore, String alias) throws KeyStoreException {
+            if (keyStore.entryInstanceOf(alias, KeyStore.PrivateKeyEntry.class)) {
+                return KeyStore.PrivateKeyEntry.class.getSimpleName();
+            } else if (keyStore.entryInstanceOf(alias, KeyStore.SecretKeyEntry.class)) {
+                return KeyStore.SecretKeyEntry.class.getSimpleName();
+            } else if (keyStore.entryInstanceOf(alias, KeyStore.TrustedCertificateEntry.class)) {
+                return KeyStore.TrustedCertificateEntry.class.getSimpleName();
+            } else if (keyStore.entryInstanceOf(alias, PasswordEntry.class)) {
+                return PasswordEntry.class.getSimpleName();
+            } else {
+                return "Other";
+            }
+        }
+
+        private static void readAlias(final KeyStore keyStore, final String alias, final boolean verbose,
+                final ModelNode result) throws KeyStoreException, NoSuchAlgorithmException, CertificateEncodingException {
+            if (!keyStore.containsAlias(alias)) {
+                LOGGER.tracef("Alias [%s] does not exists in KeyStore");
+                return;
+            }
+
+            result.get(Constants.ALIAS).set(alias);
+            result.get(Constants.ENTRY_TYPE).set(getEntryType(keyStore, alias));
+
+            Date creationDate = keyStore.getCreationDate(alias);
+            if (creationDate != null) {
+                SimpleDateFormat sdf = new SimpleDateFormat(ISO_8601_FORMAT);
+                result.get(Constants.CREATION_DATE).set(sdf.format(creationDate));
+            }
+
+            Certificate[] chain = keyStore.getCertificateChain(alias);
+            if (chain == null) {
+                Certificate cert = keyStore.getCertificate(alias);
+                if (cert != null) {
+                    writeCertificate(result.get(Constants.CERTIFICATE), cert, verbose);
+                }
+            } else {
+                writeCertificates(result.get(Constants.CERTIFICATE_CHAIN), chain, verbose);
+            }
+        }
+    }
+
+    static class RemoveAliasHandler extends ElytronRuntimeOnlyHandler {
+
+        static final SimpleAttributeDefinition ALIAS = new SimpleAttributeDefinitionBuilder(Constants.ALIAS, ModelType.STRING, false)
+                .setAllowExpression(false)
+                .build();
+
+        static void register(ManagementResourceRegistration resourceRegistration, ResourceDescriptionResolver descriptionResolver) {
+            resourceRegistration.registerOperationHandler(new SimpleOperationDefinitionBuilder(Constants.REMOVE_ALIAS, descriptionResolver)
+                        .setParameters(ALIAS)
+                        .setRuntimeOnly()
+                        .build()
+                    , new RemoveAliasHandler());
+        }
+
+        @Override
+        protected void executeRuntimeStep(final OperationContext context, final ModelNode operation) throws OperationFailedException {
+            String alias = ALIAS.resolveModelAttribute(context, operation).asString();
+            KeyStore keyStore = getModifiableKeyStore(context);
+
+            try {
+                keyStore.deleteEntry(alias);
+            } catch (KeyStoreException e) {
+                throw new OperationFailedException(e);
+            }
+        }
+    }
+
+    /**
+     * Try to obtain a {@link KeyStore} based on the given {@link OperationContext}.
+     *
+     * @param context the current context
+     * @return the unmodifiable KeyStore
+     * @throws OperationFailedException if any error occurs while obtaining.
+     */
+    static KeyStore getKeyStore(OperationContext context) throws OperationFailedException {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+        PathAddress currentAddress = context.getCurrentAddress();
+        RuntimeCapability<Void> runtimeCapability = KEY_STORE_RUNTIME_CAPABILITY.fromBaseCapability(currentAddress.getLastElement().getValue());
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+        ServiceController<KeyStore> serviceController = getRequiredService(serviceRegistry, serviceName, KeyStore.class);
+
+        return Assert.assertNotNull(serviceController.getValue());
+    }
+
+    /**
+     * Try to obtain a modifiable {@link KeyStore} based on the given {@link OperationContext}.
+     *
+     * @param context the current context
+     * @return the modifiable KeyStore
+     * @throws OperationFailedException if any error occurs while obtaining.
+     */
+    static KeyStore getModifiableKeyStore(OperationContext context) throws OperationFailedException {
+        return getModifiableKeyStoreService(context).getModifiableValue();
+    }
+
+    /**
+     * Try to obtain a modifiable {@link KeyStoreService} based on the given {@link OperationContext}.
+     *
+     * @param context the current context
+     * @return the modifiable KeyStore service
+     * @throws OperationFailedException if an error occurs while attempting to obtain the modifiable KeyStore service
+     */
+    static ModifiableKeyStoreService getModifiableKeyStoreService(OperationContext context) throws OperationFailedException {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+        PathAddress currentAddress = context.getCurrentAddress();
+        RuntimeCapability<Void> runtimeCapability = KEY_STORE_RUNTIME_CAPABILITY.fromBaseCapability(currentAddress.getLastElement().getValue());
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+
+        ServiceController<KeyStore> serviceContainer = getRequiredService(serviceRegistry, serviceName, KeyStore.class);
+        ServiceController.State serviceState = serviceContainer.getState();
+        if (serviceState != ServiceController.State.UP) {
+            throw LOGGER.requiredServiceNotUp(serviceName, serviceState);
+        }
+
+        return (ModifiableKeyStoreService) serviceContainer.getService();
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ModifiableKeyStoreService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ModifiableKeyStoreService.java
new file mode 100644
index 0000000..8e9fef8
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ModifiableKeyStoreService.java
@@ -0,0 +1,34 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2016 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.security.KeyStore;
+
+import org.jboss.msc.service.Service;
+
+/**
+ * An interface for KeyStore services, which provide modifiable KeyStore.
+ *
+ * @author <a href="mailto:jkalina@redhat.com">Jan Kalina</a>
+ */
+interface ModifiableKeyStoreService extends Service<KeyStore> {
+
+    KeyStore getModifiableValue();
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderAttributeDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderAttributeDefinition.java
new file mode 100644
index 0000000..ed69d8f
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderAttributeDefinition.java
@@ -0,0 +1,214 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.ClassLoadingAttributeDefinitions.CLASS_NAMES;
+import static org.wildfly.extension.elytron.tls.ClassLoadingAttributeDefinitions.MODULE;
+
+import java.security.Provider;
+import java.security.Provider.Service;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.ObjectListAttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+
+/**
+ * Class to contain the attribute definition for the runtime representation of a security provider.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class ProviderAttributeDefinition {
+
+    private static final SimpleAttributeDefinition NAME = new SimpleAttributeDefinitionBuilder(Constants.NAME, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition INFO = new SimpleAttributeDefinitionBuilder(Constants.INFO, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition VERSION = new SimpleAttributeDefinitionBuilder(Constants.VERSION, ModelType.DOUBLE).build();
+
+    static final ObjectTypeAttributeDefinition LOADED_PROVIDER = new ObjectTypeAttributeDefinition.Builder(Constants.LOADED_PROVIDER, NAME, INFO, VERSION)
+        .setStorageRuntime()
+        .setRequired(false)
+        .build();
+
+    /*
+     * Service Attributes and Full Definition.
+     */
+
+    private static final SimpleAttributeDefinition TYPE = new SimpleAttributeDefinitionBuilder(Constants.TYPE, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.ALGORITHM, ModelType.STRING).build();
+
+    private static final SimpleAttributeDefinition CLASS_NAME = new SimpleAttributeDefinitionBuilder(Constants.CLASS_NAME, ModelType.STRING)
+        .setAllowExpression(false)
+        .build();
+
+    private static final ObjectTypeAttributeDefinition SERVICE = new ObjectTypeAttributeDefinition.Builder(Constants.SERVICE, TYPE, ALGORITHM, CLASS_NAME)
+        .setRequired(true)
+        .build();
+
+    private static final ObjectListAttributeDefinition SERVICES = new ObjectListAttributeDefinition.Builder(Constants.SERVICES, SERVICE)
+        .build();
+
+    private static final ObjectTypeAttributeDefinition FULL_PROVIDER = new ObjectTypeAttributeDefinition.Builder(Constants.PROVIDER, NAME, INFO, VERSION, SERVICES)
+        .setRequired(false)
+        .build();
+
+    static final ObjectListAttributeDefinition LOADED_PROVIDERS = new ObjectListAttributeDefinition.Builder(Constants.LOADED_PROVIDERS, FULL_PROVIDER)
+        .setStorageRuntime()
+        .setRequired(false)
+        .build();
+
+    /*
+     *  Provider Configuration Attributes
+     */
+
+    private static final SimpleAttributeDefinition INDEX = new SimpleAttributeDefinitionBuilder(Constants.INDEX, ModelType.INT)
+        .build();
+
+    private static final SimpleAttributeDefinition LOAD_SERVICES = new SimpleAttributeDefinitionBuilder(Constants.LOAD_SERVICES, ModelType.BOOLEAN)
+        .setAttributeGroup(Constants.CLASS_LOADING)
+        .setAllowExpression(true)
+        .setRequired(false)
+        .setDefaultValue(ModelNode.FALSE)
+        .build();
+
+    private static final SimpleAttributeDefinition PROPERTY_NAME = new SimpleAttributeDefinitionBuilder(Constants.NAME, ModelType.STRING, false)
+        .setAllowExpression(true)
+        .setMinSize(1)
+        .build();
+
+    private static final SimpleAttributeDefinition VALUE = new SimpleAttributeDefinitionBuilder(Constants.VALUE, ModelType.STRING, false)
+        .setAllowExpression(true)
+        .setMinSize(1)
+        .build();
+
+    private static final AttributeDefinition[] PROPERTY_ATTRIBUTES = { PROPERTY_NAME, VALUE };
+
+    private static final ObjectTypeAttributeDefinition PROPERTY = new ObjectTypeAttributeDefinition.Builder(Constants.PROPERTY, PROPERTY_ATTRIBUTES)
+        .build();
+
+    private static final AttributeDefinition[] INDEXED_PROPERTY_ATTRIBUTES = combine(INDEX, PROPERTY_ATTRIBUTES);
+
+    private static final ObjectTypeAttributeDefinition INDEXED_PROPERTY = new ObjectTypeAttributeDefinition.Builder(Constants.PROPERTY, INDEXED_PROPERTY_ATTRIBUTES)
+        .build();
+
+    private static final ObjectListAttributeDefinition PROPERTY_LIST = new ObjectListAttributeDefinition.Builder(Constants.PROPERTY_LIST, PROPERTY)
+        .setAttributeGroup(Constants.CONFIGURATION)
+        .setAlternatives(Constants.PATH)
+        .setAllowDuplicates(true)
+        .setRequired(false)
+        .build();
+
+    private static final ObjectListAttributeDefinition INDEXED_PROPERTY_LIST = new ObjectListAttributeDefinition.Builder(Constants.PROPERTY_LIST, INDEXED_PROPERTY)
+        .setAttributeGroup(Constants.CONFIGURATION)
+        .setAlternatives(Constants.PATH)
+        .setAllowDuplicates(true)
+        .setRequired(false)
+        .build();
+
+    private static final SimpleAttributeDefinition PATH = new SimpleAttributeDefinitionBuilder(Constants.PATH, FileAttributeDefinitions.PATH)
+        .setAttributeGroup(Constants.CONFIGURATION)
+        .setAlternatives(Constants.PROPERTY_LIST)
+        .build();
+
+    private static final SimpleAttributeDefinition RELATIVE_TO = new SimpleAttributeDefinitionBuilder(Constants.RELATIVE_TO, FileAttributeDefinitions.RELATIVE_TO)
+        .setAttributeGroup(Constants.CONFIGURATION)
+        .build();
+
+    private static final AttributeDefinition[] PROVIDER_ATTRIBUTES = { MODULE, LOAD_SERVICES, CLASS_NAMES, PATH, RELATIVE_TO };
+
+    private static final ObjectTypeAttributeDefinition PROVIDER = new ObjectTypeAttributeDefinition.Builder(Constants.PROVIDER, combine(null, PROVIDER_ATTRIBUTES, PROPERTY_LIST))
+        .build();
+
+    private static final ObjectTypeAttributeDefinition INDEXED_PROVIDER = new ObjectTypeAttributeDefinition.Builder(Constants.PROVIDER, combine(INDEX, PROVIDER_ATTRIBUTES, INDEXED_PROPERTY_LIST))
+        .build();
+
+    static final ObjectListAttributeDefinition PROVIDERS = new ObjectListAttributeDefinition.Builder(Constants.PROVIDERS, PROVIDER)
+        .setRequired(false)
+        .build();
+
+    static final ObjectListAttributeDefinition INDEXED_PROVIDERS = new ObjectListAttributeDefinition.Builder(Constants.PROVIDERS, INDEXED_PROVIDER)
+        .setRequired(false)
+        .build();
+
+
+    private ProviderAttributeDefinition() {
+    }
+
+    /**
+     * Populate the supplied response {@link ModelNode} with information about the supplied {@link Provider}
+     *
+     * @param response the response to populate.
+     * @param provider the {@link Provider} to use when populating the response.
+     */
+    static void populateProvider(final ModelNode response, final Provider provider, final boolean includeServices) {
+        response.get(Constants.NAME).set(provider.getName());
+        response.get(Constants.INFO).set(provider.getInfo());
+        response.get(Constants.VERSION).set(provider.getVersion());
+
+        if (includeServices) {
+            addServices(response, provider);
+        }
+    }
+
+    /**
+     * Populate the supplied response {@link ModelNode} with information about each {@link Provider} in the included array.
+     *
+     * @param response the response to populate.
+     * @param providers the array or {@link Provider} instances to use to populate the response.
+     */
+    static void populateProviders(final ModelNode response, final Provider[] providers) {
+        for (Provider current : providers) {
+            ModelNode providerModel = new ModelNode();
+            populateProvider(providerModel, current, true);
+            response.add(providerModel);
+        }
+    }
+
+    private static void addServices(final ModelNode providerModel, final Provider provider) {
+        ModelNode servicesModel = providerModel.get(Constants.SERVICES);
+
+        for (Service current : provider.getServices()) {
+            ModelNode serviceModel = new ModelNode();
+            serviceModel.get(Constants.TYPE).set(current.getType());
+            serviceModel.get(Constants.ALGORITHM).set(current.getAlgorithm());
+            serviceModel.get(Constants.CLASS_NAME).set(current.getClassName());
+
+            servicesModel.add(serviceModel);
+        }
+
+    }
+
+    private static AttributeDefinition[] combine(AttributeDefinition first, AttributeDefinition[] remaining, AttributeDefinition... more) {
+        AttributeDefinition[] response = new AttributeDefinition[(first == null ? 0 : 1) + remaining.length + more.length];
+        int pos = 0;
+        if (first != null) {
+            response[pos++] = first;
+        }
+        System.arraycopy(remaining, 0, response, pos, remaining.length);
+        pos += remaining.length;
+        System.arraycopy(more, 0, response, pos, more.length);
+        return response;
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderDefinitions.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderDefinitions.java
new file mode 100644
index 0000000..9345598
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderDefinitions.java
@@ -0,0 +1,387 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_API_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ClassLoadingAttributeDefinitions.CLASS_NAMES;
+import static org.wildfly.extension.elytron.tls.ClassLoadingAttributeDefinitions.MODULE;
+import static org.wildfly.extension.elytron.tls.ClassLoadingAttributeDefinitions.resolveClassLoader;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathName;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathResolver;
+import static org.wildfly.extension.elytron.tls.ProviderAttributeDefinition.LOADED_PROVIDERS;
+import static org.wildfly.extension.elytron.tls.ProviderAttributeDefinition.populateProviders;
+import static org.wildfly.extension.elytron.tls.SecurityActions.doPrivileged;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.security.Provider;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Properties;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.CapabilityServiceBuilder;
+import org.jboss.as.controller.ListAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleMapAttributeDefinition;
+import org.jboss.as.controller.services.path.PathManagerService;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.modules.Module;
+import org.jboss.modules.ModuleClassLoader;
+import org.jboss.msc.service.StartException;
+import org.wildfly.common.function.ExceptionConsumer;
+import org.wildfly.common.function.ExceptionFunction;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PathResolver;
+import org.wildfly.extension.elytron.tls.TrivialResourceDefinition.Builder;
+
+
+/**
+ * Resource definition(s) for resources satisfying the Provider[] capability.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class ProviderDefinitions {
+
+    static final SimpleAttributeDefinition PATH = new SimpleAttributeDefinitionBuilder(Constants.PATH, FileAttributeDefinitions.PATH)
+            .setAttributeGroup(Constants.CONFIGURATION)
+            .setAlternatives(Constants.CONFIGURATION)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition RELATIVE_TO = new SimpleAttributeDefinitionBuilder(Constants.RELATIVE_TO, FileAttributeDefinitions.RELATIVE_TO)
+            .setAttributeGroup(Constants.CONFIGURATION)
+            .setRequires(Constants.PATH)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleMapAttributeDefinition CONFIGURATION = new SimpleMapAttributeDefinition.Builder(Constants.CONFIGURATION, ModelType.STRING, true)
+            .setAttributeGroup(Constants.CONFIGURATION)
+            .setAllowExpression(true)
+            .setAlternatives(Constants.PATH, Constants.ARGUMENT)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition ARGUMENT = new SimpleAttributeDefinitionBuilder(Constants.ARGUMENT, ModelType.STRING, true)
+            .setAttributeGroup(Constants.CONFIGURATION)
+            .setRequires(Constants.CLASS_NAMES)
+            .setAlternatives(Constants.PATH, Constants.CONFIGURATION)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    private static final AggregateComponentDefinition<Provider[]> AGGREGATE_PROVIDERS = AggregateComponentDefinition.create(Provider[].class,
+            Constants.AGGREGATE_PROVIDERS, Constants.PROVIDERS, PROVIDERS_RUNTIME_CAPABILITY, PROVIDERS_API_CAPABILITY, ProviderDefinitions::aggregate, false);
+
+    static final ListAttributeDefinition REFERENCES = AGGREGATE_PROVIDERS.getReferencesAttribute();
+
+    static AggregateComponentDefinition<Provider[]> getAggregateProvidersDefinition() {
+        return AGGREGATE_PROVIDERS;
+    }
+
+    static ResourceDefinition getProviderLoaderDefinition(boolean serverOrHostController) {
+        AttributeDefinition[] attributes = new AttributeDefinition[] { MODULE, CLASS_NAMES, PATH, RELATIVE_TO, ARGUMENT, CONFIGURATION };
+
+        AbstractAddStepHandler add = new DoohickeyAddHandler<Provider[]>(PROVIDERS_RUNTIME_CAPABILITY, attributes, PROVIDERS_API_CAPABILITY) {
+
+            @Override
+            protected ElytronDoohickey<Provider[]> createDoohickey(PathAddress resourceAddress) {
+                return new ElytronDoohickey<Provider[]>(resourceAddress) {
+
+                    private volatile String module;
+                    private volatile String[] classNames;
+                    private volatile String path;
+                    private volatile String relativeTo;
+                    private volatile String argument;
+                    private volatile Properties properties;
+
+                    @Override
+                    protected void resolveRuntime(ModelNode model, OperationContext context) throws OperationFailedException {
+                        module = MODULE.resolveModelAttribute(context, model).asStringOrNull();
+                        ModelNode classNamesNode = CLASS_NAMES.resolveModelAttribute(context, model);
+                        if (classNamesNode.isDefined()) {
+                            List<ModelNode> values = classNamesNode.asList();
+                            classNames = new String[values.size()];
+                            for (int i = 0; i < classNames.length; i++) {
+                                classNames[i] = values.get(i).asString();
+                            }
+                        } else {
+                            classNames = null;
+                        }
+                        path = PATH.resolveModelAttribute(context, model).asStringOrNull();
+                        relativeTo = RELATIVE_TO.resolveModelAttribute(context, model).asStringOrNull();
+                        argument = ARGUMENT.resolveModelAttribute(context, model).asStringOrNull();
+                        ModelNode configuration = CONFIGURATION.resolveModelAttribute(context, model);
+                        if (configuration.isDefined()) {
+                            properties = new Properties();
+                            for (String s : configuration.keys()) {
+                                properties.setProperty(s, configuration.require(s).asString());
+                            }
+                        } else {
+                            properties = null;
+                        }
+                    }
+
+                    @Override
+                    protected ExceptionSupplier<Provider[], StartException> prepareServiceSupplier(OperationContext context,
+                            CapabilityServiceBuilder<?> serviceBuilder) throws OperationFailedException {
+                        final Supplier<PathManagerService> pathManager;
+                        if (properties == null && relativeTo != null) {
+                            pathManager = serviceBuilder.requires(PathManagerService.SERVICE_NAME);
+                            serviceBuilder.requires(pathName(relativeTo));
+                        } else {
+                            pathManager = null;
+                        }
+
+                        return new ExceptionSupplier<Provider[], StartException>() {
+
+                            @Override
+                            public Provider[] get() throws StartException {
+                                File resolved = null;
+                                if (properties == null && relativeTo != null) {
+                                    PathResolver pathResolver = pathResolver();
+                                    pathResolver.path(path);
+                                    if (relativeTo != null) {
+                                        pathResolver.relativeTo(relativeTo, pathManager.get());
+                                    }
+                                    resolved = pathResolver.resolve();
+                                    pathResolver.clear();
+                                }
+
+                                return loadProviders(resolved);
+                            }
+                        };
+                    }
+
+                    @Override
+                    protected Provider[] createImmediately(OperationContext foreignContext) throws OperationFailedException {
+                        File resolvedPath = null;
+                        if (properties == null && path != null) {
+                            resolvedPath = resolveRelativeToImmediately(path, relativeTo, foreignContext);
+                        }
+
+                        try {
+                            return loadProviders(resolvedPath);
+                        } catch (StartException e) {
+                            throw new OperationFailedException(e);
+                        }
+                    }
+
+                    private Provider[] loadProviders(final File resolvedPath) throws StartException {
+                        final Supplier<InputStream> configSupplier;
+                        if (properties != null) {
+                            configSupplier = getConfigurationSupplier(properties);
+                        } else if (resolvedPath != null) {
+                            configSupplier = getConfigurationSupplier(resolvedPath);
+                        } else {
+                            configSupplier = null;
+                        }
+
+                        try {
+                            Collection<ExceptionConsumer<InputStream, IOException>> deferred = new ArrayList<>();
+                            ClassLoader classLoader = doPrivileged(
+                                    (PrivilegedExceptionAction<ClassLoader>) () -> resolveClassLoader(module));
+                            final List<Provider> loadedProviders;
+                            if (classNames != null) {
+                                loadedProviders = new ArrayList<>(classNames.length);
+                                for (String className : classNames) {
+                                    Class<? extends Provider> providerClazz = classLoader.loadClass(className)
+                                            .asSubclass(Provider.class);
+                                    if (argument != null) {
+                                        Constructor<? extends Provider> constructor = doPrivileged(
+                                                (PrivilegedExceptionAction<Constructor<? extends Provider>>) () -> providerClazz
+                                                        .getConstructor(String.class));
+                                        loadedProviders.add(constructor.newInstance(new Object[] { argument }));
+                                    } else if (configSupplier != null) {
+                                        // Try and find a constructor that takes an input stream and use it - or use default
+                                        // constructor and enable deferred initialisation.
+                                        try {
+                                            Constructor<? extends Provider> constructor = doPrivileged(
+                                                    (PrivilegedExceptionAction<Constructor<? extends Provider>>) () -> providerClazz
+                                                            .getConstructor(InputStream.class));
+                                            loadedProviders.add(constructor.newInstance(new Object[]{configSupplier.get()}));
+                                        } catch (NoSuchMethodException constructorDoesNotExist) {
+                                            File tempFile = null;
+                                            try {
+                                                Method configureMethod = doPrivileged((PrivilegedExceptionAction<Method>) () -> providerClazz.getMethod("configure", String.class));
+                                                Provider provider = providerClazz.newInstance();
+                                                tempFile = inputStreamToFile(configSupplier);
+                                                loadedProviders.add((Provider) configureMethod.invoke(provider, tempFile.getAbsolutePath()));
+                                            } catch (NoSuchMethodException configureMethodDoesNotExist) {
+                                                Provider provider = providerClazz.newInstance();
+                                                loadedProviders.add(provider);
+                                                deferred.add(provider::load);
+                                            } finally {
+                                                if (tempFile != null) {
+                                                    tempFile.delete();
+                                                }
+                                            }
+                                        }
+                                    } else {
+                                        loadedProviders.add(providerClazz.newInstance());
+                                    }
+                                }
+                            } else {
+                                loadedProviders = new ArrayList<>();
+                                try {
+                                    Iterable<Provider> providers = Module.findServices(Provider.class, new Predicate<Class<?>>() {
+                                        @Override
+                                        public boolean test(final Class<?> providerClass) {
+                                            // We don't want to pick up JDK services resolved via JPMS definitions.
+                                            return providerClass.getClassLoader() instanceof ModuleClassLoader;
+                                        }
+                                    }, classLoader);
+                                    Iterator<Provider> iterator = providers.iterator();
+                                    while (iterator.hasNext()) {
+                                        final Provider p = iterator.next();
+                                        if (configSupplier != null) {
+                                            deferred.add(p::load);
+                                        }
+                                        loadedProviders.add(p);
+                                    }
+                                } catch (Exception e) {
+                                    LOGGER.tracef(e, "Failed to initialize a security provider");
+                                }
+                            }
+
+                            for (ExceptionConsumer<InputStream, IOException> current : deferred) {
+                                // We know from above the deferred Collection is only populated if we do have a configSupplier.
+                                current.accept(configSupplier.get());
+                            }
+
+                            Provider[] providers = loadedProviders.toArray(new Provider[loadedProviders.size()]);
+                            if (LOGGER.isTraceEnabled()) {
+                                LOGGER.tracef("Loaded providers %s", Arrays.toString(providers));
+                            }
+                            return providers;
+                        } catch (PrivilegedActionException e) {
+                            throw new StartException(e.getCause());
+                        } catch (Exception e) {
+                            throw new StartException(e);
+                        }
+                    }
+                };
+            }
+
+            @Override
+            protected boolean dependOnProviderRegistration() {
+                return false;
+            }
+
+        };
+
+        Builder builder = TrivialResourceDefinition.builder()
+                .setPathKey(Constants.PROVIDER_LOADER)
+                .setAddHandler(add)
+                .setAttributes(attributes)
+                .setRuntimeCapabilities(PROVIDERS_RUNTIME_CAPABILITY);
+
+        if (serverOrHostController) {
+            builder.addReadOnlyAttribute(LOADED_PROVIDERS, new LoadedProvidersAttributeHandler());
+        }
+
+        return builder.build();
+    }
+
+    private static Provider[] aggregate(Provider[] ... providers) {
+        int length = 0;
+        for (Provider[] current : providers) {
+            length += current.length;
+        }
+
+        Provider[] combined = new Provider[length];
+        int startPos = 0;
+        for (Provider[] current : providers) {
+            System.arraycopy(current, 0, combined, startPos, current.length);
+            startPos += current.length;
+        }
+
+        return combined;
+    }
+
+    private static Supplier<InputStream> getConfigurationSupplier(final File location) throws StartException {
+        try {
+            byte[] configuration = Files.readAllBytes(location.toPath());
+
+            return () -> new ByteArrayInputStream(configuration);
+        } catch (IOException e) {
+            throw LOGGER.unableToStartService(e);
+        }
+    }
+
+    private static Supplier<InputStream> getConfigurationSupplier(final Properties properties) throws StartException {
+        try {
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            properties.store(baos, "");
+            final byte[] configuration = baos.toByteArray();
+
+            return () -> new ByteArrayInputStream(configuration);
+        } catch (IOException e) {
+            throw LOGGER.unableToStartService(e);
+        }
+    }
+
+    private static File inputStreamToFile(Supplier<InputStream> configSupplier) throws IOException {
+        File tempFile = new File(Files.createTempFile("temp", "cfg").toString());
+        InputStream inputStream = configSupplier.get();
+        byte[] buffer = new byte[inputStream.available()];
+        inputStream.read(buffer);
+        OutputStream outStream = new FileOutputStream(tempFile);
+        outStream.write(buffer);
+        outStream.close();
+        return tempFile;
+    }
+
+    private static class LoadedProvidersAttributeHandler extends ElytronRuntimeOnlyHandler {
+
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            final ExceptionFunction<OperationContext, Provider[], OperationFailedException> providerApi = context
+                    .getCapabilityRuntimeAPI(PROVIDERS_API_CAPABILITY, context.getCurrentAddressValue(), ExceptionFunction.class);
+
+            populateProviders(context.getResult(), providerApi.apply(context));
+        }
+
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderParser.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderParser.java
new file mode 100644
index 0000000..350b447
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderParser.java
@@ -0,0 +1,52 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2017 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.AGGREGATE_PROVIDERS;
+import static org.wildfly.extension.elytron.tls.Constants.PROVIDERS;
+import static org.wildfly.extension.elytron.tls.Constants.PROVIDER_LOADER;
+
+import org.jboss.as.controller.AttributeMarshallers;
+import org.jboss.as.controller.AttributeParsers;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+
+/**
+ * XML Parser and Marshaller for Provider configuration.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ * @author Tomaz Cerar
+ */
+class ProviderParser {
+
+    private final PersistentResourceXMLDescription providerLoaderParser = PersistentResourceXMLDescription.builder(PathElement.pathElement(PROVIDER_LOADER))
+            .setUseElementsForGroups(false)
+            .addAttributes(ClassLoadingAttributeDefinitions.MODULE, ClassLoadingAttributeDefinitions.CLASS_NAMES, ProviderDefinitions.PATH, ProviderDefinitions.RELATIVE_TO,
+                    ProviderDefinitions.ARGUMENT, ProviderDefinitions.CONFIGURATION)
+            .build();
+    private final PersistentResourceXMLDescription aggregateProviders = PersistentResourceXMLDescription.builder(PathElement.pathElement(AGGREGATE_PROVIDERS))
+            .addAttribute(ProviderDefinitions.REFERENCES,
+                    new AttributeParsers.NamedStringListParser(PROVIDERS),
+                    new AttributeMarshallers.NamedStringListMarshaller(PROVIDERS))
+            .build();
+    final PersistentResourceXMLDescription providerParser_1_0 = PersistentResourceXMLDescription.decorator(PROVIDERS)
+            .addChild(aggregateProviders)
+            .addChild(providerLoaderParser)
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderRegistrationService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderRegistrationService.java
new file mode 100644
index 0000000..f22e9c2
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ProviderRegistrationService.java
@@ -0,0 +1,118 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.Security;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+import org.jboss.msc.inject.Injector;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+import org.jboss.msc.value.InjectedValue;
+
+/**
+ * Core {@link Service} for the Elytron subsystem handling {@link Provider} registration.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class ProviderRegistrationService implements Service<Void> {
+
+    static final ServiceName SERVICE_NAME = ElytronTlsExtension.BASE_SERVICE_NAME.append(Constants.PROVIDER_REGISTRATION);
+
+    private InjectedValue<Provider[]> initialProviders = new InjectedValue<>();
+    private InjectedValue<Provider[]> finalProviders = new InjectedValue<>();
+    private final Set<String> providersToRemove;
+
+    private final Set<String> registeredProviderNames = new HashSet<>();
+
+    ProviderRegistrationService(Collection<String> providersToRemove) {
+        this.providersToRemove = new HashSet<>(providersToRemove == null ? Collections.emptySet() : providersToRemove);
+    }
+
+    @Override
+    public void start(StartContext context) throws StartException {
+        SecurityActions.doPrivileged((PrivilegedAction<Void>) () -> {
+            for (String s : providersToRemove) {
+                Security.removeProvider(s);
+            }
+            return null;
+        });
+
+        final Provider[] initialProviders = this.initialProviders.getOptionalValue();
+        final Provider[] finalProviders = this.finalProviders.getOptionalValue();
+
+        if (initialProviders != null) {
+            SecurityActions.doPrivileged((PrivilegedAction<Void>) () -> {
+                for (int i = initialProviders.length - 1; i >= 0; i--) {
+                    int position = Security.insertProviderAt(initialProviders[i], 1);
+                    if (position > -1) {
+                        registeredProviderNames.add(initialProviders[i].getName());
+                    }
+                }
+                return null;
+            });
+        }
+
+        if (finalProviders != null) {
+            SecurityActions.doPrivileged((PrivilegedAction<Void>) () -> {
+                for (Provider current : finalProviders) {
+                    int position = Security.addProvider(current);
+                    if (position > -1) {
+                        registeredProviderNames.add(current.getName());
+                    }
+                }
+                return null;
+            });
+        }
+    }
+
+    @Override
+    public void stop(StopContext context) {
+        Iterator<String> namesIterator = registeredProviderNames.iterator();
+        SecurityActions.doPrivileged((PrivilegedAction<Void>) () -> {
+            while (namesIterator.hasNext()) {
+                Security.removeProvider(namesIterator.next());
+                namesIterator.remove();
+            }
+            return null;
+        });
+    }
+
+    Injector<Provider[]> getInitialProivders() {
+        return initialProviders;
+    }
+
+    Injector<Provider[]> getFinalProviders() {
+        return finalProviders;
+    }
+
+    @Override
+    public Void getValue() throws IllegalStateException, IllegalArgumentException {
+        return null;
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextDefinitions.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextDefinitions.java
new file mode 100644
index 0000000..585c4e2
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextDefinitions.java
@@ -0,0 +1,2000 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.capability.RuntimeCapability.buildDynamicCapabilityName;
+import static org.jboss.as.controller.security.CredentialReference.handleCredentialReferenceUpdate;
+import static org.jboss.as.controller.security.CredentialReference.rollbackCredentialStoreUpdate;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_MANAGER_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_MANAGER_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.KEY_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.PROVIDERS_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.SSL_CONTEXT_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.SSL_CONTEXT_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.TRUST_MANAGER_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.getRequiredService;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PATH;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.RELATIVE_TO;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathName;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+import java.net.Socket;
+import java.net.URI;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.Provider;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLSessionContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509ExtendedKeyManager;
+import javax.net.ssl.X509ExtendedTrustManager;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.ObjectListAttributeDefinition;
+import org.jboss.as.controller.ObjectTypeAttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.StringListAttributeDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.ResourceDescriptionResolver;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.operations.validation.IntRangeValidator;
+import org.jboss.as.controller.operations.validation.StringAllowedValuesValidator;
+import org.jboss.as.controller.registry.AttributeAccess;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.controller.services.path.PathManager;
+import org.jboss.as.controller.services.path.PathManagerService;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.State;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.ServiceRegistry;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.value.InjectedValue;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls.TrivialResourceDefinition.Builder;
+import org.wildfly.extension.elytron.tls.TrivialService.ValueSupplier;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.source.CredentialSource;
+import org.wildfly.security.keystore.AliasFilter;
+import org.wildfly.security.keystore.FilteringKeyStore;
+import org.wildfly.security.password.interfaces.ClearPassword;
+import org.wildfly.security.ssl.CipherSuiteSelector;
+import org.wildfly.security.ssl.DomainlessSSLContextBuilder;
+import org.wildfly.security.ssl.Protocol;
+import org.wildfly.security.ssl.ProtocolSelector;
+import org.wildfly.security.ssl.X509RevocationTrustManager;
+
+/**
+ * Definitions for resources used to configure SSLContexts.
+ *
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+class SSLContextDefinitions {
+
+    static final ServiceUtil<SSLContext> SERVER_SERVICE_UTIL = ServiceUtil.newInstance(SSL_CONTEXT_RUNTIME_CAPABILITY, Constants.SERVER_SSL_CONTEXT, SSLContext.class);
+    static final ServiceUtil<SSLContext> CLIENT_SERVICE_UTIL = ServiceUtil.newInstance(SSL_CONTEXT_RUNTIME_CAPABILITY, Constants.CLIENT_SSL_CONTEXT, SSLContext.class);
+
+    static final ObjectTypeAttributeDefinition CREDENTIAL_REFERENCE = CredentialReference.getAttributeDefinition(true);
+
+    /** Base attribute definitions */
+
+    static final SimpleAttributeDefinition ALGORITHM = new SimpleAttributeDefinitionBuilder(Constants.ALGORITHM, ModelType.STRING, true)
+            .setMinSize(1)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition CIPHER_SUITE_FILTER = new SimpleAttributeDefinitionBuilder(Constants.CIPHER_SUITE_FILTER, ModelType.STRING, true)
+            .setMinSize(1)
+            .setDefaultValue(new ModelNode("DEFAULT"))
+            .setValidator(new Validators.CipherSuiteFilterValidator())
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition CIPHER_SUITE_NAMES = new SimpleAttributeDefinitionBuilder(Constants.CIPHER_SUITE_NAMES, ModelType.STRING, true)
+            .setMinSize(1)
+            .setValidator(new Validators.CipherSuiteNamesValidator())
+            // WFCORE-4789: Add the following line back when we are ready to enable TLS 1.3 by default
+            //.setDefaultValue(new ModelNode(CipherSuiteSelector.OPENSSL_DEFAULT_CIPHER_SUITE_NAMES))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    private static final String[] ALLOWED_PROTOCOLS = { "SSLv2", "SSLv2Hello", "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+
+    static final StringListAttributeDefinition PROTOCOLS = new StringListAttributeDefinition.Builder(Constants.PROTOCOLS)
+            .setMinSize(1)
+            .setRequired(false)
+            .setValidator(new StringAllowedValuesValidator(ALLOWED_PROTOCOLS))
+            .setAllowedValues(ALLOWED_PROTOCOLS)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition WANT_CLIENT_AUTH = new SimpleAttributeDefinitionBuilder(Constants.WANT_CLIENT_AUTH, ModelType.BOOLEAN, true)
+            .setMinSize(1)
+            .setDefaultValue(ModelNode.FALSE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition NEED_CLIENT_AUTH = new SimpleAttributeDefinitionBuilder(Constants.NEED_CLIENT_AUTH, ModelType.BOOLEAN, true)
+            .setMinSize(1)
+            .setDefaultValue(ModelNode.FALSE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition AUTHENTICATION_OPTIONAL = new SimpleAttributeDefinitionBuilder(Constants.AUTHENTICATION_OPTIONAL, ModelType.BOOLEAN, true)
+            .setMinSize(1)
+            .setDefaultValue(ModelNode.FALSE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition USE_CIPHER_SUITES_ORDER = new SimpleAttributeDefinitionBuilder(Constants.USE_CIPHER_SUITES_ORDER, ModelType.BOOLEAN, true)
+            .setMinSize(1)
+            .setDefaultValue(ModelNode.TRUE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition MAXIMUM_SESSION_CACHE_SIZE = new SimpleAttributeDefinitionBuilder(Constants.MAXIMUM_SESSION_CACHE_SIZE, ModelType.INT, true)
+            .setValidator(new IntRangeValidator(-1))
+            .setDefaultValue(new ModelNode(-1))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition SESSION_TIMEOUT = new SimpleAttributeDefinitionBuilder(Constants.SESSION_TIMEOUT, ModelType.INT, true)
+            .setValidator(new IntRangeValidator(-1))
+            .setDefaultValue(new ModelNode(-1))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition WRAP = new SimpleAttributeDefinitionBuilder(Constants.WRAP, ModelType.BOOLEAN, true)
+            .setDefaultValue(ModelNode.FALSE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition MAXIMUM_CERT_PATH = new SimpleAttributeDefinitionBuilder(Constants.MAXIMUM_CERT_PATH, ModelType.INT, true)
+            .setValidator(new IntRangeValidator(1))
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition GENERATE_SELF_SIGNED_CERTIFICATE_HOST = new SimpleAttributeDefinitionBuilder(Constants.GENERATE_SELF_SIGNED_CERTIFICATE_HOST, ModelType.STRING, true)
+            .setMinSize(1)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    /** Provider definitions */
+
+    static final SimpleAttributeDefinition PROVIDER_NAME = new SimpleAttributeDefinitionBuilder(Constants.PROVIDER_NAME, ModelType.STRING, true)
+            .setMinSize(1)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition PROVIDERS = new SimpleAttributeDefinitionBuilder(Constants.PROVIDERS, ModelType.STRING, true)
+            .setMinSize(1)
+            .setFlags(AttributeAccess.Flag.RESTART_RESOURCE_SERVICES)
+            .setAllowExpression(false)
+            .build();
+
+
+    static final SimpleAttributeDefinition providersKMDefinition = new SimpleAttributeDefinitionBuilder(PROVIDERS)
+            .setCapabilityReference(PROVIDERS_CAPABILITY, KEY_MANAGER_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+
+    static final SimpleAttributeDefinition providersTMDefinition = new SimpleAttributeDefinitionBuilder(PROVIDERS)
+            .setCapabilityReference(PROVIDERS_CAPABILITY, TRUST_MANAGER_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+
+    /** KeyStore definitions **/
+
+    static final SimpleAttributeDefinition TYPE = new SimpleAttributeDefinitionBuilder(Constants.TYPE, ModelType.STRING, true)
+            .setMinSize(1)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition REQUIRED = new SimpleAttributeDefinitionBuilder(Constants.REQUIRED, ModelType.BOOLEAN, true)
+            .setRequires(Constants.PATH)
+            .setAttributeGroup(Constants.FILE)
+            .setDefaultValue(ModelNode.FALSE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition ALIAS_FILTER = new SimpleAttributeDefinitionBuilder(Constants.ALIAS_FILTER, ModelType.STRING, true)
+            .setMinSize(1)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    /* Since XSD doesn't support providing a choice between 2 attributes, validation is done in the definition.
+     * This applies to all types of key stores, key managers, and trust managers
+     * TODO: potentially move validation into XML schema */
+
+    static final SimpleAttributeDefinition KEY_STORE = new SimpleAttributeDefinitionBuilder(Constants.KEY_STORE, ModelType.STRING, true)
+            .setMinSize(1)
+            .setRequired(true)
+            // .setAlternatives(Constants.KEY_STORE_OBJECT)
+            .setFlags(AttributeAccess.Flag.RESTART_RESOURCE_SERVICES)
+            .setAllowExpression(false)
+            .build();
+            
+    static final SimpleAttributeDefinition keystoreKMDefinition = new SimpleAttributeDefinitionBuilder(KEY_STORE)
+            .setCapabilityReference(KEY_STORE_CAPABILITY, KEY_MANAGER_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition keystoreTMDefinition = new SimpleAttributeDefinitionBuilder(KEY_STORE)
+            .setCapabilityReference(KEY_STORE_CAPABILITY, TRUST_MANAGER_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+
+    static final ObjectTypeAttributeDefinition KEY_STORE_OBJECT = new ObjectTypeAttributeDefinition.Builder(Constants.KEY_STORE_OBJECT, TYPE,
+                PATH, RELATIVE_TO, REQUIRED, CREDENTIAL_REFERENCE, ALIAS_FILTER, KeyStoreDefinition.PROVIDER_NAME, KeyStoreDefinition.PROVIDERS)
+            .setMinSize(1)
+            .setRequired(true)
+            .setAlternatives(Constants.KEY_STORE)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition keystoreKMObjectDefinition = new ObjectTypeAttributeDefinition.Builder(Constants.KEY_STORE_OBJECT, KEY_STORE_OBJECT)
+            .setCapabilityReference(KEY_STORE_CAPABILITY, TRUST_MANAGER_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+            
+    static final ObjectTypeAttributeDefinition keystoreTMObjectDefinition = new ObjectTypeAttributeDefinition.Builder(Constants.KEY_STORE_OBJECT, KEY_STORE_OBJECT)
+            .setCapabilityReference(KEY_STORE_CAPABILITY, TRUST_MANAGER_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    /** Revocation definitions */
+
+    static final SimpleAttributeDefinition RESPONDER_KEYSTORE = new SimpleAttributeDefinitionBuilder(Constants.RESPONDER_KEYSTORE, ModelType.STRING, true)
+            .setRequired(false)
+            // .setAlternatives(Constants.RESPONDER_KEYSTORE_OBJECT)
+            .setRequires(Constants.RESPONDER_CERTIFICATE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition RESPONDER_KEYSTORE_OBJECT = new ObjectTypeAttributeDefinition.Builder(Constants.RESPONDER_KEYSTORE_OBJECT,
+            TYPE, PATH, RELATIVE_TO, REQUIRED, CREDENTIAL_REFERENCE, ALIAS_FILTER, KeyStoreDefinition.PROVIDER_NAME, KeyStoreDefinition.PROVIDERS)
+            .setRequired(false)
+            .setAlternatives(Constants.RESPONDER_KEYSTORE)
+            .setRequires(Constants.RESPONDER_CERTIFICATE)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition CERTIFICATE_REVOCATION_LIST = new ObjectTypeAttributeDefinition.Builder(Constants.CERTIFICATE_REVOCATION_LIST,
+            PATH, RELATIVE_TO, MAXIMUM_CERT_PATH)
+            .setRequired(false)
+            .setAlternatives(Constants.CERTIFICATE_REVOCATION_LISTS)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition CERTIFICATE_REVOCATION_LIST_NO_MAX_CERT_PATH = new ObjectTypeAttributeDefinition.Builder(Constants.CERTIFICATE_REVOCATION_LIST, PATH, RELATIVE_TO)
+            .setRequired(false)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectListAttributeDefinition CERTIFICATE_REVOCATION_LISTS = new ObjectListAttributeDefinition.Builder(Constants.CERTIFICATE_REVOCATION_LISTS, CERTIFICATE_REVOCATION_LIST_NO_MAX_CERT_PATH)
+            .setRequired(false)
+            .setAlternatives(Constants.CERTIFICATE_REVOCATION_LIST)
+            .setRestartAllServices()
+            .build();
+
+
+    static final SimpleAttributeDefinition RESPONDER = new SimpleAttributeDefinitionBuilder(Constants.RESPONDER, ModelType.STRING, true)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition PREFER_CRLS = new SimpleAttributeDefinitionBuilder(Constants.PREFER_CRLS, ModelType.BOOLEAN, true)
+            .setDefaultValue(ModelNode.FALSE)
+            .setRequired(false)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition SOFT_FAIL = new SimpleAttributeDefinitionBuilder(Constants.SOFT_FAIL, ModelType.BOOLEAN, true)
+            .setRequired(false)
+            .setDefaultValue(ModelNode.FALSE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition ONLY_LEAF_CERT = new SimpleAttributeDefinitionBuilder(Constants.ONLY_LEAF_CERT, ModelType.BOOLEAN, true)
+            .setRequired(false)
+            .setDefaultValue(ModelNode.FALSE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition RESPONDER_CERTIFICATE = new SimpleAttributeDefinitionBuilder(Constants.RESPONDER_CERTIFICATE, ModelType.STRING, true)
+            .setRequired(false)
+            .setAllowExpression(true)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition OCSP = new ObjectTypeAttributeDefinition.Builder(Constants.OCSP, RESPONDER, PREFER_CRLS,
+            RESPONDER_CERTIFICATE, RESPONDER_KEYSTORE/* , RESPONDER_KEYSTORE_OBJECT */)
+            .setRequired(false)
+            .setRestartAllServices()
+            .build();
+
+    /** KeyManager definitions */
+
+    static final SimpleAttributeDefinition KEY_MANAGER = new SimpleAttributeDefinitionBuilder(Constants.KEY_MANAGER, ModelType.STRING, true)
+            .setMinSize(1)
+            // .setAlternatives(Constants.KEY_MANAGER_OBJECT)
+            .setCapabilityReference(KEY_MANAGER_CAPABILITY, SSL_CONTEXT_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition KEY_MANAGER_OBJECT = new ObjectTypeAttributeDefinition.Builder(Constants.KEY_MANAGER_OBJECT,
+    ALGORITHM, providersKMDefinition, PROVIDER_NAME, keystoreKMDefinition, keystoreKMObjectDefinition, ALIAS_FILTER, CREDENTIAL_REFERENCE,
+    GENERATE_SELF_SIGNED_CERTIFICATE_HOST)
+            .setRequired(true)
+            .setAlternatives(Constants.KEY_MANAGER)
+            .setCapabilityReference(KEY_MANAGER_CAPABILITY, SSL_CONTEXT_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+
+    /** TrustManager definitions */
+
+    static final SimpleAttributeDefinition TRUST_MANAGER = new SimpleAttributeDefinitionBuilder(Constants.TRUST_MANAGER, ModelType.STRING, true)
+            .setMinSize(1)
+            // .setAlternatives(Constants.TRUST_MANAGER_OBJECT)
+            .setCapabilityReference(TRUST_MANAGER_CAPABILITY, SSL_CONTEXT_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    static final ObjectTypeAttributeDefinition TRUST_MANAGER_OBJECT = new ObjectTypeAttributeDefinition.Builder(Constants.TRUST_MANAGER_OBJECT, ALGORITHM,
+                PROVIDER_NAME, providersTMDefinition, keystoreTMDefinition, keystoreTMObjectDefinition, ALIAS_FILTER, CERTIFICATE_REVOCATION_LIST,
+                CERTIFICATE_REVOCATION_LISTS, OCSP, SOFT_FAIL, ONLY_LEAF_CERT, MAXIMUM_CERT_PATH)
+            .setAlternatives(Constants.TRUST_MANAGER)
+            .setCapabilityReference(TRUST_MANAGER_CAPABILITY, SSL_CONTEXT_CAPABILITY)
+            .setAllowExpression(false)
+            .setRestartAllServices()
+            .build();
+
+    /* SSL Context definitions */
+
+    // TODO implement SNI
+    /* static final SimpleAttributeDefinition DEFAULT_SSL_CONTEXT = new SimpleAttributeDefinitionBuilder(Constants.DEFAULT_SSL_CONTEXT, ModelType.STRING)
+           .setRequired(true)
+           .setCapabilityReference(SSL_CONTEXT_CAPABILITY)
+           .setRestartAllServices()
+           .build();
+
+    static final MapAttributeDefinition HOST_CONTEXT_MAP = new SimpleMapAttributeDefinition.Builder(Constants.HOST_CONTEXT_MAP, ModelType.STRING, true)
+           .setMinSize(0)
+           .setCapabilityReference(SSL_CONTEXT_CAPABILITY)
+           .setMapValidator(new Validators.HostContextMapValidator())
+           .setAllowExpression(false)
+           .setRestartAllServices()
+           .build(); */
+
+    /* Runtime Attributes */
+
+    private static final SimpleAttributeDefinition ACTIVE_SESSION_COUNT = new SimpleAttributeDefinitionBuilder(Constants.ACTIVE_SESSION_COUNT, ModelType.INT)
+            .setStorageRuntime()
+            .build();
+
+    static ResourceDefinition getKeyManagerDefinition() {
+
+        final StandardResourceDescriptionResolver RESOURCE_RESOLVER = ElytronTlsExtension.getResourceDescriptionResolver(Constants.KEY_MANAGER);
+        final ObjectTypeAttributeDefinition credentialReferenceDefinition = CredentialReference.getAttributeDefinition(true);
+
+        AttributeDefinition[] attributes = new AttributeDefinition[]{ALGORITHM, providersKMDefinition, PROVIDER_NAME,
+                keystoreKMDefinition, /* keystoreKMObjectDefinition */ ALIAS_FILTER, credentialReferenceDefinition, GENERATE_SELF_SIGNED_CERTIFICATE_HOST};
+
+        AbstractAddStepHandler add = new TrivialAddHandler<KeyManager>(KeyManager.class, attributes, KEY_MANAGER_RUNTIME_CAPABILITY) {
+
+            @Override
+            protected void populateModel(final OperationContext context, final ModelNode operation, final Resource resource) throws  OperationFailedException {
+                super.populateModel(context, operation, resource);
+                handleCredentialReferenceUpdate(context, resource.getModel());
+            }
+
+            @Override
+            protected ValueSupplier<KeyManager> getValueSupplier(ServiceBuilder<KeyManager> serviceBuilder, OperationContext context, ModelNode model) throws OperationFailedException {
+
+                ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, credentialReferenceDefinition, model, serviceBuilder);
+                final String algorithmName = ALGORITHM.resolveModelAttribute(context, model).asStringOrNull();
+                final String aliasFilter = ALIAS_FILTER.resolveModelAttribute(context, model).asStringOrNull();
+                final String generateSelfSignedCertificateHost = GENERATE_SELF_SIGNED_CERTIFICATE_HOST.resolveModelAttribute(context, model).asStringOrNull();
+                final String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+                final String providersName = providersKMDefinition.resolveModelAttribute(context, model).asStringOrNull();
+                
+                final InjectedValue<Provider[]> providersInjector = new InjectedValue<>();
+                if (providersName != null) {
+                    serviceBuilder.addDependency(context.getCapabilityServiceName(
+                            buildDynamicCapabilityName(PROVIDERS_CAPABILITY, providersName), Provider[].class),
+                            Provider[].class, providersInjector);
+                }
+                
+                // final ModelNode keyStoreObject = keystoreKMObjectDefinition.resolveModelAttribute(context, model);
+                final String keyStoreName = keystoreKMDefinition.resolveModelAttribute(context, model).asStringOrNull();
+                final ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context, keyStoreName);
+                final InjectedValue<KeyStore> keyStoreInjector = new InjectedValue<>();
+                
+                if (keyStoreName != null) {
+                    /* if (keyStoreObject.isDefined()) {
+                        throw LOGGER.multipleKeyStoreDefinitions();
+                    } */
+                    serviceBuilder.addDependency(context.getCapabilityServiceName(
+                            buildDynamicCapabilityName(KEY_STORE_CAPABILITY, keyStoreName), KeyStore.class),
+                            KeyStore.class, keyStoreInjector);
+                /* } else {
+                    if (!keyStoreObject.isDefined()) {
+                         LOGGER.missingKeyStoreDefinition();
+                     }
+                    keyStoreInjector = createKeyStore(serviceBuilder, context, keyStoreObject, providersInjector); */
+                }
+
+                final String algorithm = algorithmName != null ? algorithmName : KeyManagerFactory.getDefaultAlgorithm();
+                DelegatingKeyManager delegatingKeyManager = new DelegatingKeyManager();
+                return () -> {
+                    Provider[] providers = providersInjector.getOptionalValue();
+                    KeyManagerFactory keyManagerFactory = null;
+                    if (providers != null) {
+                        for (Provider current : providers) {
+                            if (providerName == null || providerName.equals(current.getName())) {
+                                try {
+                                    // TODO - We could check the Services within each Provider to check there is one of the required type/algorithm
+                                    // However the same loop would need to remain as it is still possible a specific provider can't create it.
+                                    keyManagerFactory = KeyManagerFactory.getInstance(algorithm, current);
+                                    break;
+                                } catch (NoSuchAlgorithmException ignored) {
+                                }
+                            }
+                        }
+                        if (keyManagerFactory == null)
+                            throw LOGGER.unableToCreateManagerFactory(KeyManagerFactory.class.getSimpleName(), algorithm);
+                    } else {
+                        try {
+                            keyManagerFactory = KeyManagerFactory.getInstance(algorithm);
+                        } catch (NoSuchAlgorithmException e) {
+                            throw new StartException(e);
+                        }
+                    }
+
+                    KeyStore keyStore = keyStoreInjector.getOptionalValue();
+                    char[] password;
+                    try {
+                        CredentialSource cs = credentialSourceSupplier.get();
+                        if (cs != null) {
+                            password = cs.getCredential(PasswordCredential.class).getPassword(ClearPassword.class).getPassword();
+                        } else {
+                            // throw new StartException(LOGGER.keyStorePasswordCannotBeResolved(keyStoreName == null ? keyStoreObject.asStringOrNull() : keyStoreName));
+                            throw new StartException(LOGGER.keyStorePasswordCannotBeResolved(keyStoreName));
+                        }
+                        if (LOGGER.isTraceEnabled()) {
+                            LOGGER.tracef(
+                                    "KeyManager supplying:  providers = %s  provider = %s  algorithm = %s  keyManagerFactory = %s  " +
+                                            "keyStoreName = %s  aliasFilter = %s  keyStore = %s  keyStoreSize = %d  password (of item) = %b",
+                                    Arrays.toString(providers), providerName, algorithm, keyManagerFactory, keyStoreName, aliasFilter, keyStore, keyStore.size(), password != null
+                            );
+                        }
+                    } catch (StartException e) {
+                        throw e;
+                    } catch (Exception e) {
+                        throw new StartException(e);
+                    }
+
+                    if ((keyStoreService instanceof KeyStoreService) && ((KeyStoreService) keyStoreService).shouldAutoGenerateSelfSignedCertificate(generateSelfSignedCertificateHost)) {
+                        LOGGER.selfSignedCertificateWillBeCreated(((KeyStoreService) keyStoreService).getResolvedAbsolutePath(), generateSelfSignedCertificateHost);
+                        return new LazyDelegatingKeyManager(keyStoreService, password, keyManagerFactory,
+                                generateSelfSignedCertificateHost, aliasFilter);
+                    } else {
+                        try {
+                            if (initKeyManagerFactory(keyStore, delegatingKeyManager, aliasFilter, password, keyManagerFactory)) {
+                                return delegatingKeyManager;
+                            }
+                        } catch (Exception e) {
+                            throw new StartException(e);
+                        }
+                        throw LOGGER.noTypeFound(X509ExtendedKeyManager.class.getSimpleName());
+                    }
+                };
+            }
+
+            @Override
+            protected void rollbackRuntime(OperationContext context, final ModelNode operation, final Resource resource) {
+                rollbackCredentialStoreUpdate(credentialReferenceDefinition, context, resource);
+            }
+        };
+
+        final ServiceUtil<KeyManager> KEY_MANAGER_UTIL = ServiceUtil.newInstance(KEY_MANAGER_RUNTIME_CAPABILITY, Constants.KEY_MANAGER, KeyManager.class);
+        return TrivialResourceDefinition.builder()
+                .setPathKey(Constants.KEY_MANAGER)
+                .setAddHandler(add)
+                .setAttributes(attributes)
+                .setRuntimeCapabilities(KEY_MANAGER_RUNTIME_CAPABILITY)
+                .addOperation(new SimpleOperationDefinitionBuilder(Constants.INIT, RESOURCE_RESOLVER)
+                        .setRuntimeOnly()
+                        .build(), init(KEY_MANAGER_UTIL))
+                .build();
+    }
+
+    static ResourceDefinition getTrustManagerDefinition() {
+
+        final StandardResourceDescriptionResolver RESOURCE_RESOLVER = ElytronTlsExtension.getResourceDescriptionResolver(Constants.TRUST_MANAGER);
+
+        AttributeDefinition[] attributes = new AttributeDefinition[]{ALGORITHM, providersTMDefinition, PROVIDER_NAME,
+                keystoreTMDefinition, /* keystoreTMObjectDefinition, */ ALIAS_FILTER, CERTIFICATE_REVOCATION_LIST, CERTIFICATE_REVOCATION_LISTS, OCSP, SOFT_FAIL, ONLY_LEAF_CERT, MAXIMUM_CERT_PATH};
+
+        AbstractAddStepHandler add = new TrivialAddHandler<TrustManager>(TrustManager.class, attributes, TRUST_MANAGER_RUNTIME_CAPABILITY) {
+
+            @Override
+            protected ValueSupplier<TrustManager> getValueSupplier(ServiceBuilder<TrustManager> serviceBuilder, OperationContext context, ModelNode model) throws OperationFailedException {
+                final String algorithmName = ALGORITHM.resolveModelAttribute(context, model).asStringOrNull();
+                final String aliasFilter = ALIAS_FILTER.resolveModelAttribute(context, model).asStringOrNull();
+                final String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+                String providerLoader = providersTMDefinition.resolveModelAttribute(context, model).asStringOrNull();
+                final String keyStoreName = keystoreTMDefinition.resolveModelAttribute(context, model).asStringOrNull();
+
+                final InjectedValue<Provider[]> providersInjector = new InjectedValue<>();
+                if (providerLoader != null) {
+                    serviceBuilder.addDependency(context.getCapabilityServiceName(
+                            buildDynamicCapabilityName(PROVIDERS_CAPABILITY, providerLoader), Provider[].class),
+                            Provider[].class, providersInjector);
+                }
+
+                // final ModelNode keyStoreObject = keystoreTMObjectDefinition.resolveModelAttribute(context, model);
+                final InjectedValue<KeyStore> keyStoreInjector = new InjectedValue<>();
+                
+                if (keyStoreName != null) {
+                    /* if (keyStoreObject.isDefined()) {
+                        throw LOGGER.multipleKeyStoreDefinitions();
+                    } */
+                    serviceBuilder.addDependency(context.getCapabilityServiceName(
+                            buildDynamicCapabilityName(KEY_STORE_CAPABILITY, keyStoreName), KeyStore.class),
+                            KeyStore.class, keyStoreInjector);
+                /* } else {
+                    if (!keyStoreObject.isDefined()) {
+                        LOGGER.missingKeyStoreDefinition();
+                    }
+                    keyStoreInjector = createKeyStore(serviceBuilder, context, keyStoreObject, providersInjector); */
+                }
+
+                final String algorithm = algorithmName != null ? algorithmName : TrustManagerFactory.getDefaultAlgorithm();
+
+                if (model.hasDefined(CERTIFICATE_REVOCATION_LIST.getName()) || model.hasDefined(OCSP.getName()) || model.hasDefined(CERTIFICATE_REVOCATION_LISTS.getName())) {
+                    return createX509RevocationTrustManager(serviceBuilder, context, model, algorithm, providerName, providersInjector, keyStoreInjector, aliasFilter);
+                }
+
+                DelegatingTrustManager delegatingTrustManager = new DelegatingTrustManager();
+                return () -> {
+                    Provider[] providers = providersInjector.getOptionalValue();
+
+                    TrustManagerFactory trustManagerFactory = createTrustManagerFactory(providers, providerName, algorithm);
+                    KeyStore keyStore = keyStoreInjector.getOptionalValue();
+
+                    try {
+                        if (aliasFilter != null) {
+                            keyStore = FilteringKeyStore.filteringKeyStore(keyStore, AliasFilter.fromString(aliasFilter));
+                        }
+
+                        if (LOGGER.isTraceEnabled()) {
+                            LOGGER.tracef(
+                                    "TrustManager supplying:  providers = %s  provider = %s  algorithm = %s  trustManagerFactory = %s  keyStoreName = %s  keyStore = %s  aliasFilter = %s  keyStoreSize = %d",
+                                    Arrays.toString(providers), providerName, algorithm, trustManagerFactory, keyStoreName, keyStore, aliasFilter, keyStore.size()
+                            );
+                        }
+
+                        trustManagerFactory.init(keyStoreInjector.getOptionalValue());
+                    } catch (Exception e) {
+                        throw new StartException(e);
+                    }
+
+                    TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
+                    for (TrustManager trustManager : trustManagers) {
+                        if (trustManager instanceof X509ExtendedTrustManager) {
+                            delegatingTrustManager.setTrustManager((X509ExtendedTrustManager) trustManager);
+                            return delegatingTrustManager;
+                        }
+                    }
+                    throw LOGGER.noTypeFound(X509ExtendedKeyManager.class.getSimpleName());
+                };
+            }
+
+            private ValueSupplier<TrustManager> createX509RevocationTrustManager(ServiceBuilder<TrustManager> serviceBuilder, OperationContext context,
+                    ModelNode model, String algorithm, String providerName, InjectedValue<Provider[]> providersInjector,
+                    InjectedValue<KeyStore> keyStoreInjector, String aliasFilter) throws OperationFailedException {
+                ModelNode crlNode = CERTIFICATE_REVOCATION_LIST.resolveModelAttribute(context, model);
+                ModelNode ocspNode = OCSP.resolveModelAttribute(context, model);
+                ModelNode multipleCrlsNode = CERTIFICATE_REVOCATION_LISTS.resolveModelAttribute(context, model);
+                boolean softFail = SOFT_FAIL.resolveModelAttribute(context, model).asBoolean();
+                boolean onlyLeafCert = ONLY_LEAF_CERT.resolveModelAttribute(context, model).asBoolean();
+                Integer maxCertPath = MAXIMUM_CERT_PATH.resolveModelAttribute(context, model).asIntOrNull();
+
+                String crlPath = null;
+                String crlRelativeTo = null;
+                InjectedValue<PathManager> pathManagerInjector = new InjectedValue<>();
+                List<CrlFile> crlFiles = new ArrayList<>();
+
+                if (crlNode.isDefined()) {
+                    crlPath = PATH.resolveModelAttribute(context, crlNode).asStringOrNull();
+                    crlRelativeTo = RELATIVE_TO.resolveModelAttribute(context, crlNode).asStringOrNull();
+
+                    if (crlPath != null) {
+                        if (crlRelativeTo != null) {
+                            serviceBuilder.addDependency(PathManagerService.SERVICE_NAME, PathManager.class, pathManagerInjector);
+                            serviceBuilder.requires(pathName(crlRelativeTo));
+                        }
+                        crlFiles.add(new CrlFile(crlPath, crlRelativeTo, pathManagerInjector));
+                    }
+                } else if (multipleCrlsNode.isDefined()) {
+                    // certificate-revocation-lists and certificate-revocation-list are mutually exclusive
+                    for (ModelNode crl : multipleCrlsNode.asList()) {
+                        crlPath = PATH.resolveModelAttribute(context, crl).asStringOrNull();
+                        crlRelativeTo = RELATIVE_TO.resolveModelAttribute(context, crl).asStringOrNull();
+                        pathManagerInjector = new InjectedValue<>();
+                        if (crlPath != null) {
+                            if (crlRelativeTo != null) {
+                                serviceBuilder.addDependency(PathManagerService.SERVICE_NAME, PathManager.class, pathManagerInjector);
+                                serviceBuilder.requires(pathName(crlRelativeTo));
+                            }
+                            crlFiles.add(new CrlFile(crlPath, crlRelativeTo, pathManagerInjector));
+                        }
+                    }
+                }
+
+                boolean preferCrls = PREFER_CRLS.resolveModelAttribute(context, ocspNode).asBoolean(false);
+                String responder = RESPONDER.resolveModelAttribute(context, ocspNode).asStringOrNull();
+                String responderCertAlias = RESPONDER_CERTIFICATE.resolveModelAttribute(context, ocspNode).asStringOrNull();
+                String responderKeystore = RESPONDER_KEYSTORE.resolveModelAttribute(context, ocspNode).asStringOrNull();
+
+                final InjectedValue<KeyStore> responderStoreInjector = responderKeystore != null ? new InjectedValue<>() : keyStoreInjector;
+
+                if (responderKeystore != null) {
+                    serviceBuilder.addDependency(context.getCapabilityServiceName(
+                            buildDynamicCapabilityName(KEY_STORE_CAPABILITY, responderKeystore), KeyStore.class),
+                            KeyStore.class, responderStoreInjector);
+                }
+
+                URI responderUri;
+                try {
+                    responderUri = responder == null ? null : new URI(responder);
+                } catch (Exception e) {
+                    throw new OperationFailedException(e);
+                }
+
+                X509RevocationTrustManager.Builder builder = X509RevocationTrustManager.builder();
+                builder.setResponderURI(responderUri);
+                builder.setSoftFail(softFail);
+                builder.setOnlyEndEntity(onlyLeafCert);
+                if (maxCertPath != null) {
+                    builder.setMaxCertPath(maxCertPath.intValue());
+                }
+                if (model.hasDefined(CERTIFICATE_REVOCATION_LIST.getName()) || model.hasDefined(CERTIFICATE_REVOCATION_LISTS.getName())) {
+                    if (!model.hasDefined(OCSP.getName())) {
+                        builder.setPreferCrls(true);
+                        builder.setNoFallback(true);
+                    }
+                }
+                if (model.hasDefined(OCSP.getName())) {
+                    builder.setResponderURI(responderUri);
+                    if (!model.hasDefined(CERTIFICATE_REVOCATION_LIST.getName()) && !model.hasDefined(CERTIFICATE_REVOCATION_LISTS.getName())) {
+                        builder.setPreferCrls(false);
+                        builder.setNoFallback(true);
+                    } else {
+                        builder.setPreferCrls(preferCrls);
+                    }
+                }
+                final List<CrlFile> finalCrlFiles = crlFiles;
+                return () -> {
+                    TrustManagerFactory trustManagerFactory = createTrustManagerFactory(providersInjector.getOptionalValue(), providerName, algorithm);
+                    KeyStore keyStore = keyStoreInjector.getOptionalValue();
+
+                    if (aliasFilter != null) {
+                        try {
+                            keyStore = FilteringKeyStore.filteringKeyStore(keyStore, AliasFilter.fromString(aliasFilter));
+                        } catch (Exception e) {
+                            throw new StartException(e);
+                        }
+                    }
+
+                    if (responderCertAlias != null) {
+                        KeyStore responderStore = responderStoreInjector.getOptionalValue();
+                        try {
+                            builder.setOcspResponderCert((X509Certificate) responderStore.getCertificate(responderCertAlias));
+                        } catch (KeyStoreException e) {
+                            throw LOGGER.failedToLoadResponderCert(responderCertAlias, e);
+                        }
+                    }
+
+                    builder.setTrustStore(keyStore);
+                    builder.setTrustManagerFactory(trustManagerFactory);
+
+                    if (! finalCrlFiles.isEmpty()) {
+                        List<InputStream> finalCrlStreams = getCrlStreams(finalCrlFiles);
+                        builder.setCrlStreams(finalCrlStreams);
+                        return createReloadableX509CRLTrustManager(finalCrlFiles, builder);
+                    }
+                    return builder.build();
+                };
+            }
+
+            private List<InputStream> getCrlStreams(List<CrlFile> crlFiles) throws StartException {
+                List<InputStream> crlStreams = new ArrayList<>();
+                for (CrlFile crl : crlFiles) {
+                    try {
+                        crlStreams.add(new FileInputStream(resolveFileLocation(crl.getCrlPath(), crl.getRelativeTo(), crl.getPathManagerInjector())));
+                    } catch (FileNotFoundException e) {
+                        throw LOGGER.unableToAccessCRL(e);
+                    }
+                }
+                return crlStreams;
+            }
+
+            private TrustManager createReloadableX509CRLTrustManager(final List<CrlFile> crlFiles, final X509RevocationTrustManager.Builder builder) {
+                return new ReloadableX509ExtendedTrustManager() {
+
+                    private volatile X509ExtendedTrustManager delegate = builder.build();
+                    private AtomicBoolean reloading = new AtomicBoolean();
+
+                    @Override
+                    void reload() {
+                        if (reloading.compareAndSet(false, true)) {
+                            try {
+                                builder.setCrlStreams(getCrlStreams(crlFiles));
+                                delegate = builder.build();
+                            } catch (StartException cause) {
+                                throw LOGGER.unableToReloadCRL(cause);
+                            } finally {
+                                reloading.lazySet(false);
+                            }
+                        }
+                    }
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] x509Certificates, String s, Socket socket) throws CertificateException {
+                        delegate.checkClientTrusted(x509Certificates, s, socket);
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] x509Certificates, String s, Socket socket) throws CertificateException {
+                        delegate.checkServerTrusted(x509Certificates, s, socket);
+                    }
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine) throws CertificateException {
+                        delegate.checkClientTrusted(x509Certificates, s, sslEngine);
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine) throws CertificateException {
+                        delegate.checkServerTrusted(x509Certificates, s, sslEngine);
+                    }
+
+                    @Override
+                    public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+                        delegate.checkClientTrusted(x509Certificates, s);
+                    }
+
+                    @Override
+                    public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+                        delegate.checkServerTrusted(x509Certificates, s);
+                    }
+
+                    @Override
+                    public X509Certificate[] getAcceptedIssuers() {
+                        return delegate.getAcceptedIssuers();
+                    }
+                };
+            }
+
+            private File resolveFileLocation(String path, String relativeTo, InjectedValue<PathManager> pathManagerInjector) {
+                final File resolvedPath;
+                if (relativeTo != null) {
+                    PathManager pathManager = pathManagerInjector.getValue();
+                    resolvedPath = new File(pathManager.resolveRelativePathEntry(path, relativeTo));
+                } else {
+                    resolvedPath = new File(path);
+                }
+                return resolvedPath;
+            }
+
+            private TrustManagerFactory createTrustManagerFactory(Provider[] providers, String providerName, String algorithm) throws StartException {
+                TrustManagerFactory trustManagerFactory = null;
+
+                if (providers != null) {
+                    for (Provider current : providers) {
+                        if (providerName == null || providerName.equals(current.getName())) {
+                            try {
+                                // TODO - We could check the Services within each Provider to check there is one of the required type/algorithm
+                                // However the same loop would need to remain as it is still possible a specific provider can't create it.
+                                return TrustManagerFactory.getInstance(algorithm, current);
+                            } catch (NoSuchAlgorithmException ignored) {
+                            }
+                        }
+                    }
+                    if (trustManagerFactory == null)
+                        throw LOGGER.unableToCreateManagerFactory(TrustManagerFactory.class.getSimpleName(), algorithm);
+                }
+
+                try {
+                    return TrustManagerFactory.getInstance(algorithm);
+                } catch (NoSuchAlgorithmException e) {
+                    throw new StartException(e);
+                }
+            }
+        };
+
+        ResourceDescriptionResolver resolver = ElytronTlsExtension.getResourceDescriptionResolver(Constants.TRUST_MANAGER);
+        final ServiceUtil<TrustManager> TRUST_MANAGER_UTIL = ServiceUtil.newInstance(TRUST_MANAGER_RUNTIME_CAPABILITY, Constants.TRUST_MANAGER, TrustManager.class);
+        return TrivialResourceDefinition.builder()
+                .setPathKey(Constants.TRUST_MANAGER)
+                .setResourceDescriptionResolver(resolver)
+                .setAddHandler(add)
+                .setAttributes(attributes)
+                .setRuntimeCapabilities(TRUST_MANAGER_RUNTIME_CAPABILITY)
+                .addOperation(new SimpleOperationDefinitionBuilder(Constants.RELOAD_CERTIFICATE_REVOCATION_LIST, resolver)
+                        .setRuntimeOnly()
+                        .build(), new ElytronRuntimeOnlyHandler() {
+                            @Override
+                            protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+                                ServiceName serviceName = TRUST_MANAGER_RUNTIME_CAPABILITY.fromBaseCapability(context.getCurrentAddressValue()).getCapabilityServiceName();
+                                ServiceController<TrustManager> serviceContainer = getRequiredService(context.getServiceRegistry(true), serviceName, TrustManager.class);
+                                State serviceState;
+                                if ((serviceState = serviceContainer.getState()) != State.UP) {
+                                    throw LOGGER.requiredServiceNotUp(serviceName, serviceState);
+                                }
+                                TrustManager trustManager = serviceContainer.getValue();
+                                if (! (trustManager instanceof ReloadableX509ExtendedTrustManager)) {
+                                    throw LOGGER.unableToReloadCRLNotReloadable();
+                                }
+                                ((ReloadableX509ExtendedTrustManager) trustManager).reload();
+                            }
+                        })
+                .addOperation(new SimpleOperationDefinitionBuilder(Constants.INIT, RESOURCE_RESOLVER)
+                        .setRuntimeOnly()
+                        .build(), init(TRUST_MANAGER_UTIL))
+                .build();
+    }
+
+    private static ResourceDefinition createSSLContextDefinition(String pathKey, boolean server, AbstractAddStepHandler addHandler, AttributeDefinition[] attributes, boolean serverOrHostController) {
+        /* The original method used SimpleResourceDefinition and would return an object from SSLContextResourceDefinition(parameters, attributes)
+         * This was likely planned to replace a variety of other classes (like TrivialResourceDefinition)
+         * TODO: Simplify and reimplement _Trivial_ classes with native subsystem versions */
+
+//        SimpleResourceDefinition.Parameters parameters = new SimpleResourceDefinition.Parameters(PathElement.pathElement(pathKey), ElytronTlsExtension.getResourceDescriptionResolver(pathKey))
+//                .setAddHandler(addHandler)
+//                .setCapabilities(SSL_CONTEXT_RUNTIME_CAPABILITY)
+//                .setAddRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+//                .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES);
+
+        Builder builder = TrivialResourceDefinition.builder()
+                .setPathKey(pathKey)
+                .setAddHandler(addHandler)
+                .setAttributes(attributes)
+                .setRuntimeCapabilities(SSL_CONTEXT_RUNTIME_CAPABILITY);
+
+        if (serverOrHostController) {
+            builder.addReadOnlyAttribute(ACTIVE_SESSION_COUNT, new SSLContextRuntimeHandler() {
+                @Override
+                protected void performRuntime(ModelNode result, ModelNode operation, SSLContext sslContext) {
+                    SSLSessionContext sessionContext = server ? sslContext.getServerSessionContext() : sslContext.getClientSessionContext();
+                    int sum = 0;
+                    for (byte[] ignored : Collections.list(sessionContext.getIds())) {
+                        int i = 1;
+                        sum += i;
+                    }
+                    result.set(sum);
+                }
+
+                @Override
+                protected ServiceUtil<SSLContext> getSSLContextServiceUtil() {
+                    return server ? SERVER_SERVICE_UTIL : CLIENT_SERVICE_UTIL;
+                }
+            }).addChild(new SSLSessionDefinition(server));
+        }
+
+        return builder.build();
+    }
+
+    static ResourceDefinition getClientSSLContextDefinition(boolean serverOrHostController) {
+
+        final SimpleAttributeDefinition providersDefinition = new SimpleAttributeDefinitionBuilder(PROVIDERS)
+                .setCapabilityReference(PROVIDERS_CAPABILITY, SSL_CONTEXT_CAPABILITY)
+                .setAllowExpression(false)
+                .setRestartAllServices()
+                .build();
+
+        final AttributeDefinition[] attributes = new AttributeDefinition[]{CIPHER_SUITE_FILTER, CIPHER_SUITE_NAMES,
+                PROTOCOLS, /* KEY_MANAGER_OBJECT, */ KEY_MANAGER, /* TRUST_MANAGER_OBJECT, */ TRUST_MANAGER,
+                PROVIDER_NAME, providersDefinition};
+
+        AbstractAddStepHandler add = new TrivialAddHandler<SSLContext>(SSLContext.class, attributes, SSL_CONTEXT_RUNTIME_CAPABILITY) {
+            @Override
+            protected ValueSupplier<SSLContext> getValueSupplier(ServiceBuilder<SSLContext> serviceBuilder, OperationContext context, ModelNode model) throws OperationFailedException {
+                final String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+                final List<String> protocols = PROTOCOLS.unwrap(context, model);
+                final String cipherSuiteFilter = CIPHER_SUITE_FILTER.resolveModelAttribute(context, model).asString();
+                final String cipherSuiteNames = CIPHER_SUITE_NAMES.resolveModelAttribute(context, model).asStringOrNull();
+                
+                final InjectedValue<Provider[]> providersInjector = addDependency(PROVIDERS_CAPABILITY, providersDefinition, Provider[].class, serviceBuilder, context, model);
+                final InjectedValue<KeyManager> keyManagerInjector = addDependency(KEY_MANAGER_CAPABILITY, KEY_MANAGER, KeyManager.class, serviceBuilder, context, model);
+                final InjectedValue<TrustManager> trustManagerInjector = addDependency(TRUST_MANAGER_CAPABILITY, TRUST_MANAGER, TrustManager.class, serviceBuilder, context, model);
+                // final ModelNode keyManagerObject = KEY_MANAGER_OBJECT.resolveModelAttribute(context, model);
+                // final ModelNode trustManagerObject = TRUST_MANAGER_OBJECT.resolveModelAttribute(context, model);
+                
+                /* if (keyManagerName != null) {
+                    if (keyManagerObject.isDefined()) {
+                        throw LOGGER.multipleKeyManagerDefinitions();
+                    }
+                    keyManagerInjector = addSSLContextDependency(KEY_MANAGER_CAPABILITY, KEY_MANAGER, KeyManager.class, serviceBuilder, context, model);
+                } else { // Use reference
+                    if (!keyManagerObject.isDefined()) {
+                        LOGGER.missingKeyManagerDefinition();
+                    }
+                    keyManagerInjector = createKeyManager(serviceBuilder, context, keyManagerObject, providersInjector);
+                }
+
+                if (trustManagerName != null) {
+                    if (trustManagerObject.isDefined()) {
+                        throw LOGGER.multipleTrustManagerDefinitions();
+                    }
+                    trustManagerInjector = addSSLContextDependency(TRUST_MANAGER_CAPABILITY, TRUST_MANAGER, TrustManager.class, serviceBuilder, context, model);
+                } else {
+                    if (!trustManagerObject.isDefined()) {
+                        LOGGER.missingTrustManagerDefinition();
+                    }
+                    trustManagerInjector = createTrustManager(serviceBuilder, context, trustManagerObject, providersInjector);
+                } */
+
+                return () -> {
+                    X509ExtendedKeyManager keyManager = getX509KeyManager(keyManagerInjector.getOptionalValue());
+                    X509ExtendedTrustManager trustManager = getX509TrustManager(trustManagerInjector.getOptionalValue());
+                    Provider[] providers = filterProviders(providersInjector.getOptionalValue(), providerName);
+
+                    DomainlessSSLContextBuilder builder = new DomainlessSSLContextBuilder();
+                    if (keyManager != null) builder.setKeyManager(keyManager);
+                    if (trustManager != null) builder.setTrustManager(trustManager);
+                    if (providers != null) builder.setProviderSupplier(() -> providers);
+                    builder.setCipherSuiteSelector(CipherSuiteSelector.aggregate(
+                                cipherSuiteNames != null? CipherSuiteSelector.fromNamesString(cipherSuiteNames) : null,
+                                CipherSuiteSelector.fromString(cipherSuiteFilter)
+                    ));
+                    if (!protocols.isEmpty()) {
+                        List<Protocol> list = new ArrayList<>();
+                        for (String protocol : protocols) {
+                            Protocol forName = Protocol.forName(protocol);
+                            list.add(forName);
+                        }
+                        builder.setProtocolSelector(ProtocolSelector.empty().add(
+                                EnumSet.copyOf(list)
+                        ));
+                    }
+                    builder.setClientMode(true)
+                            .setWrap(false);
+
+                    if (LOGGER.isTraceEnabled()) {
+                        LOGGER.tracef(
+                                "ClientSSLContext supplying:  keyManager = %s  trustManager = %s  providers = %s  " +
+                                        "cipherSuiteFilter = %s cipherSuiteNames = %s protocols = %s",
+                                keyManager, trustManager, Arrays.toString(providers), cipherSuiteFilter, cipherSuiteNames,
+                                Arrays.toString(protocols.toArray())
+                        );
+                    }
+
+                    try {
+                        return builder.build().create();
+                    } catch (GeneralSecurityException e) {
+                        throw new StartException(e);
+                    }
+                };
+            }
+
+            @Override
+            protected Resource createResource(OperationContext context) {
+                SSLContextResource resource = new SSLContextResource(Resource.Factory.create(), false);
+                context.addResource(PathAddress.EMPTY_ADDRESS, resource);
+                return resource;
+            }
+
+            @Override
+            protected void installedForResource(ServiceController<SSLContext> serviceController, Resource resource) {
+                ((SSLContextResource) resource).setSSLContextServiceController(serviceController);
+            }
+        };
+
+        return createSSLContextDefinition(Constants.CLIENT_SSL_CONTEXT, false, add, attributes, serverOrHostController);
+    }
+
+    static ResourceDefinition getServerSSLContextDefinition(boolean serverOrHostController) {
+
+        final SimpleAttributeDefinition providersDefinition = new SimpleAttributeDefinitionBuilder(PROVIDERS)
+                .setCapabilityReference(PROVIDERS_CAPABILITY, SSL_CONTEXT_CAPABILITY)
+                .setRestartAllServices()
+                .build();
+
+        final SimpleAttributeDefinition keyManagerDefinition = new SimpleAttributeDefinitionBuilder(KEY_MANAGER)
+                .setRequired(true)
+                .setRestartAllServices()
+                .build();
+
+        final AttributeDefinition[] attributes = new AttributeDefinition[]{CIPHER_SUITE_FILTER, CIPHER_SUITE_NAMES,
+                PROTOCOLS, /* KEY_MANAGER_OBJECT, */ keyManagerDefinition, /* TRUST_MANAGER_OBJECT, */ TRUST_MANAGER, PROVIDER_NAME,
+                providersDefinition, WANT_CLIENT_AUTH, NEED_CLIENT_AUTH, AUTHENTICATION_OPTIONAL, USE_CIPHER_SUITES_ORDER, MAXIMUM_SESSION_CACHE_SIZE,
+                SESSION_TIMEOUT, WRAP};
+
+        AbstractAddStepHandler add = new TrivialAddHandler<SSLContext>(SSLContext.class, ServiceController.Mode.ACTIVE,
+                                        ServiceController.Mode.PASSIVE, attributes, SSL_CONTEXT_RUNTIME_CAPABILITY) {
+
+            @Override
+            protected ValueSupplier<SSLContext> getValueSupplier(ServiceBuilder<SSLContext> serviceBuilder,
+                                                                OperationContext context, ModelNode model) throws OperationFailedException {
+                                                    
+                final String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+                final List<String> protocols = PROTOCOLS.unwrap(context, model);
+                final String cipherSuiteFilter = CIPHER_SUITE_FILTER.resolveModelAttribute(context, model).asString(); // has default value, can't be null
+                final String cipherSuiteNames = CIPHER_SUITE_NAMES.resolveModelAttribute(context, model).asStringOrNull(); // doesn't have a default value yet since we are disabling TLS 1.3 by default
+                final boolean wantClientAuth = WANT_CLIENT_AUTH.resolveModelAttribute(context, model).asBoolean();
+                final boolean needClientAuth = NEED_CLIENT_AUTH.resolveModelAttribute(context, model).asBoolean();
+                final boolean authenticationOptional = AUTHENTICATION_OPTIONAL.resolveModelAttribute(context, model).asBoolean();
+                final boolean useCipherSuitesOrder = USE_CIPHER_SUITES_ORDER.resolveModelAttribute(context, model).asBoolean();
+                final int maximumSessionCacheSize = MAXIMUM_SESSION_CACHE_SIZE.resolveModelAttribute(context, model).asInt();
+                final int sessionTimeout = SESSION_TIMEOUT.resolveModelAttribute(context, model).asInt();
+                final boolean wrap = WRAP.resolveModelAttribute(context, model).asBoolean();
+
+                final InjectedValue<Provider[]> providersInjector = addDependency(PROVIDERS_CAPABILITY, providersDefinition, Provider[].class, serviceBuilder, context, model);
+                InjectedValue<KeyManager> keyManagerInjector = addDependency(KEY_MANAGER_CAPABILITY, KEY_MANAGER, KeyManager.class, serviceBuilder, context, model);
+                InjectedValue<TrustManager> trustManagerInjector = addDependency(TRUST_MANAGER_CAPABILITY, TRUST_MANAGER, TrustManager.class, serviceBuilder, context, model);;
+                // final ModelNode keyManagerObject = KEY_MANAGER_OBJECT.resolveModelAttribute(context, model);
+                // final ModelNode trustManagerObject = TRUST_MANAGER_OBJECT.resolveModelAttribute(context, model);
+
+                /* if (keyManagerName != null) {
+                    if (keyManagerObject.isDefined()) {
+                        throw LOGGER.multipleKeyManagerDefinitions();
+                    }
+                    keyManagerInjector = addSSLContextDependency(KEY_MANAGER_CAPABILITY, KEY_MANAGER, KeyManager.class, serviceBuilder, context, model);
+                } else { // Use reference
+                     if (!keyManagerObject.isDefined()) {
+                        throw LOGGER.missingKeyManagerDefinition();
+                    }
+                    keyManagerInjector = createKeyManager(serviceBuilder, context, keyManagerObject, providersInjector);
+                }
+     
+                if (trustManagerName != null) {
+                    if (trustManagerObject.isDefined()) {
+                        throw LOGGER.multipleTrustManagerDefinitions();
+                    }
+                    trustManagerInjector = addSSLContextDependency(TRUST_MANAGER_CAPABILITY, TRUST_MANAGER, TrustManager.class, serviceBuilder, context, model);
+                } else {
+                     if (!keyManagerObject.isDefined()) {
+                        throw LOGGER.missingKeyManagerDefinition();
+                    }
+                    trustManagerInjector = createTrustManager(serviceBuilder, context, keyManagerObject, providersInjector);
+                } */
+
+                return () -> {
+                    X509ExtendedKeyManager keyManager = getX509KeyManager(keyManagerInjector.getOptionalValue());
+                    X509ExtendedTrustManager trustManager = getX509TrustManager(trustManagerInjector.getOptionalValue());
+                    Provider[] providers = filterProviders(providersInjector.getOptionalValue(), providerName);
+
+                    DomainlessSSLContextBuilder builder = new DomainlessSSLContextBuilder();
+                    if (keyManager != null) builder.setKeyManager(keyManager);
+                    if (trustManager != null) builder.setTrustManager(trustManager);
+                    if (providers != null) builder.setProviderSupplier(() -> providers);
+                    builder.setCipherSuiteSelector(CipherSuiteSelector.aggregate(
+                            cipherSuiteNames != null ? CipherSuiteSelector.fromNamesString(cipherSuiteNames) : null,
+                            CipherSuiteSelector.fromString(cipherSuiteFilter)
+                    ));
+                    if (!protocols.isEmpty()) {
+                        List<Protocol> list = new ArrayList<>();
+                        for (String protocol : protocols) {
+                            Protocol forName = Protocol.forName(protocol);
+                            list.add(forName);
+                        }
+                        builder.setProtocolSelector(ProtocolSelector.empty().add(EnumSet.copyOf(list)));
+                    }
+                    builder.setWantClientAuth(wantClientAuth)
+                            .setNeedClientAuth(needClientAuth)
+                            .setAuthenticationOptional(authenticationOptional)
+                            .setUseCipherSuitesOrder(useCipherSuitesOrder)
+                            .setSessionCacheSize(maximumSessionCacheSize)
+                            .setSessionTimeout(sessionTimeout)
+                            .setWrap(wrap);
+
+                    if (LOGGER.isTraceEnabled()) {
+                        LOGGER.tracef(
+                                "ServerSSLContext supplying:  keyManager = %s  trustManager = %s  "
+                                        + "providers = %s  cipherSuiteFilter = %s  cipherSuiteNames = %s protocols = %s  wantClientAuth = %s  needClientAuth = %s  "
+                                        + "authenticationOptional = %s maximumSessionCacheSize = %s  sessionTimeout = %s wrap = %s",
+                                keyManager, trustManager, Arrays.toString(providers), cipherSuiteFilter, cipherSuiteNames,
+                                Arrays.toString(protocols.toArray()), wantClientAuth, needClientAuth, authenticationOptional,
+                                maximumSessionCacheSize, sessionTimeout, wrap);
+                    }
+
+                    try {
+                        return builder.build().create();
+                    } catch (GeneralSecurityException e) {
+                        throw new StartException(e);
+                    }
+                };
+            }
+
+            @Override
+            protected Resource createResource(OperationContext context) {
+                SSLContextResource resource = new SSLContextResource(Resource.Factory.create(), true);
+                context.addResource(PathAddress.EMPTY_ADDRESS, resource);
+                return resource;
+            }
+
+            @Override
+            protected void installedForResource(ServiceController<SSLContext> serviceController, Resource resource) {
+                ((SSLContextResource) resource).setSSLContextServiceController(serviceController);
+            }
+
+        };
+
+        return createSSLContextDefinition(Constants.SERVER_SSL_CONTEXT, true, add, attributes, serverOrHostController);
+    }
+
+    // TODO: Add SNI
+    /* static ResourceDefinition getServerSNISSLContextDefinition() {
+
+        AttributeDefinition[] attributes = new AttributeDefinition[] { DEFAULT_SSL_CONTEXT, HOST_CONTEXT_MAP };
+
+        AbstractAddStepHandler add = new TrivialAddHandler<SSLContext>(SSLContext.class, attributes, SSL_CONTEXT_RUNTIME_CAPABILITY) {
+
+            @Override
+            protected ValueSupplier<SSLContext> getValueSupplier(ServiceBuilder<SSLContext> serviceBuilder,
+                                                                 OperationContext context, ModelNode model) throws OperationFailedException {
+
+                final InjectedValue<SSLContext> defaultContext = new InjectedValue<>();
+
+                ModelNode defaultContextName = DEFAULT_SSL_CONTEXT.resolveModelAttribute(context, model);
+                serviceBuilder.addDependency(SSL_CONTEXT_RUNTIME_CAPABILITY.getCapabilityServiceName(defaultContextName.asString()), SSLContext.class, defaultContext);
+
+                ModelNode hostContextMap = HOST_CONTEXT_MAP.resolveModelAttribute(context, model);
+
+                Set<String> keys;
+                if (hostContextMap.isDefined() && !(keys = hostContextMap.keys()).isEmpty()) {
+                    final Map<String, InjectedValue<SSLContext>> sslContextMap = new HashMap<>(keys.size());
+                    for (String host : keys) {
+                        String sslContextName = hostContextMap.require(host).asString();
+                        final InjectedValue<SSLContext> injector = new InjectedValue<>();
+                        serviceBuilder.addDependency(SSL_CONTEXT_RUNTIME_CAPABILITY.getCapabilityServiceName(sslContextName), SSLContext.class, injector);
+                        sslContextMap.put(host, injector);
+                    }
+
+                    return () -> {
+                        SNIContextMatcher.Builder builder = new SNIContextMatcher.Builder();
+                        for(Map.Entry<String, InjectedValue<SSLContext>> e : sslContextMap.entrySet()) {
+                            builder.addMatch(e.getKey(), e.getValue().getValue());
+                        }
+                        return new SNISSLContext(builder
+                                .setDefaultContext(defaultContext.getValue())
+                                .build());
+                    };
+                    return () -> defaultContext.getValue();
+        };
+
+        Builder builder = TrivialResourceDefinition.builder()
+                .setPathKey(ElytronDescriptionConstants.SERVER_SSL_SNI_CONTEXT)
+                .setAddHandler(add)
+                .setAttributes(attributes)
+                .setRuntimeCapabilities(SSL_CONTEXT_RUNTIME_CAPABILITY);
+        return builder.build();
+    } */
+
+    private static ExceptionSupplier<TrustManager, Exception> createTrustManager(ServiceBuilder<SSLContext> serviceBuilder, OperationContext context, ModelNode model,
+                                                                                    InjectedValue<Provider[]> providersInjector) throws OperationFailedException {
+        final String algorithmName = ALGORITHM.resolveModelAttribute(context, model).asStringOrNull();
+        final String aliasFilter = ALIAS_FILTER.resolveModelAttribute(context, model).asStringOrNull();
+        final String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+        
+        // final ModelNode keyStoreObject = keystoreTMObjectDefinition.resolveModelAttribute(context, model);
+        final String keyStoreName = keystoreTMDefinition.resolveModelAttribute(context, model).asStringOrNull();
+        InjectedValue<KeyStore> keyStoreInjector = new InjectedValue<>();
+
+       if (keyStoreName != null) {
+          /* if (keyStoreObject.isDefined()) {
+              throw LOGGER.multipleKeyStoreDefinitions();
+          } */
+          serviceBuilder.addDependency(context.getCapabilityServiceName(
+                  buildDynamicCapabilityName(KEY_STORE_CAPABILITY, keyStoreName), KeyStore.class),
+                  KeyStore.class, keyStoreInjector);
+       /* } else {
+           if (!keyStoreObject.isDefined()) {
+               LOGGER.missingKeyStoreDefinition();
+           }
+           keyStoreInjector = createKeyStore(serviceBuilder, context, keyStoreObject, providersInjector); */
+       }
+
+       final String algorithm = algorithmName != null ? algorithmName : TrustManagerFactory.getDefaultAlgorithm();
+
+       if (model.hasDefined(CERTIFICATE_REVOCATION_LIST.getName()) || model.hasDefined(OCSP.getName()) || model.hasDefined(CERTIFICATE_REVOCATION_LISTS.getName())) {
+           return createX509RevocationTrustManager(serviceBuilder, context, model, algorithm, providerName, providersInjector, keyStoreInjector, aliasFilter);
+       }
+
+       DelegatingTrustManager delegatingTrustManager = new DelegatingTrustManager();
+       return () -> {
+           Provider[] providers = providersInjector.getOptionalValue();
+
+           TrustManagerFactory trustManagerFactory = createTrustManagerFactory(providers, providerName, algorithm);
+           KeyStore keyStore = keyStoreInjector.getOptionalValue();
+
+           try {
+               if (aliasFilter != null) {
+                   keyStore = FilteringKeyStore.filteringKeyStore(keyStore, AliasFilter.fromString(aliasFilter));
+               }
+
+               if (LOGGER.isTraceEnabled()) {
+                   LOGGER.tracef(
+                           "TrustManager supplying:  providers = %s  provider = %s  algorithm = %s  trustManagerFactory = %s  keyStoreName = %s  keyStore = %s  aliasFilter = %s  keyStoreSize = %d",
+                           Arrays.toString(providers), providerName, algorithm, trustManagerFactory, keyStoreName, keyStore, aliasFilter, keyStore.size()
+                   );
+               }
+
+               trustManagerFactory.init(keyStoreInjector.getOptionalValue());
+           } catch (Exception e) {
+               throw new StartException(e);
+           }
+
+           TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
+           for (TrustManager trustManager : trustManagers) {
+               if (trustManager instanceof X509ExtendedTrustManager) {
+                   delegatingTrustManager.setTrustManager((X509ExtendedTrustManager) trustManager);
+                   return delegatingTrustManager;
+               }
+           }
+           throw LOGGER.noTypeFound(X509ExtendedKeyManager.class.getSimpleName());
+       };
+    }
+
+    private static ExceptionSupplier<TrustManager, Exception> createX509RevocationTrustManager(ServiceBuilder<SSLContext> serviceBuilder, OperationContext context,
+                    ModelNode model, String algorithm, String providerName, InjectedValue<Provider[]> providersInjector,
+                    InjectedValue<KeyStore> keyStoreInjector, String aliasFilter) throws OperationFailedException {
+        ModelNode crlNode = CERTIFICATE_REVOCATION_LIST.resolveModelAttribute(context, model);
+        ModelNode ocspNode = OCSP.resolveModelAttribute(context, model);
+        ModelNode multipleCrlsNode = CERTIFICATE_REVOCATION_LISTS.resolveModelAttribute(context, model);
+        boolean softFail = SOFT_FAIL.resolveModelAttribute(context, model).asBoolean();
+        boolean onlyLeafCert = ONLY_LEAF_CERT.resolveModelAttribute(context, model).asBoolean();
+        Integer maxCertPath = MAXIMUM_CERT_PATH.resolveModelAttribute(context, model).asIntOrNull();
+
+        String crlPath;
+        String crlRelativeTo;
+        InjectedValue<PathManager> pathManagerInjector = new InjectedValue<>();
+        List<CrlFile> crlFiles = new ArrayList<>();
+
+        if (crlNode.isDefined()) {
+            crlPath = PATH.resolveModelAttribute(context, crlNode).asStringOrNull();
+            crlRelativeTo = RELATIVE_TO.resolveModelAttribute(context, crlNode).asStringOrNull();
+
+            if (crlPath != null) {
+                if (crlRelativeTo != null) {
+                    serviceBuilder.addDependency(PathManagerService.SERVICE_NAME, PathManager.class, pathManagerInjector);
+                    serviceBuilder.requires(pathName(crlRelativeTo));
+                }
+                crlFiles.add(new CrlFile(crlPath, crlRelativeTo, pathManagerInjector));
+            }
+        } else if (multipleCrlsNode.isDefined()) {
+            // certificate-revocation-lists and certificate-revocation-list are mutually exclusive
+            for (ModelNode crl : multipleCrlsNode.asList()) {
+                crlPath = PATH.resolveModelAttribute(context, crl).asStringOrNull();
+                crlRelativeTo = RELATIVE_TO.resolveModelAttribute(context, crl).asStringOrNull();
+                pathManagerInjector = new InjectedValue<>();
+                if (crlPath != null) {
+                    if (crlRelativeTo != null) {
+                        serviceBuilder.addDependency(PathManagerService.SERVICE_NAME, PathManager.class, pathManagerInjector);
+                        serviceBuilder.requires(pathName(crlRelativeTo));
+                    }
+                    crlFiles.add(new CrlFile(crlPath, crlRelativeTo, pathManagerInjector));
+                }
+            }
+        }
+
+        boolean preferCrls = PREFER_CRLS.resolveModelAttribute(context, ocspNode).asBoolean(false);
+        String responder = RESPONDER.resolveModelAttribute(context, ocspNode).asStringOrNull();
+        String responderCertAlias = RESPONDER_CERTIFICATE.resolveModelAttribute(context, ocspNode).asStringOrNull();
+        String responderKeystore = RESPONDER_KEYSTORE.resolveModelAttribute(context, ocspNode).asStringOrNull();
+
+        final InjectedValue<KeyStore> responderStoreInjector = responderKeystore != null ? new InjectedValue<>() : keyStoreInjector;
+
+        if (responderKeystore != null) {
+            serviceBuilder.addDependency(context.getCapabilityServiceName(
+                    buildDynamicCapabilityName(KEY_STORE_CAPABILITY, responderKeystore), KeyStore.class),
+                    KeyStore.class, responderStoreInjector);
+        }
+
+        URI responderUri;
+        try {
+            responderUri = responder == null ? null : new URI(responder);
+        } catch (Exception e) {
+            throw new OperationFailedException(e);
+        }
+
+        X509RevocationTrustManager.Builder builder = X509RevocationTrustManager.builder();
+        builder.setResponderURI(responderUri);
+        builder.setSoftFail(softFail);
+        builder.setOnlyEndEntity(onlyLeafCert);
+        if (maxCertPath != null) {
+            builder.setMaxCertPath(maxCertPath);
+        }
+        if (model.hasDefined(CERTIFICATE_REVOCATION_LIST.getName()) || model.hasDefined(CERTIFICATE_REVOCATION_LISTS.getName())) {
+            if (!model.hasDefined(OCSP.getName())) {
+                builder.setPreferCrls(true);
+                builder.setNoFallback(true);
+            }
+        }
+        if (model.hasDefined(OCSP.getName())) {
+            builder.setResponderURI(responderUri);
+            if (!model.hasDefined(CERTIFICATE_REVOCATION_LIST.getName()) && !model.hasDefined(CERTIFICATE_REVOCATION_LISTS.getName())) {
+                builder.setPreferCrls(false);
+                builder.setNoFallback(true);
+            } else {
+                builder.setPreferCrls(preferCrls);
+            }
+        }
+        final List<CrlFile> finalCrlFiles = crlFiles;
+        return () -> {
+            TrustManagerFactory trustManagerFactory = createTrustManagerFactory(providersInjector.getOptionalValue(), providerName, algorithm);
+            KeyStore keyStore = keyStoreInjector.getOptionalValue();
+
+            if (aliasFilter != null) {
+                try {
+                    keyStore = FilteringKeyStore.filteringKeyStore(keyStore, AliasFilter.fromString(aliasFilter));
+                } catch (Exception e) {
+                    throw new StartException(e);
+                }
+            }
+
+            if (responderCertAlias != null) {
+                KeyStore responderStore = responderStoreInjector.getOptionalValue();
+                try {
+                    builder.setOcspResponderCert((X509Certificate) responderStore.getCertificate(responderCertAlias));
+                } catch (KeyStoreException e) {
+                    throw LOGGER.failedToLoadResponderCert(responderCertAlias, e);
+                }
+            }
+
+            builder.setTrustStore(keyStore);
+            builder.setTrustManagerFactory(trustManagerFactory);
+
+            if (! finalCrlFiles.isEmpty()) {
+                List<InputStream> finalCrlStreams = getCrlStreams(finalCrlFiles);
+                builder.setCrlStreams(finalCrlStreams);
+                return createReloadableX509CRLTrustManager(finalCrlFiles, builder);
+            }
+            return builder.build();
+        };
+    }
+
+    private static List<InputStream> getCrlStreams(List<CrlFile> crlFiles) throws StartException {
+        List<InputStream> crlStreams = new ArrayList<>();
+        for (CrlFile crl : crlFiles) {
+            try {
+                crlStreams.add(new FileInputStream(resolveFileLocation(crl.getCrlPath(), crl.getRelativeTo(), crl.getPathManagerInjector())));
+            } catch (FileNotFoundException e) {
+                throw LOGGER.unableToAccessCRL(e);
+            }
+        }
+        return crlStreams;
+    }
+
+    private static File resolveFileLocation(String path, String relativeTo, InjectedValue<PathManager> pathManagerInjector) {
+        final File resolvedPath;
+        if (relativeTo != null) {
+            PathManager pathManager = pathManagerInjector.getValue();
+            resolvedPath = new File(pathManager.resolveRelativePathEntry(path, relativeTo));
+        } else {
+            resolvedPath = new File(path);
+        }
+        return resolvedPath;
+    }
+
+    private static TrustManagerFactory createTrustManagerFactory(Provider[] providers, String providerName, String algorithm) throws StartException {
+        if (providers != null) {
+            for (Provider current : providers) {
+                if (providerName == null || providerName.equals(current.getName())) {
+                    try {
+                        return TrustManagerFactory.getInstance(algorithm, current);
+                    } catch (NoSuchAlgorithmException ignored) {
+                    }
+                }
+            }
+            throw LOGGER.unableToCreateManagerFactory(TrustManagerFactory.class.getSimpleName(), algorithm);
+        }
+
+        try {
+            return TrustManagerFactory.getInstance(algorithm);
+        } catch (NoSuchAlgorithmException e) {
+            throw new StartException(e);
+        }
+    }
+
+    private static TrustManager createReloadableX509CRLTrustManager(final List<CrlFile> crlFiles, final X509RevocationTrustManager.Builder builder) {
+        return new ReloadableX509ExtendedTrustManager() {
+
+            private volatile X509ExtendedTrustManager delegate = builder.build();
+            private AtomicBoolean reloading = new AtomicBoolean();
+
+            @Override
+            void reload() {
+                if (reloading.compareAndSet(false, true)) {
+                    try {
+                        builder.setCrlStreams(getCrlStreams(crlFiles));
+                        delegate = builder.build();
+                    } catch (StartException cause) {
+                        throw LOGGER.unableToReloadCRL(cause);
+                    } finally {
+                        reloading.lazySet(false);
+                    }
+                }
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] x509Certificates, String s, Socket socket) throws CertificateException {
+                delegate.checkClientTrusted(x509Certificates, s, socket);
+            }
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] x509Certificates, String s, Socket socket) throws CertificateException {
+                delegate.checkServerTrusted(x509Certificates, s, socket);
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine) throws CertificateException {
+                delegate.checkClientTrusted(x509Certificates, s, sslEngine);
+            }
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine) throws CertificateException {
+                delegate.checkServerTrusted(x509Certificates, s, sslEngine);
+            }
+
+            @Override
+            public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+                delegate.checkClientTrusted(x509Certificates, s);
+            }
+
+            @Override
+            public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+                delegate.checkServerTrusted(x509Certificates, s);
+            }
+
+            @Override
+            public X509Certificate[] getAcceptedIssuers() {
+                return delegate.getAcceptedIssuers();
+            }
+        };
+    }
+
+    private static ExceptionSupplier<KeyManager, Exception> createKeyManager(ServiceBuilder<SSLContext> serviceBuilder, OperationContext context,
+                                                                        ModelNode model, InjectedValue<Provider[]> providersInjector) throws OperationFailedException {
+        final ExceptionSupplier<CredentialSource, Exception> credentialSourceSupplier = CredentialReference.getCredentialSourceSupplier(context, CREDENTIAL_REFERENCE, model, serviceBuilder);
+        final String algorithmName = ALGORITHM.resolveModelAttribute(context, model).asStringOrNull();
+        final String aliasFilter = ALIAS_FILTER.resolveModelAttribute(context, model).asStringOrNull();
+        final String generateSelfSignedCertificateHost = GENERATE_SELF_SIGNED_CERTIFICATE_HOST.resolveModelAttribute(context, model).asStringOrNull();
+        final String providerName = PROVIDER_NAME.resolveModelAttribute(context, model).asStringOrNull();
+        
+        // final ModelNode keyStoreObject = keystoreKMObjectDefinition.resolveModelAttribute(context, model);
+        final String keyStoreName = keystoreKMDefinition.resolveModelAttribute(context, model).asStringOrNull();
+        final ModifiableKeyStoreService keyStoreService = getModifiableKeyStoreService(context, keyStoreName);
+        InjectedValue<KeyStore> keyStoreInjector = new InjectedValue<>();
+
+        if (keyStoreName != null) {
+            /* if (keyStoreObject.isDefined()) {
+                throw LOGGER.multipleKeyStoreDefinitions();
+            } */
+            serviceBuilder.addDependency(context.getCapabilityServiceName(
+                    buildDynamicCapabilityName(KEY_STORE_CAPABILITY, keyStoreName), KeyStore.class),
+                    KeyStore.class, keyStoreInjector);
+        /* } else {
+            if (!keyStoreObject.isDefined()) {
+                throw LOGGER.missingKeyStoreDefinition();
+            }
+            keyStoreInjector = createKeyStore(serviceBuilder, context, keyStoreObject, providersInjector); */
+        }
+
+        final String algorithm = algorithmName == null ? algorithmName : KeyManagerFactory.getDefaultAlgorithm();
+        DelegatingKeyManager delegatingKeyManager = new DelegatingKeyManager();
+        return () -> {
+            Provider[] providers = providersInjector.getOptionalValue();
+            KeyManagerFactory keyManagerFactory = null;
+            if (providers != null) {
+                for (Provider current : providers) {
+                    if (providerName == null || providerName.equals(current.getName())) {
+                        try {
+                            keyManagerFactory = KeyManagerFactory.getInstance(algorithm, current);
+                            break;
+                        } catch (NoSuchAlgorithmException ignored) {
+                        }
+                    }
+                }
+                if (keyManagerFactory == null)
+                    throw LOGGER.unableToCreateManagerFactory(KeyManagerFactory.class.getSimpleName(), algorithm);
+            } else {
+                try {
+                    keyManagerFactory = KeyManagerFactory.getInstance(algorithm);
+                } catch (NoSuchAlgorithmException e) {
+                    throw new StartException(e);
+                }
+            }
+
+            KeyStore keyStore = keyStoreInjector.getOptionalValue();
+            char[] password;
+            try {
+                CredentialSource cs = credentialSourceSupplier.get();
+                if (cs != null) {
+                    password = cs.getCredential(PasswordCredential.class).getPassword(ClearPassword.class).getPassword();
+                } else {
+                    // throw new StartException(LOGGER.keyStorePasswordCannotBeResolved(keyStoreName == null ? keyStoreObject.asStringOrNull() : keyStoreName));
+                    throw new StartException(LOGGER.keyStorePasswordCannotBeResolved(keyStoreName));
+                }
+                if (LOGGER.isTraceEnabled()) {
+                    LOGGER.tracef(
+                            "KeyManager supplying:  providers = %s  provider = %s  algorithm = %s  keyManagerFactory = %s  " +
+                                    "keyStoreName = %s  aliasFilter = %s  keyStore = %s  keyStoreSize = %d  password (of item) = %b",
+                            Arrays.toString(providers), providerName, algorithm, keyManagerFactory, keyStoreName, aliasFilter, keyStore, keyStore.size(), password != null
+                    );
+                }
+            } catch (StartException e) {
+                throw e;
+            } catch (Exception e) {
+                throw new StartException(e);
+            }
+            
+            if ((keyStoreService instanceof KeyStoreService) && ((KeyStoreService) keyStoreService).shouldAutoGenerateSelfSignedCertificate(generateSelfSignedCertificateHost)) {
+                LOGGER.selfSignedCertificateWillBeCreated(((KeyStoreService) keyStoreService).getResolvedAbsolutePath(), generateSelfSignedCertificateHost);
+                return new LazyDelegatingKeyManager(keyStoreService, password, keyManagerFactory,
+                        generateSelfSignedCertificateHost, aliasFilter);
+            } else {
+                try {
+                    if (initKeyManagerFactory(keyStore, delegatingKeyManager, aliasFilter, password, keyManagerFactory)) {
+                        return delegatingKeyManager;
+                    }
+                } catch (Exception e) {
+                    throw new StartException(e);
+                }
+                throw LOGGER.noTypeFound(X509ExtendedKeyManager.class.getSimpleName());
+            } 
+        };
+    }
+
+    private static OperationStepHandler init(ServiceUtil<?> managerUtil) {
+        return new ElytronRuntimeOnlyHandler() {
+            @Override
+            protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+                try {
+                    ServiceName serviceName = managerUtil.serviceName(operation);
+                    ServiceController<?> serviceContainer = null;
+                    if(serviceName.getParent().getCanonicalName().equals(KEY_MANAGER_CAPABILITY)){
+                        serviceContainer = getRequiredService(context.getServiceRegistry(false), serviceName, KeyManager.class);
+                    } else if (serviceName.getParent().getCanonicalName().equals(TRUST_MANAGER_CAPABILITY)) {
+                        serviceContainer = getRequiredService(context.getServiceRegistry(false), serviceName, TrustManager.class);
+                    } else {
+                        throw LOGGER.invalidServiceNameParent(serviceName.getParent().getCanonicalName());
+                    }
+                    serviceContainer.getService().stop(null);
+                    serviceContainer.getService().start(null);
+                } catch (Exception e) {
+                    throw new OperationFailedException(e);
+                }
+            }
+        };
+    }
+
+    private static X509ExtendedKeyManager getX509KeyManager(KeyManager keyManager) throws StartException {
+        if (keyManager == null) {
+            return null;
+        }
+        if (keyManager instanceof X509ExtendedKeyManager) {
+            X509ExtendedKeyManager x509KeyManager = (X509ExtendedKeyManager) keyManager;
+            // TODO: add FIPS
+            /* if (x509KeyManager instanceof DelegatingKeyManager && IS_FIPS.getAsBoolean()) {
+                LOGGER.trace("FIPS enabled on JVM, unwrapping KeyManager");
+                // If FIPS is enabled unwrap the KeyManager
+                x509KeyManager = ((DelegatingKeyManager) x509KeyManager).delegating.get();
+            } */
+            return x509KeyManager;
+        }
+        throw LOGGER.invalidTypeInjected(X509ExtendedKeyManager.class.getSimpleName());
+    }
+
+    private static class LazyDelegatingKeyManager extends DelegatingKeyManager {
+        private ModifiableKeyStoreService keyStoreService;
+        private char[] password;
+        private KeyManagerFactory keyManagerFactory;
+        private String generateSelfSignedCertificateHostName;
+        private String aliasFilter;
+        private volatile boolean init = false;
+
+        private LazyDelegatingKeyManager(ModifiableKeyStoreService keyStoreService, char[] password, KeyManagerFactory keyManagerFactory,
+                                         String generateSelfSignedCertificateHostName, String aliasFilter) {
+            this.keyStoreService = keyStoreService;
+            this.password = password;
+            this.keyManagerFactory = keyManagerFactory;
+            this.generateSelfSignedCertificateHostName = generateSelfSignedCertificateHostName;
+            this.aliasFilter = aliasFilter;
+        }
+
+        private void doInit() {
+            if(! init) {
+                synchronized (this) {
+                    if(! init) {
+                        try {
+                            ((KeyStoreService) keyStoreService).generateAndSaveSelfSignedCertificate(generateSelfSignedCertificateHostName, password);
+                            if (! initKeyManagerFactory(((KeyStoreService) keyStoreService).getValue(), this, aliasFilter, password, keyManagerFactory)) {
+                                throw LOGGER.noTypeFoundForLazyInitKeyManager(X509ExtendedKeyManager.class.getSimpleName());
+                            }
+                        } catch (Exception e) {
+                            throw LOGGER.failedToLazilyInitKeyManager(e);
+                        } finally {
+                            init = true;
+                        }
+                    }
+                }
+            }
+        }
+
+        @Override
+        public String[] getClientAliases(String s, Principal[] principals) {
+            doInit();
+            return super.getClientAliases(s, principals);
+        }
+
+        @Override
+        public String chooseClientAlias(String[] strings, Principal[] principals, Socket socket) {
+            doInit();
+            return super.chooseClientAlias(strings, principals, socket);
+        }
+
+        @Override
+        public String[] getServerAliases(String s, Principal[] principals) {
+            doInit();
+            return super.getServerAliases(s, principals);
+        }
+
+        @Override
+        public String chooseServerAlias(String s, Principal[] principals, Socket socket) {
+            doInit();
+            return super.chooseServerAlias(s, principals, socket);
+        }
+
+        @Override
+        public X509Certificate[] getCertificateChain(String s) {
+            doInit();
+            return super.getCertificateChain(s);
+        }
+
+        @Override
+        public PrivateKey getPrivateKey(String s) {
+            doInit();
+            return super.getPrivateKey(s);
+        }
+
+        @Override
+        public String chooseEngineClientAlias(String[] keyType, Principal[] issuers, SSLEngine engine) {
+            doInit();
+            return super.chooseEngineClientAlias(keyType, issuers, engine);
+        }
+
+        @Override
+        public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine) {
+            doInit();
+            return super.chooseEngineServerAlias(keyType, issuers, engine);
+        }
+
+    }
+
+    static boolean initKeyManagerFactory(KeyStore keyStore, DelegatingKeyManager delegating, String aliasFilter,
+                                         char[] password, KeyManagerFactory keyManagerFactory) throws Exception {
+        if (aliasFilter != null) {
+            keyStore = FilteringKeyStore.filteringKeyStore(keyStore, AliasFilter.fromString(aliasFilter));
+        }
+        keyManagerFactory.init(keyStore, password);
+        KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();
+        boolean keyManagerTypeFound = false;
+        for (KeyManager keyManager : keyManagers) {
+            if (keyManager instanceof X509ExtendedKeyManager) {
+                delegating.setKeyManager((X509ExtendedKeyManager) keyManager);
+                keyManagerTypeFound = true;
+                break;
+            }
+        }
+        return keyManagerTypeFound;
+    }
+    
+    private static X509ExtendedTrustManager getX509TrustManager(TrustManager trustManager) throws StartException {
+        if (trustManager == null) {
+            return null;
+        }
+        if (trustManager instanceof X509ExtendedTrustManager) {
+            X509ExtendedTrustManager x509TrustManager = (X509ExtendedTrustManager) trustManager;
+            // TODO: add FIPS
+            /* if (x509TrustManager instanceof DelegatingTrustManager && IS_FIPS.getAsBoolean()) {
+                ROOT_LOGGER.trace("FIPS enabled on JVM, unwrapping TrustManager");
+                x509TrustManager = ((DelegatingTrustManager)x509TrustManager).delegating.get();
+            } */
+            return x509TrustManager;
+        }
+        throw LOGGER.invalidTypeInjected(X509ExtendedTrustManager.class.getSimpleName());
+    }
+
+    private abstract static class ReloadableX509ExtendedTrustManager extends X509ExtendedTrustManager {
+        abstract void reload();
+    }
+
+    private static class DelegatingTrustManager extends X509ExtendedTrustManager {
+
+        private final AtomicReference<X509ExtendedTrustManager> delegating = new AtomicReference<>();
+
+        public void setTrustManager(X509ExtendedTrustManager trustManager){
+            delegating.set(trustManager);
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] x509Certificates, String s, Socket socket) throws CertificateException {
+            delegating.get().checkClientTrusted(x509Certificates, s, socket);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] x509Certificates, String s, Socket socket) throws CertificateException {
+            delegating.get().checkServerTrusted(x509Certificates, s, socket);
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine) throws CertificateException {
+            delegating.get().checkClientTrusted(x509Certificates, s, sslEngine);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine) throws CertificateException {
+            delegating.get().checkServerTrusted(x509Certificates, s, sslEngine);
+        }
+
+        @Override
+        public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+            delegating.get().checkClientTrusted(x509Certificates, s);
+        }
+
+        @Override
+        public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
+            delegating.get().checkServerTrusted(x509Certificates, s);
+        }
+
+        @Override
+        public X509Certificate[] getAcceptedIssuers() {
+            return delegating.get().getAcceptedIssuers();
+        }
+    }
+
+    private static class DelegatingKeyManager extends X509ExtendedKeyManager {
+
+        private final AtomicReference<X509ExtendedKeyManager> delegating = new AtomicReference<>();
+
+        private void setKeyManager(X509ExtendedKeyManager keyManager) {
+            delegating.set(keyManager);
+        }
+
+        @Override
+        public String[] getClientAliases(String s, Principal[] principals) {
+            return delegating.get().getClientAliases(s, principals);
+        }
+
+        @Override
+        public String chooseClientAlias(String[] strings, Principal[] principals, Socket socket) {
+            return delegating.get().chooseClientAlias(strings, principals, socket);
+        }
+
+        @Override
+        public String[] getServerAliases(String s, Principal[] principals) {
+            return delegating.get().getServerAliases(s, principals);
+        }
+
+        @Override
+        public String chooseServerAlias(String s, Principal[] principals, Socket socket) {
+            return delegating.get().chooseServerAlias(s, principals, socket);
+        }
+
+        @Override
+        public X509Certificate[] getCertificateChain(String s) {
+            return delegating.get().getCertificateChain(s);
+        }
+
+        @Override
+        public PrivateKey getPrivateKey(String s) {
+            return delegating.get().getPrivateKey(s);
+        }
+
+        @Override
+        public String chooseEngineClientAlias(String[] keyType, Principal[] issuers, SSLEngine engine) {
+            return delegating.get().chooseEngineClientAlias(keyType, issuers, engine);
+        }
+
+        @Override
+        public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine) {
+            return delegating.get().chooseEngineServerAlias(keyType, issuers, engine);
+        }
+    }
+
+    //TODO: correctly implement creating new key stores
+    private static ExceptionSupplier<KeyStore, Exception> createKeyStore(ServiceBuilder<?> serviceBuilder, OperationContext context,
+                                                                ModelNode model, InjectedValue<Provider[]> providersInjector) throws OperationFailedException { return null; }
+
+    // Derives dynamic name from provided attribute
+    private static <T> InjectedValue<T> addDependency(String baseName, SimpleAttributeDefinition attribute,
+                                                      Class<T> type, ServiceBuilder<SSLContext> serviceBuilder, OperationContext context, ModelNode model) throws OperationFailedException {
+        String dynamicNameElement = attribute.resolveModelAttribute(context, model).asStringOrNull();
+        InjectedValue<T> injectedValue = new InjectedValue<>();
+        if (dynamicNameElement != null) {
+            serviceBuilder.addDependency(context.getCapabilityServiceName(
+                    buildDynamicCapabilityName(baseName, dynamicNameElement), type),
+                    type, injectedValue);
+        }
+        return injectedValue;
+    }
+
+    private static Provider[] filterProviders(Provider[] all, String provider) {
+        if (provider == null || all == null) return all;
+        List<Provider> list = new ArrayList<>();
+        for (Provider current : all) {
+            if (provider.equals(current.getName())) {
+                list.add(current);
+            }
+        }
+        return list.toArray(new Provider[0]);
+    }
+
+    abstract static class SSLContextRuntimeHandler extends ElytronRuntimeOnlyHandler {
+        @Override
+        protected void executeRuntimeStep(OperationContext context, ModelNode operation) throws OperationFailedException {
+            ServiceName serviceName = getSSLContextServiceUtil().serviceName(operation);
+
+            ServiceController<SSLContext> serviceController = getRequiredService(context.getServiceRegistry(false), serviceName, SSLContext.class);
+            State serviceState;
+            if ((serviceState = serviceController.getState()) != State.UP) {
+                throw LOGGER.requiredServiceNotUp(serviceName, serviceState);
+            }
+
+            performRuntime(context.getResult(), operation, serviceController.getService().getValue());
+        }
+
+        protected abstract void performRuntime(ModelNode result, ModelNode operation, SSLContext sslContext) throws OperationFailedException;
+
+        protected abstract ServiceUtil<SSLContext> getSSLContextServiceUtil();
+    }
+
+    // TODO: add FIPS
+    /* private static BooleanSupplier getFipsSupplier() {
+        try {
+            final Class<?> providerClazz = SSLDefinitions.class.getClassLoader().loadClass("com.sun.net.ssl.internal.ssl.Provider");
+            final Method isFipsMethod = providerClazz.getMethod("isFIPS", new Class[0]);
+
+            Object isFips;
+            try {
+                isFips = isFipsMethod.invoke(null, new Object[0]);
+                if ((isFips instanceof Boolean)) {
+                    return () -> (boolean) isFips;
+                } else {
+                    return () -> false;
+                }
+            } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException e) {
+                LOGGER.trace("Unable to invoke com.sun.net.ssl.internal.ssl.Provider.isFIPS() method.", e);
+                return () -> false;
+            }
+        } catch (ClassNotFoundException | NoSuchMethodException | SecurityException e) {
+            LOGGER.trace("Unable to find com.sun.net.ssl.internal.ssl.Provider.isFIPS() method.", e);
+        }
+
+        return () -> new SecureRandom().getProvider().getName().toLowerCase().contains("fips");
+    } */
+
+    static ModifiableKeyStoreService getModifiableKeyStoreService(OperationContext context, String keyStoreName) {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+        RuntimeCapability<Void> runtimeCapability = KEY_STORE_RUNTIME_CAPABILITY.fromBaseCapability(keyStoreName);
+        ServiceName serviceName = runtimeCapability.getCapabilityServiceName();
+        ServiceController<KeyStore> serviceContainer = getRequiredService(serviceRegistry, serviceName, KeyStore.class);
+        return (ModifiableKeyStoreService) serviceContainer.getService();
+    }
+
+    /**
+     * CrlFile contains the necessary information to create a
+     * CRL File Input Stream
+     */
+    static class CrlFile {
+        private final String crlPath;
+        private final String relativeTo;
+        private final InjectedValue<PathManager> pathManagerInjector;
+
+        public CrlFile(final String crlPath, final String relativeTo, InjectedValue<PathManager> pathManagerInjector) {
+            this.crlPath = crlPath;
+            this.relativeTo = relativeTo;
+            this.pathManagerInjector = pathManagerInjector;
+        }
+
+        public String getCrlPath() {
+            return crlPath;
+        }
+
+        public String getRelativeTo() {
+            return relativeTo;
+        }
+
+        public InjectedValue<PathManager> getPathManagerInjector() {
+            return pathManagerInjector;
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextDependencyProcessor.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextDependencyProcessor.java
new file mode 100644
index 0000000..aac965a
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextDependencyProcessor.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2018 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import javax.net.ssl.SSLContext;
+
+import org.jboss.as.server.deployment.DeploymentPhaseContext;
+import org.jboss.as.server.deployment.DeploymentUnitProcessingException;
+import org.jboss.as.server.deployment.DeploymentUnitProcessor;
+
+/**
+ * A simple {@link DeploymentUnitProcessor} to ensure deployments wait until the default {@link SSLContext} has been registered.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class SSLContextDependencyProcessor implements DeploymentUnitProcessor {
+
+    /**
+     * @see org.jboss.as.server.deployment.DeploymentUnitProcessor#deploy(org.jboss.as.server.deployment.DeploymentPhaseContext)
+     */
+    @Override
+    public void deploy(DeploymentPhaseContext phaseContext) throws DeploymentUnitProcessingException {
+        phaseContext.addDeploymentDependency(DefaultSSLContextService.SERVICE_NAME, ElytronTlsExtension.SSL_CONTEXT_KEY);
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextParsers.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextParsers.java
new file mode 100644
index 0000000..79a1be2
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextParsers.java
@@ -0,0 +1,73 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2022 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Constants.CLIENT_SSL_CONTEXT;
+import static org.wildfly.extension.elytron.tls.Constants.CLIENT_SSL_CONTEXTS;
+import static org.wildfly.extension.elytron.tls.Constants.SERVER_SSL_CONTEXT;
+import static org.wildfly.extension.elytron.tls.Constants.SERVER_SSL_CONTEXTS;
+
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.PersistentResourceXMLDescription;
+
+/**
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+class SSLContextParsers {
+
+    final PersistentResourceXMLDescription clientSslContextParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(CLIENT_SSL_CONTEXT))
+            .setXmlWrapperElement(CLIENT_SSL_CONTEXTS)
+            .addAttribute(SSLContextDefinitions.CIPHER_SUITE_FILTER)
+            .addAttribute(SSLContextDefinitions.CIPHER_SUITE_NAMES)
+            .addAttribute(SSLContextDefinitions.PROTOCOLS)
+            .addAttribute(SSLContextDefinitions.WANT_CLIENT_AUTH)
+            .addAttribute(SSLContextDefinitions.NEED_CLIENT_AUTH)
+            .addAttribute(SSLContextDefinitions.AUTHENTICATION_OPTIONAL)
+            .addAttribute(SSLContextDefinitions.USE_CIPHER_SUITES_ORDER)
+            .addAttribute(SSLContextDefinitions.MAXIMUM_SESSION_CACHE_SIZE)
+            .addAttribute(SSLContextDefinitions.SESSION_TIMEOUT)
+            .addAttribute(SSLContextDefinitions.WRAP)
+            .addAttribute(SSLContextDefinitions.KEY_MANAGER)
+        //     .addAttribute(SSLContextDefinitions.KEY_MANAGER_OBJECT)
+            .addAttribute(SSLContextDefinitions.TRUST_MANAGER)
+        //     .addAttribute(SSLContextDefinitions.TRUST_MANAGER_OBJECT)
+            .addAttribute(SSLContextDefinitions.PROVIDERS)
+            .addAttribute(SSLContextDefinitions.PROVIDER_NAME)
+            .build();
+
+    final PersistentResourceXMLDescription serverSslContextParser_1_0 = PersistentResourceXMLDescription.builder(PathElement.pathElement(SERVER_SSL_CONTEXT))
+            .setXmlWrapperElement(SERVER_SSL_CONTEXTS)
+            .addAttribute(SSLContextDefinitions.CIPHER_SUITE_FILTER)
+            .addAttribute(SSLContextDefinitions.CIPHER_SUITE_NAMES)
+            .addAttribute(SSLContextDefinitions.PROTOCOLS)
+            .addAttribute(SSLContextDefinitions.WANT_CLIENT_AUTH)
+            .addAttribute(SSLContextDefinitions.NEED_CLIENT_AUTH)
+            .addAttribute(SSLContextDefinitions.AUTHENTICATION_OPTIONAL)
+            .addAttribute(SSLContextDefinitions.USE_CIPHER_SUITES_ORDER)
+            .addAttribute(SSLContextDefinitions.MAXIMUM_SESSION_CACHE_SIZE)
+            .addAttribute(SSLContextDefinitions.SESSION_TIMEOUT)
+            .addAttribute(SSLContextDefinitions.WRAP)
+            .addAttribute(SSLContextDefinitions.KEY_MANAGER)
+        //     .addAttribute(SSLContextDefinitions.KEY_MANAGER_OBJECT)
+            .addAttribute(SSLContextDefinitions.TRUST_MANAGER)
+        //     .addAttribute(SSLContextDefinitions.TRUST_MANAGER_OBJECT)
+            .addAttribute(SSLContextDefinitions.PROVIDERS)
+            .addAttribute(SSLContextDefinitions.PROVIDER_NAME)
+            .build();
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextResource.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextResource.java
new file mode 100644
index 0000000..d5f3fc0
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLContextResource.java
@@ -0,0 +1,161 @@
+ /*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSessionContext;
+
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.registry.DelegatingResource;
+import org.jboss.as.controller.registry.PlaceholderResource;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.State;
+import org.wildfly.common.iteration.ByteIterator;
+
+/**
+ * A {@link Resource} to represent a server-ssl-context/client-ssl-context, the majority is actually model
+ * but child resources are a runtime concern.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class SSLContextResource extends DelegatingResource {
+
+    private ServiceController<SSLContext> sslContextServiceController;
+    private boolean server;
+
+    SSLContextResource(Resource delegate, boolean server) {
+        super(delegate);
+        this.server = server;
+    }
+
+    /**
+     * Set the {@link ServiceController<SSLContext>} for the {@link SSLContext} represented by this {@link Resource}.
+     *
+     * @param sslContextServiceController The {@link ServiceController<SSLContext>} to obtain the {@link SSLContext} from.
+     */
+    void setSSLContextServiceController(ServiceController<SSLContext> sslContextServiceController) {
+        this.sslContextServiceController = sslContextServiceController;
+    }
+
+    @Override
+    public Set<String> getChildTypes() {
+        if (hasActiveSessions()) {
+            return Collections.singleton(Constants.SSL_SESSION);
+        }
+        return Collections.emptySet();
+    }
+
+    @Override
+    public boolean hasChildren(String childType) {
+        return Constants.SSL_SESSION.equals(childType) && hasActiveSessions();
+    }
+
+    @Override
+    public boolean hasChild(PathElement element) {
+        SSLContext sslContext;
+        if (Constants.SSL_SESSION.equals(element.getKey()) && (sslContext = getSSLContext(sslContextServiceController)) != null) {
+            byte[] sessionId = ByteIterator.ofBytes(element.getValue().getBytes(StandardCharsets.UTF_8)).asUtf8String().hexDecode().drain();
+            SSLSessionContext sslSessionContext = server ? sslContext.getServerSessionContext() : sslContext.getClientSessionContext();
+            return sslSessionContext.getSession(sessionId) != null;
+        }
+        return false;
+    }
+
+    @Override
+    public Resource getChild(PathElement element) {
+        return hasChild(element) ? PlaceholderResource.INSTANCE : null;
+    }
+
+    @Override
+    public Resource requireChild(PathElement element) {
+        Resource resource = getChild(element);
+        if (resource == null) {
+            throw new NoSuchResourceException(element);
+        }
+        return resource;
+    }
+
+    @Override
+    public Set<String> getChildrenNames(String childType) {
+        SSLContext sslContext;
+        if (Constants.SSL_SESSION.equals(childType) && (sslContext = getSSLContext(sslContextServiceController)) != null) {
+            SSLSessionContext sslSessionContext = server ? sslContext.getServerSessionContext() : sslContext.getClientSessionContext();
+            Set<String> set = new HashSet<>();
+            for (byte[] b : Collections.list(sslSessionContext.getIds())) {
+                String s = ByteIterator.ofBytes(b).hexEncode(true).drainToString();
+                set.add(s);
+            }
+            return set;
+        }
+        return Collections.emptySet();
+    }
+
+    @Override
+    public Set<ResourceEntry> getChildren(String childType) {
+        Set<ResourceEntry> set = new HashSet<>();
+        for (String s : getChildrenNames(childType)) {
+            PlaceholderResource.PlaceholderResourceEntry placeholderResourceEntry = new PlaceholderResource.PlaceholderResourceEntry(Constants.SSL_SESSION, s);
+            set.add(placeholderResourceEntry);
+        }
+        return set;
+    }
+
+    @Override
+    public Resource navigate(PathAddress address) {
+        return Resource.Tools.navigate(this, address);
+    }
+
+    @Override
+    public Resource clone() {
+        SSLContextResource sslContextResource = new SSLContextResource(super.clone(), server);
+        sslContextResource.setSSLContextServiceController(sslContextServiceController);
+        return sslContextResource;
+    }
+
+    /**
+     * Check if the {@link SSLContext} has any active sessions.
+     *
+     * @return {@code true} if the {@link SSLContext} is available and has at least one session, {@code false} otherwise.
+     */
+    private boolean hasActiveSessions() {
+        final SSLContext sslContext = getSSLContext(sslContextServiceController);
+        if (sslContext == null) return false;
+        SSLSessionContext sslSessionContext = server ? sslContext.getServerSessionContext() : sslContext.getClientSessionContext();
+        return sslSessionContext.getIds().hasMoreElements();
+    }
+
+    /**
+     * Get the {@link SSLContext} represented by this {@link Resource} or {@code null} if it is not currently available.
+     *
+     * @return The {@link SSLContext} represented by this {@link Resource} or {@code null} if it is not currently available.
+     */
+    static SSLContext getSSLContext(ServiceController<SSLContext> sslContextServiceController) {
+        if (sslContextServiceController == null || sslContextServiceController.getState() != State.UP) {
+            return null;
+        } else {
+            return sslContextServiceController.getValue();
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLSessionDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLSessionDefinition.java
new file mode 100644
index 0000000..346f731
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SSLSessionDefinition.java
@@ -0,0 +1,209 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2016 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP_ADDR;
+import static org.wildfly.extension.elytron.tls.CertificateChainAttributeDefinitions.getNamedCertificateList;
+import static org.wildfly.extension.elytron.tls.CertificateChainAttributeDefinitions.writeCertificates;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.ISO_8601_FORMAT;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.nio.charset.StandardCharsets;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.cert.CertificateEncodingException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.function.BiConsumer;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSessionContext;
+
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.descriptions.ResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.wildfly.common.iteration.ByteIterator;
+
+// TODO: merge into SSLContextDefintions?
+
+/**
+ * A resource definition to represent a currently established SSL session.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class SSLSessionDefinition extends SimpleResourceDefinition {
+
+    private static final SimpleAttributeDefinition APPLICATION_BUFFER_SIZE = new SimpleAttributeDefinitionBuilder(Constants.APPLICATION_BUFFER_SIZE, ModelType.INT)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition CIPHER_SUITE = new SimpleAttributeDefinitionBuilder(Constants.CIPHER_SUITE, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition CREATION_TIME = new SimpleAttributeDefinitionBuilder(Constants.CREATION_TIME, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition LAST_ACCESSED_TIME = new SimpleAttributeDefinitionBuilder(Constants.LAST_ACCESSED_TIME, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition LOCAL_PRINCIPAL = new SimpleAttributeDefinitionBuilder(Constants.LOCAL_PRINCIPAL, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition PACKET_BUFFER_SIZE = new SimpleAttributeDefinitionBuilder(Constants.PACKET_BUFFER_SIZE, ModelType.INT)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition PEER_HOST = new SimpleAttributeDefinitionBuilder(Constants.PEER_HOST, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition PEER_PORT = new SimpleAttributeDefinitionBuilder(Constants.PEER_PORT, ModelType.INT)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition PEER_PRINCIPAL = new SimpleAttributeDefinitionBuilder(Constants.PEER_PRINCIPAL, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition PROTOCOL = new SimpleAttributeDefinitionBuilder(Constants.PROTOCOL, ModelType.STRING)
+            .setStorageRuntime()
+            .build();
+
+    private static final SimpleAttributeDefinition VALID = new SimpleAttributeDefinitionBuilder(Constants.VALID, ModelType.BOOLEAN)
+            .setStorageRuntime()
+            .build();
+
+    private static final ResourceDescriptionResolver RESOURCE_DESCRIPTION_RESOLVER = ElytronTlsExtension.getResourceDescriptionResolver(Constants.SERVER_SSL_CONTEXT, Constants.SSL_SESSION);
+
+
+    private static final SimpleOperationDefinition INVALIDATE = new SimpleOperationDefinitionBuilder(Constants.INVALIDATE, RESOURCE_DESCRIPTION_RESOLVER)
+            .build();
+
+    private boolean server;
+
+    SSLSessionDefinition(boolean server) {
+        super(new Parameters(PathElement.pathElement(Constants.SSL_SESSION), RESOURCE_DESCRIPTION_RESOLVER)
+            .setAddRestartLevel(OperationEntry.Flag.RESTART_NONE)
+            .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setRuntime());
+        this.server = server;
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+        resourceRegistration.registerReadOnlyAttribute(APPLICATION_BUFFER_SIZE, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.getApplicationBufferSize())));
+        resourceRegistration.registerReadOnlyAttribute(CIPHER_SUITE, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.getCipherSuite())));
+        resourceRegistration.registerReadOnlyAttribute(CREATION_TIME, new SSLSessionRuntimeHandler(
+                (ModelNode r, SSLSession s) -> r.set(new SimpleDateFormat(ISO_8601_FORMAT).format(new Date(s.getCreationTime())))));
+        resourceRegistration.registerReadOnlyAttribute(LAST_ACCESSED_TIME, new SSLSessionRuntimeHandler(
+                (ModelNode r, SSLSession s) -> r.set(new SimpleDateFormat(ISO_8601_FORMAT).format(new Date(s.getLastAccessedTime())))));
+        resourceRegistration.registerReadOnlyAttribute(getNamedCertificateList(Constants.LOCAL_CERTIFICATES),
+                new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> {
+                    try {
+                        writeCertificates(r, s.getLocalCertificates());
+                    } catch (CertificateEncodingException | NoSuchAlgorithmException ignored) {
+                    }
+                }));
+        resourceRegistration.registerReadOnlyAttribute(LOCAL_PRINCIPAL, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> {
+                    Principal p = s.getLocalPrincipal();
+                    if (p != null) {
+                        r.set(p.toString());
+                    }
+        }));
+        resourceRegistration.registerReadOnlyAttribute(PACKET_BUFFER_SIZE, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.getPacketBufferSize())));
+        resourceRegistration.registerReadOnlyAttribute(getNamedCertificateList(Constants.PEER_CERTIFICATES),
+                new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> {
+                    try {
+                        writeCertificates(r, s.getPeerCertificates());
+                    } catch (CertificateEncodingException | NoSuchAlgorithmException | SSLPeerUnverifiedException ignored) {
+                    }
+                }));
+        resourceRegistration.registerReadOnlyAttribute(PEER_HOST, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.getPeerHost())));
+        resourceRegistration.registerReadOnlyAttribute(PEER_PORT, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.getPeerPort())));
+        resourceRegistration.registerReadOnlyAttribute(PEER_PRINCIPAL, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> {
+                    try {
+                        Principal p = s.getPeerPrincipal();
+                        if (p != null) {
+                            r.set(p.toString());
+                        }
+                    } catch (SSLPeerUnverifiedException ignored) {}
+        }));
+        resourceRegistration.registerReadOnlyAttribute(PROTOCOL, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.getProtocol())));
+        resourceRegistration.registerReadOnlyAttribute(VALID, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> r.set(s.isValid())));
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration);
+        resourceRegistration.registerOperationHandler(INVALIDATE, new SSLSessionRuntimeHandler((ModelNode r, SSLSession s) -> s.invalidate()));
+    }
+
+    class SSLSessionRuntimeHandler extends SSLContextDefinitions.SSLContextRuntimeHandler {
+
+        private final BiConsumer<ModelNode, SSLSession> biConsumer;
+
+        SSLSessionRuntimeHandler(BiConsumer<ModelNode, SSLSession> biConsumer) {
+            this.biConsumer = biConsumer;
+        }
+        @Override
+        protected void performRuntime(ModelNode result, ModelNode operation, SSLContext sslContext) throws OperationFailedException {
+            SSLSessionContext sslSessionContext = server ? sslContext.getServerSessionContext() : sslContext.getClientSessionContext();
+            SSLSession sslSession = sslSessionContext.getSession(sessionId(operation));
+            if (sslSession != null) {
+                performRuntime(result, operation, sslSession);
+            }
+        }
+
+        protected void performRuntime(ModelNode result, ModelNode operation, SSLSession sslSession) throws OperationFailedException {
+            biConsumer.accept(result, sslSession);
+        }
+
+        @Override
+        protected ServiceUtil<SSLContext> getSSLContextServiceUtil() {
+            return server ? SSLContextDefinitions.SERVER_SERVICE_UTIL : SSLContextDefinitions.CLIENT_SERVICE_UTIL;
+        }
+    }
+
+    private static byte[] sessionId(ModelNode operation) {
+        PathAddress pa = PathAddress.pathAddress(operation.require(OP_ADDR));
+        for (int i = pa.size() - 1; i > 0; i--) {
+            PathElement pe = pa.getElement(i);
+            if (Constants.SSL_SESSION.equals(pe.getKey())) {
+                return ByteIterator.ofBytes(pe.getValue().getBytes(StandardCharsets.UTF_8)).asUtf8String().hexDecode().drain();
+            }
+        }
+
+        throw LOGGER.operationAddressMissingKey(Constants.SSL_SESSION);
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecretKeyCredentialStoreDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecretKeyCredentialStoreDefinition.java
new file mode 100644
index 0000000..eb5f49c
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecretKeyCredentialStoreDefinition.java
@@ -0,0 +1,320 @@
+/*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_API_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.Capabilities.CREDENTIAL_STORE_RUNTIME_CAPABILITY;
+import static org.wildfly.extension.elytron.tls.ElytronTlsExtension.isServerOrHostController;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.RELATIVE_TO;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathName;
+import static org.wildfly.extension.elytron.tls.FileAttributeDefinitions.pathResolver;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+import static org.wildfly.security.encryption.SecretKeyUtil.generateSecretKey;
+
+import java.io.File;
+import java.security.GeneralSecurityException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Supplier;
+
+import javax.crypto.SecretKey;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.CapabilityServiceBuilder;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.as.controller.SimpleOperationDefinition;
+import org.jboss.as.controller.SimpleOperationDefinitionBuilder;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.descriptions.StandardResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+import org.jboss.as.controller.services.path.PathManagerService;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.StartException;
+import org.wildfly.common.function.ExceptionRunnable;
+import org.wildfly.common.function.ExceptionSupplier;
+import org.wildfly.extension.elytron.tls.FileAttributeDefinitions.PathResolver;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.credential.store.CredentialStore;
+
+/**
+ * A resource definitions for a simple credential store which just supports the storage of
+ * {@link SecretKey} instances stored in the clear.
+ *
+ * Whilst the keys are stored in the clear this resource allows administrators to bootstrap in
+ * an initial key which can be used to encrypt passwords defined within the management model.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class SecretKeyCredentialStoreDefinition extends AbstractCredentialStoreResourceDefinition {
+
+    private static final String CREDENTIAL_STORE_TYPE = "PropertiesCredentialStore";
+
+    static final SimpleAttributeDefinition PATH =
+            new SimpleAttributeDefinitionBuilder(Constants.PATH, FileAttributeDefinitions.PATH)
+                    .setAttributeGroup(Constants.FILE)
+                    .setRequired(true)
+                    .setRestartAllServices()
+                    .build();
+
+    static final SimpleAttributeDefinition CREATE = new SimpleAttributeDefinitionBuilder(Constants.CREATE, ModelType.BOOLEAN, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setDefaultValue(ModelNode.TRUE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition POPULATE = new SimpleAttributeDefinitionBuilder(Constants.POPULATE, ModelType.BOOLEAN, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setDefaultValue(ModelNode.TRUE)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition KEY_SIZE = new SimpleAttributeDefinitionBuilder(Constants.KEY_SIZE, ModelType.INT, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setDefaultValue(new ModelNode(256))
+            .setAllowedValues(128, 192, 256)
+            .setRestartAllServices()
+            .build();
+
+    static final SimpleAttributeDefinition DEFAULT_ALIAS = new SimpleAttributeDefinitionBuilder(Constants.DEFAULT_ALIAS, ModelType.STRING, true)
+            .setAttributeGroup(Constants.IMPLEMENTATION)
+            .setAllowExpression(true)
+            .setDefaultValue(new ModelNode("key"))
+            .setRestartAllServices()
+            .build();
+
+    // Resource Resolver
+    private static final StandardResourceDescriptionResolver RESOURCE_RESOLVER = ElytronTlsExtension.getResourceDescriptionResolver(Constants.SECRET_KEY_CREDENTIAL_STORE);
+
+    static final AttributeDefinition[] CONFIG_ATTRIBUTES = new AttributeDefinition[] { RELATIVE_TO, PATH, CREATE, POPULATE, KEY_SIZE, DEFAULT_ALIAS };
+
+    private static final AbstractAddStepHandler ADD = new SecretKeyCredentialStoreAddHandler();
+    private static final OperationStepHandler REMOVE = new TrivialCapabilityServiceRemoveHandler(ADD, CREDENTIAL_STORE_RUNTIME_CAPABILITY);
+
+    // Operation Definitions and Parameters
+
+    private static final SimpleOperationDefinition REMOVE_ALIAS = new SimpleOperationDefinitionBuilder(Constants.REMOVE_ALIAS, OPERATION_RESOLVER)
+            .setParameters(ALIAS)
+            .setRuntimeOnly()
+            .build();
+
+    private static final SimpleAttributeDefinition KEY_SIZE_PARAMETER = new SimpleAttributeDefinitionBuilder(Constants.KEY_SIZE, ModelType.INT, true)
+            .setAllowExpression(true)
+            .setAllowedValues(128, 192, 256)
+            .setRestartAllServices()
+            .build();
+
+    private static final SimpleOperationDefinition GENERATE_SECRET_KEY = new SimpleOperationDefinitionBuilder(Constants.GENERATE_SECRET_KEY, OPERATION_RESOLVER)
+            .setParameters(ALIAS, KEY_SIZE_PARAMETER)
+            .setRuntimeOnly()
+            .build();
+
+    SecretKeyCredentialStoreDefinition() {
+        super(new SimpleResourceDefinition.Parameters(PathElement.pathElement(Constants.SECRET_KEY_CREDENTIAL_STORE), RESOURCE_RESOLVER)
+                .setAddHandler(ADD)
+                .setRemoveHandler(REMOVE)
+                .setAddRestartLevel(OperationEntry.Flag.RESTART_NONE)
+                .setRemoveRestartLevel(OperationEntry.Flag.RESTART_NONE)
+                .setCapabilities(CREDENTIAL_STORE_RUNTIME_CAPABILITY)
+        );
+    }
+
+    @Override
+    protected AttributeDefinition[] getAttributeDefinitions() {
+        return CONFIG_ATTRIBUTES;
+    }
+
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration); // Always needed to register add / remove.
+
+        boolean isServerOrHostController = isServerOrHostController(resourceRegistration);
+        Map<String, CredentialStoreRuntimeOperation> operationMethods = new HashMap<>();
+
+        operationMethods.put(Constants.READ_ALIASES, this::readAliasesOperation);
+        if (isServerOrHostController) {
+            operationMethods.put(Constants.REMOVE_ALIAS, this::removeAliasOperation);
+            operationMethods.put(Constants.EXPORT_SECRET_KEY, this::exportSecretKeyOperation);
+            operationMethods.put(Constants.GENERATE_SECRET_KEY, this::generateSecretKeyOperation);
+            operationMethods.put(Constants.IMPORT_SECRET_KEY, this::importSecretKeyOperation);
+        }
+
+        OperationStepHandler operationHandler = new CredentialStoreRuntimeHandler(operationMethods);
+        resourceRegistration.registerOperationHandler(READ_ALIASES, operationHandler);
+        if (isServerOrHostController) {
+            resourceRegistration.registerOperationHandler(REMOVE_ALIAS, operationHandler);
+            resourceRegistration.registerOperationHandler(EXPORT_SECRET_KEY, operationHandler);
+            resourceRegistration.registerOperationHandler(GENERATE_SECRET_KEY, operationHandler);
+            resourceRegistration.registerOperationHandler(IMPORT_SECRET_KEY, operationHandler);
+            resourceRegistration.registerOperationHandler(RELOAD, RELOAD_HANDLER);
+        }
+    }
+
+    /*
+     * Operation Handler Methods.
+     */
+
+    void removeAliasOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        super.removeAliasOperation(context, operation, credentialStore, SecretKeyCredential.class);
+    }
+
+    protected void generateSecretKeyOperation(OperationContext context, ModelNode operation, CredentialStore credentialStore) throws OperationFailedException {
+        final int keySize;
+        ModelNode keySizeModel = KEY_SIZE_PARAMETER.resolveModelAttribute(context, operation);
+        if (keySizeModel.isDefined()) {
+            keySize = keySizeModel.asInt();
+        } else {
+            ModelNode resourceModel = context.readResource(PathAddress.EMPTY_ADDRESS).getModel();
+            keySize = KEY_SIZE.resolveModelAttribute(context, resourceModel).asInt();
+        }
+
+        generateSecretKeyOperation(context, operation, credentialStore, keySize);
+    }
+
+    static class SecretKeyCredentialStoreAddHandler extends DoohickeyAddHandler<CredentialStore> {
+
+        private SecretKeyCredentialStoreAddHandler() {
+            super(CREDENTIAL_STORE_RUNTIME_CAPABILITY, CONFIG_ATTRIBUTES, CREDENTIAL_STORE_API_CAPABILITY);
+        }
+
+        @Override
+        protected ElytronDoohickey<CredentialStore> createDoohickey(PathAddress resourceAddress) {
+            return new SecretKeyDoohickey(resourceAddress);
+        }
+
+    }
+
+    static class SecretKeyDoohickey extends AbstractCredentialStoreDoohickey {
+
+        private volatile String relativeTo;
+        private volatile String path;
+        private volatile boolean create;
+        private volatile boolean populate;
+        private volatile int keySize;
+        private volatile String defaultAlias;
+
+        private volatile ExceptionRunnable<GeneralSecurityException> reloader;
+
+        protected SecretKeyDoohickey(PathAddress resourceAddress) {
+            super(resourceAddress);
+        }
+
+        @Override
+        protected void resolveRuntime(ModelNode model, OperationContext context) throws OperationFailedException {
+            relativeTo = RELATIVE_TO.resolveModelAttribute(context, model).asStringOrNull();
+            path = PATH.resolveModelAttribute(context, model).asString();
+            create = CREATE.resolveModelAttribute(context, model).asBoolean();
+            populate = POPULATE.resolveModelAttribute(context, model).asBoolean();
+            keySize = KEY_SIZE.resolveModelAttribute(context, model).asInt();
+            defaultAlias = DEFAULT_ALIAS.resolveModelAttribute(context, model).asString();
+        }
+
+        @Override
+        protected ExceptionSupplier<CredentialStore, StartException> prepareServiceSupplier(OperationContext context,
+                CapabilityServiceBuilder<?> serviceBuilder) {
+
+            final Supplier<PathManagerService> pathManager;
+            if (relativeTo != null) {
+                pathManager = serviceBuilder.requires(PathManagerService.SERVICE_NAME);
+                serviceBuilder.requires(pathName(relativeTo));
+            } else {
+                pathManager = null;
+            }
+
+            return new ExceptionSupplier<CredentialStore, StartException>() {
+
+                @Override
+                public CredentialStore get() throws StartException {
+                    try {
+                        PathResolver pathResolver = pathResolver();
+                        pathResolver.path(path);
+                        if (relativeTo != null) {
+                            pathResolver.relativeTo(relativeTo, pathManager.get());
+                        }
+                        File resolved = pathResolver.resolve();
+                        pathResolver.clear();
+
+                        return createCredentialStore(resolved);
+                    } catch (GeneralSecurityException e) {
+                        throw LOGGER.unableToStartService(e);
+                    }
+                }
+            };
+        }
+
+        @Override
+        protected CredentialStore createImmediately(OperationContext foreignContext) throws OperationFailedException {
+            try {
+                return createCredentialStore(resolveRelativeToImmediately(path, relativeTo, foreignContext));
+            } catch (GeneralSecurityException e) {
+                throw LOGGER.unableToCreateCredentialStoreImmediately(e);
+            }
+        }
+
+        private CredentialStore createCredentialStore(final File resolved) throws GeneralSecurityException {
+            CredentialStore credentialStore = CredentialStore.getInstance(CREDENTIAL_STORE_TYPE);
+
+            final Map<String, String> configuration = new HashMap<>();
+            configuration.put(Constants.LOCATION, resolved.getAbsolutePath());
+            if (create) {
+                configuration.put(Constants.CREATE, Boolean.TRUE.toString());
+            }
+
+            reloader = new ExceptionRunnable<GeneralSecurityException>() {
+
+                @Override
+                public void run() throws GeneralSecurityException {
+                    credentialStore.initialize(configuration);
+                }
+            };
+            reloader.run();
+
+            if (populate && !credentialStore.getAliases().contains(defaultAlias)) {
+                SecretKey secretKey = generateSecretKey(keySize);
+                SecretKeyCredential credential = new SecretKeyCredential(secretKey);
+
+                credentialStore.store(defaultAlias, credential);
+                credentialStore.flush();
+            }
+
+            return credentialStore;
+        }
+
+        @Override
+        protected void reload(OperationContext context) throws GeneralSecurityException, OperationFailedException {
+            if (reloader != null) {
+                reloader.run();
+            } else {
+                super.apply(context);
+            }
+        }
+
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityActions.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityActions.java
new file mode 100644
index 0000000..b3bc599
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityActions.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedExceptionAction;
+
+import org.wildfly.security.manager.WildFlySecurityManager;
+
+/**
+ * Wrapper around {@link AccessController#doPrivileged(PrivilegedAction)} for the 'org.wildfly.extension.elytron.tls.subsystem' package.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+final class SecurityActions {
+
+    static <T> T doPrivileged(final PrivilegedAction<T> action) {
+        return WildFlySecurityManager.isChecking() ? AccessController.doPrivileged(action) : action.run();
+    }
+
+    static <T> T doPrivileged(final PrivilegedExceptionAction<T> action) throws Exception {
+        return WildFlySecurityManager.isChecking() ? AccessController.doPrivileged(action) : action.run();
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityPropertiesWriteHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityPropertiesWriteHandler.java
new file mode 100644
index 0000000..9d4349d
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityPropertiesWriteHandler.java
@@ -0,0 +1,132 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2017, Red Hat, Inc., and individual contributors as indicated
+ * by the @authors tag.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.jboss.as.controller.AbstractWriteAttributeHandler;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.PropertiesAttributeDefinition;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceRegistry;
+
+/**
+ * @author Tomaz Cerar (c) 2017 Red Hat Inc.
+ */
+class SecurityPropertiesWriteHandler extends AbstractWriteAttributeHandler {
+    private final PropertiesAttributeDefinition securityProperties;
+
+    SecurityPropertiesWriteHandler(PropertiesAttributeDefinition attributeDefinition) {
+        super(attributeDefinition);
+        securityProperties = attributeDefinition;
+    }
+
+    private static SecurityPropertyService getService(OperationContext context) {
+        ServiceRegistry serviceRegistry = context.getServiceRegistry(true);
+
+        ServiceController<?> service = serviceRegistry.getService(SecurityPropertyService.SERVICE_NAME);
+        if (service != null) {
+            Object serviceImplementation = service.getService();
+            if (serviceImplementation != null && serviceImplementation instanceof SecurityPropertyService) {
+                return (SecurityPropertyService) serviceImplementation;
+            }
+        }
+
+        // Again should not be reachable.
+        throw new IllegalStateException("Requires service not available or wrong type.");
+    }
+
+    private static void setProperty(OperationContext context, String name, String value) {
+        getService(context).setProperty(name, value);
+    }
+
+    private static void removeProperty(OperationContext context, String name) {
+        getService(context).removeProperty(name);
+    }
+
+    @Override
+    protected boolean applyUpdateToRuntime(OperationContext context, ModelNode operation, String attributeName, ModelNode resolvedValue, ModelNode currentValue, HandbackHolder handbackHolder) throws OperationFailedException {
+        Map<String, String> newProps = securityProperties.unwrap(context, resolvedValue);
+        Map<String, String> oldProps = securityProperties.unwrap(context, currentValue);
+        setProperties(context, newProps, oldProps);
+        return false;
+    }
+
+    private void setProperties(final OperationContext context, Map<String, String> newProps, Map<String, String> oldProps) {
+        Map<String, String> toRemove = new HashMap<>();
+        Map<String, String> toAdd = new HashMap<>();
+        Map<String, String> toUpdate = new HashMap<>();
+
+
+        doDifference(newProps, oldProps, toAdd, toRemove, toUpdate);
+
+        for (Map.Entry<String, String> entry : toAdd.entrySet()) {
+            setProperty(context, entry.getKey(), entry.getValue());
+        }
+        for (Map.Entry<String, String> entry : toUpdate.entrySet()) {
+            setProperty(context, entry.getKey(), entry.getValue());
+        }
+        for (String entry : toRemove.keySet()) {
+            removeProperty(context, entry);
+        }
+
+    }
+
+    @Override
+    protected void revertUpdateToRuntime(OperationContext context, ModelNode operation, String attributeName, ModelNode valueToRestore, ModelNode valueToRevert, Object handback) throws OperationFailedException {
+        Map<String, String> newProps = securityProperties.unwrap(context, valueToRestore);
+        Map<String, String> oldProps = securityProperties.unwrap(context, valueToRevert);
+        setProperties(context, newProps, oldProps);
+    }
+
+    /**
+     * calculate the difference of the two maps, so we know what was added, removed & updated
+     * @param left
+     * @param right
+     * @param onlyOnLeft
+     * @param onlyOnRight
+     * @param updated
+     */
+    static void doDifference(
+            Map<String, String> left,
+            Map<String, String> right,
+            Map<String, String> onlyOnLeft,
+            Map<String, String> onlyOnRight,
+            Map<String, String> updated
+    ) {
+        onlyOnRight.clear();
+        onlyOnRight.putAll(right);
+        for (Map.Entry<String, String> entry : left.entrySet()) {
+            String leftKey = entry.getKey();
+            String leftValue = entry.getValue();
+            if (right.containsKey(leftKey)) {
+                String rightValue = onlyOnRight.remove(leftKey);
+                if (!leftValue.equals(rightValue)) {
+                    updated.put(leftKey, leftValue);
+                }
+            } else {
+                onlyOnLeft.put(leftKey, leftValue);
+            }
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityPropertyService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityPropertyService.java
new file mode 100644
index 0000000..3c0840b
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/SecurityPropertyService.java
@@ -0,0 +1,155 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.SecurityActions.doPrivileged;
+
+import java.lang.reflect.Field;
+import java.security.PrivilegedAction;
+import java.security.Security;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+
+/**
+ * A {@link Service} responsible for the runtime changes for security properties.
+ *
+ * Only a single instance of this service should be registered but we make use of a registered service so that we can respond to
+ * lifecycle events and clean up during a restart.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class SecurityPropertyService implements Service<Void> {
+
+    static final ServiceName SERVICE_NAME = ElytronTlsExtension.BASE_SERVICE_NAME.append(Constants.SECURITY_PROPERTIES);
+
+    private volatile boolean started = false;
+
+    /**
+     * A {@link Map} of all properties set by this service, the value is the value to restore when the property is being
+     * removed.
+     */
+    private final Map<String, SetState> valuesSet = new HashMap<String, SetState>();
+
+    /**
+     * A {@link Map} of values still to be set by this service, if values are added to this service when it has not been started
+     * they are held here until the service starts.
+     */
+    private final Map<String, String> toSet = new HashMap<String, String>();
+
+    SecurityPropertyService(Map<String,String> propertiesToBeSet) {
+        toSet.putAll(propertiesToBeSet);
+    }
+
+    @Override
+    public synchronized void start(StartContext context) throws StartException {
+        doPrivileged((PrivilegedAction<Void>) () -> {
+            toSet.forEach((String name, String value) -> setPropertyImmediate(name, value));
+            return null;
+        });
+        toSet.clear();
+        started = true;
+    }
+
+    @Override
+    public synchronized void stop(StopContext context) {
+        doPrivileged((PrivilegedAction<Void>) () -> {
+            valuesSet.forEach((String name, SetState state) -> {
+                restoreProperty(name, state.getPreviousValue());
+                toSet.put(name, state.getNewValue());
+            });
+            return null;
+        });
+        valuesSet.clear();
+        started = false;
+    }
+
+    @Override
+    public Void getValue() throws IllegalStateException, IllegalArgumentException {
+        return null;
+    }
+
+    private void restoreProperty(String name, String restorationValue) {
+        if (restorationValue == null) {
+            try {
+                Field f = Security.class.getDeclaredField("props");
+                f.setAccessible(true);
+                Properties props = (Properties) f.get(null);
+                props.remove(name);
+            } catch (NoSuchFieldException | IllegalAccessException ignored) {
+            }
+        } else {
+            Security.setProperty(name, restorationValue);
+        }
+    }
+
+    private void setPropertyImmediate(String name, String value) {
+        String original = valuesSet.containsKey(name) ? valuesSet.get(name).previousValue : Security.getProperty(name);
+        Security.setProperty(name, value);
+        valuesSet.put(name, new SetState(original, value));
+    }
+
+    synchronized void setProperty(String name, String value) {
+        if (started) {
+            doPrivileged((PrivilegedAction<Void>) () -> {
+                setPropertyImmediate(name, value);
+                return null;
+            });
+        } else {
+            toSet.put(name, value);
+        }
+    }
+
+    synchronized void removeProperty(String name) {
+        if (started) {
+            SetState state = valuesSet.remove(name);
+            doPrivileged((PrivilegedAction<Void>) () -> {
+                restoreProperty(name, state.getPreviousValue());
+                return null;
+            });
+        } else {
+            toSet.remove(name);
+        }
+    }
+
+    private static class SetState {
+        private final String previousValue;
+        private final String newValue;
+
+        private SetState(String previousValue, String newValue) {
+            this.previousValue = previousValue;
+            this.newValue = newValue;
+        }
+
+        private String getPreviousValue() {
+            return previousValue;
+        }
+        private String getNewValue() {
+            return newValue;
+        }
+
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ServiceStateDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ServiceStateDefinition.java
new file mode 100644
index 0000000..43372fc
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ServiceStateDefinition.java
@@ -0,0 +1,58 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import org.jboss.as.controller.SimpleAttributeDefinition;
+import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.State;
+
+/**
+ * Class to contain the attribute definition for the runtime representation of a services state.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class ServiceStateDefinition {
+
+    static final SimpleAttributeDefinition STATE = new SimpleAttributeDefinitionBuilder(Constants.STATE, ModelType.STRING)
+        .setStorageRuntime()
+        .setAllowedValues(allowedValues(State.values()))
+        .build();
+
+    /**
+     * Populate the supplied response {@link ModelNode} with information about the supplied {@link ServiceController}
+     *
+     * @param response the response to populate.
+     * @param serviceController the {@link ServiceController} to use when populating the response.
+     */
+    static void populateResponse(final ModelNode response, final ServiceController<?> serviceController) {
+        response.set(serviceController.getState().toString());
+    }
+
+    private static String[] allowedValues(Object[] allowedValues) {
+        String[] allowedValuesResponse = new String[allowedValues.length];
+        for (int i = 0; i < allowedValues.length; i++) {
+            allowedValuesResponse[i] = String.valueOf(allowedValues[i]);
+        }
+
+        return allowedValuesResponse;
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ServiceUtil.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ServiceUtil.java
new file mode 100644
index 0000000..71d1ff9
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/ServiceUtil.java
@@ -0,0 +1,107 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OP_ADDR;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.inject.Injector;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceName;
+
+/**
+ * A utility class for creating a {@link ServiceName} for and handling injections.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+final class ServiceUtil<T> {
+
+    private final RuntimeCapability<?> runtimeCapability;
+    private final String key;
+    private final Class<T> clazz;
+
+    private ServiceUtil(RuntimeCapability<?> runtimeCapability, String key, Class<T> injectionClass) {
+        this.runtimeCapability = runtimeCapability;
+        this.key = key;
+        clazz = injectionClass;
+    }
+
+    /**
+     * Construct the {@link ServiceName} for a {@link Service} given it's simple name.
+     *
+     * @param name - the simple name of the service.
+     * @return The fully qualified {@link ServiceName} of the service.
+     */
+    ServiceName serviceName(final String name) {
+        RuntimeCapability<?> dynamicCapability = runtimeCapability.fromBaseCapability(name);
+        return dynamicCapability.getCapabilityServiceName(clazz);
+    }
+
+    /**
+     * From a given operation extract the address of the operation, identify the simple name of the {@link Service} being
+     * referenced and convert it into a {@link ServiceName} for that {@link Service}.
+     *
+     * @param operation - the operation to extract the simple name from.
+     * @return The fully qualified {@link ServiceName} of the service.
+     */
+    ServiceName serviceName(final ModelNode operation) {
+        String name = null;
+        PathAddress pa = PathAddress.pathAddress(operation.require(OP_ADDR));
+        for (int i = pa.size() - 1; i > 0; i--) {
+            PathElement pe = pa.getElement(i);
+            if (key.equals(pe.getKey())) {
+                name = pe.getValue();
+                break;
+            }
+        }
+
+        if (name == null) {
+            throw LOGGER.operationAddressMissingKey(key);
+        }
+
+        return serviceName(name);
+    }
+
+    /**
+     * Using the supplied {@link Injector} add a dependency on the {@link Service} identified by the supplied name.
+     *
+     * @param sb - the {@link ServiceBuilder} to use for the injection.
+     * @param injector - the {@link Injector} to inject into.
+     * @param name - the simple name of the service to inject.
+     * @return The {@link ServiceBuilder} passed in to allow method chaining.
+     */
+    ServiceBuilder<?> addInjection(ServiceBuilder<?> sb, Injector<T> injector, String name) {
+        return addInjection(sb, injector, serviceName(name));
+    }
+
+    ServiceBuilder<?> addInjection(ServiceBuilder<?> sb, Injector<T> injector, ServiceName serviceName) {
+        sb.addDependency(serviceName, clazz, injector);
+        return sb;
+    }
+
+    public static <T> ServiceUtil<T> newInstance(RuntimeCapability<?> runtimeCapability, String key, Class<T> injectionClass) {
+        return new ServiceUtil<T>(runtimeCapability, key, injectionClass);
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialAddHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialAddHandler.java
new file mode 100644
index 0000000..fc8f706
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialAddHandler.java
@@ -0,0 +1,95 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.common.Assert.checkNotNullParam;
+import static org.wildfly.extension.elytron.tls.ElytronTlsSubsystemDefinition.commonRequirements;
+
+import java.util.Collections;
+import java.util.HashSet;
+
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.RunningMode;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceBuilder;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceController.Mode;
+import org.wildfly.extension.elytron.tls.TrivialService.ValueSupplier;
+
+/**
+ * A trivial {@link OperationStepHandler} for adding a {@link Service} for a resource.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+abstract class TrivialAddHandler<T> extends BaseAddHandler {
+
+    private final RuntimeCapability<?> runtimeCapability;
+    private final Mode initialMode;
+    private final Mode adminOnlyInitialMode;
+
+    TrivialAddHandler(Class<T> serviceType, AttributeDefinition[] attributes, RuntimeCapability<?> runtimeCapability) {
+        this(serviceType, Mode.ACTIVE, attributes, runtimeCapability);
+    }
+
+    TrivialAddHandler(Class<T> serviceType, Mode initialMode, AttributeDefinition[] attributes, RuntimeCapability<?> runtimeCapability) {
+        this(serviceType, initialMode, initialMode, attributes, runtimeCapability);
+    }
+
+    TrivialAddHandler(Class<T> serviceType, Mode initialMode, Mode adminOnlyInitialMode, AttributeDefinition[] attributes, RuntimeCapability<?> runtimeCapability) {
+        super(new HashSet<>(Collections.singletonList(checkNotNullParam("runtimeCapabilities", runtimeCapability))), attributes);
+        this.runtimeCapability = runtimeCapability;
+        checkNotNullParam("serviceType", serviceType);
+        this.initialMode = checkNotNullParam("initialMode", initialMode);
+        this.adminOnlyInitialMode = checkNotNullParam("adminOnlyInitialMode", adminOnlyInitialMode);
+    }
+
+    @SuppressWarnings("unchecked")
+    @Override
+    protected final void performRuntime(OperationContext context, ModelNode operation, Resource resource)
+            throws OperationFailedException {
+        TrivialService<T> trivialService = new TrivialService<>();
+
+        ServiceBuilder<T> serviceBuilder = (ServiceBuilder<T>)context.getCapabilityServiceTarget().addCapability(runtimeCapability);
+        serviceBuilder.setInstance(trivialService);
+
+        trivialService.setValueSupplier(getValueSupplier(serviceBuilder, context, resource.getModel()));
+        installedForResource(commonRequirements(serviceBuilder, dependOnProperties(), dependOnProviderRegistration())
+                .setInitialMode(context.getRunningMode() == RunningMode.ADMIN_ONLY ? adminOnlyInitialMode : initialMode)
+                .install(), resource);
+    }
+
+    protected boolean dependOnProperties() {
+        return true;
+    }
+
+    protected boolean dependOnProviderRegistration() {
+        return true;
+    }
+
+    protected void installedForResource(ServiceController<T> serviceController, Resource resource) {}
+
+    protected abstract ValueSupplier<T> getValueSupplier(ServiceBuilder<T> serviceBuilder, OperationContext context, ModelNode model) throws OperationFailedException;
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialCapabilityServiceRemoveHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialCapabilityServiceRemoveHandler.java
new file mode 100644
index 0000000..49932a6
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialCapabilityServiceRemoveHandler.java
@@ -0,0 +1,80 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls.Capabilities.ELYTRON_TLS_CAPABILITY_NAME;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.ServiceRemoveStepHandler;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceName;
+
+/**
+ * An {@link OperationStepHandler} for removing a single service based on it's capability.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class TrivialCapabilityServiceRemoveHandler extends ServiceRemoveStepHandler implements ElytronOperationStepHandler {
+
+    private final RuntimeCapability<?> firstCapability;
+    private final Set<RuntimeCapability<?>> allCapabilities;
+
+    /**
+     * Construct an {@link OperationStepHandler} for removing a single service based on it's capability.
+     *
+     * @param addOperation
+     * @param unavailableCapabilities
+     */
+    TrivialCapabilityServiceRemoveHandler(AbstractAddStepHandler addOperation, RuntimeCapability<?> ... runtimeCapabilities) {
+        super(addOperation, runtimeCapabilities);
+        this.firstCapability = runtimeCapabilities[0];
+        this.allCapabilities = new HashSet<>(Arrays.asList(runtimeCapabilities));
+    }
+
+    @Override
+    protected void recordCapabilitiesAndRequirements(OperationContext context, ModelNode operation, Resource resource) throws OperationFailedException {
+        super.recordCapabilitiesAndRequirements(context, operation, resource);
+        final String pathValue = context.getCurrentAddressValue();
+        for (RuntimeCapability<?> r : allCapabilities) {
+            context.deregisterCapabilityRequirement(ELYTRON_TLS_CAPABILITY_NAME, r.isDynamicallyNamed() ? r.getDynamicName(pathValue) : r.getName());
+        }
+    }
+
+    /**
+     * Create the name of the {@link Service} to be removed using the previously provided {@link RuntimeCapability} and the type
+     * of the service.
+     */
+    @Override
+    protected ServiceName serviceName(String name) {
+        return firstCapability.fromBaseCapability(name).getCapabilityServiceName();
+    }
+
+    @Override
+    protected boolean requiresRuntime(final OperationContext context) {
+        return isServerOrHostController(context);
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialResourceDefinition.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialResourceDefinition.java
new file mode 100644
index 0000000..921673a
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialResourceDefinition.java
@@ -0,0 +1,206 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import org.jboss.as.controller.AbstractAddStepHandler;
+import org.jboss.as.controller.AbstractRemoveStepHandler;
+import org.jboss.as.controller.AttributeDefinition;
+import org.jboss.as.controller.OperationDefinition;
+import org.jboss.as.controller.OperationStepHandler;
+import org.jboss.as.controller.PathElement;
+import org.jboss.as.controller.ResourceDefinition;
+import org.jboss.as.controller.SimpleResourceDefinition;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.descriptions.ResourceDescriptionResolver;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.OperationEntry;
+
+/**
+ * A trivial {@link ResourceDefinition}
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+final class TrivialResourceDefinition extends SimpleResourceDefinition {
+
+    private final AttributeDefinition[] attributes;
+    private final Map<OperationDefinition, OperationStepHandler> operations;
+    private final Map<AttributeDefinition, OperationStepHandler> readOnlyAttributes;
+    private final List<ResourceDefinition> children;
+
+    private TrivialResourceDefinition(String pathKey, ResourceDescriptionResolver resourceDescriptionResolver, AbstractAddStepHandler add, AbstractRemoveStepHandler remove, AttributeDefinition[] attributes,
+                                      Map<AttributeDefinition, OperationStepHandler> readOnlyAttributes, Map<OperationDefinition, OperationStepHandler> operations, List<ResourceDefinition> children,
+                                      RuntimeCapability<?>[] runtimeCapabilities) {
+        super(new Parameters(PathElement.pathElement(pathKey),
+                resourceDescriptionResolver)
+            .setAddHandler(add)
+            .setRemoveHandler(remove)
+            .setAddRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setRemoveRestartLevel(OperationEntry.Flag.RESTART_RESOURCE_SERVICES)
+            .setCapabilities(runtimeCapabilities));
+
+        this.attributes = attributes;
+        this.readOnlyAttributes = readOnlyAttributes;
+        this.operations = operations;
+        this.children = children;
+    }
+
+    TrivialResourceDefinition(String pathKey, ResourceDescriptionResolver resourceDescriptionResolver, AbstractAddStepHandler add, AttributeDefinition[] attributes, RuntimeCapability<?> ... runtimeCapabilities) {
+        this(pathKey, resourceDescriptionResolver, add, new TrivialCapabilityServiceRemoveHandler(add, runtimeCapabilities), attributes, null, null, null, runtimeCapabilities);
+    }
+
+    TrivialResourceDefinition(String pathKey, AbstractAddStepHandler add, AttributeDefinition[] attributes, RuntimeCapability<?> ... runtimeCapabilities) {
+        this(pathKey, ElytronTlsExtension.getResourceDescriptionResolver(pathKey), add, new TrivialCapabilityServiceRemoveHandler(add, runtimeCapabilities), attributes, null, null, null, runtimeCapabilities);
+    }
+
+    @Override
+    public void registerAttributes(ManagementResourceRegistration resourceRegistration) {
+         if (attributes != null && attributes.length > 0) {
+             ElytronReloadRequiredWriteAttributeHandler writeHandler = new ElytronReloadRequiredWriteAttributeHandler(attributes);
+             for (AttributeDefinition current : attributes) {
+                 resourceRegistration.registerReadWriteAttribute(current, null, writeHandler);
+             }
+         }
+
+         if (readOnlyAttributes != null) {
+             for (Entry<AttributeDefinition, OperationStepHandler> entry : readOnlyAttributes.entrySet()) {
+                 resourceRegistration.registerReadOnlyAttribute(entry.getKey(), entry.getValue());
+             }
+         }
+    }
+
+    @Override
+    public void registerOperations(ManagementResourceRegistration resourceRegistration) {
+        super.registerOperations(resourceRegistration);
+
+        if (operations != null) {
+            for (Entry<OperationDefinition, OperationStepHandler> entry : operations.entrySet()) {
+                resourceRegistration.registerOperationHandler(entry.getKey(), entry.getValue());
+            }
+        }
+    }
+
+    @Override
+    public void registerChildren(ManagementResourceRegistration resourceRegistration) {
+        if (children != null) {
+            for (ResourceDefinition child : children) {
+                resourceRegistration.registerSubModel(child);
+            }
+        }
+    }
+
+    public AttributeDefinition[] getAttributes() {
+        return attributes;
+    }
+
+    static Builder builder() {
+        return new Builder();
+    }
+
+    static class Builder {
+
+        private String pathKey;
+        private ResourceDescriptionResolver resourceDescriptionResolver;
+        private AbstractAddStepHandler addHandler;
+        private AbstractRemoveStepHandler removeHandler;
+        private AttributeDefinition[] attributes;
+        private Map<AttributeDefinition, OperationStepHandler> readOnlyAttributes;
+        private Map<OperationDefinition, OperationStepHandler> operations;
+        private RuntimeCapability<?>[] runtimeCapabilities;
+        private List<ResourceDefinition> children;
+
+        Builder() {}
+
+        Builder setPathKey(String pathKey) {
+            this.pathKey = pathKey;
+
+            return this;
+        }
+
+        Builder setResourceDescriptionResolver(ResourceDescriptionResolver resourceDescriptionResolver) {
+            this.resourceDescriptionResolver = resourceDescriptionResolver;
+
+            return this;
+        }
+
+        Builder setAddHandler(AbstractAddStepHandler addHandler) {
+            this.addHandler = addHandler;
+
+            return this;
+        }
+
+        Builder setRemoveHandler(AbstractRemoveStepHandler removeHandler) {
+            this.removeHandler = removeHandler;
+
+            return this;
+        }
+
+        Builder setAttributes(AttributeDefinition ... attributes) {
+            this.attributes = attributes;
+
+            return this;
+        }
+
+        Builder addReadOnlyAttribute(AttributeDefinition attribute, OperationStepHandler handler) {
+            if (readOnlyAttributes == null) {
+                readOnlyAttributes = new HashMap<>();
+            }
+            readOnlyAttributes.put(attribute, handler);
+
+            return this;
+        }
+
+        Builder addOperation(OperationDefinition operation, OperationStepHandler handler) {
+            if (operations == null) {
+                operations = new HashMap<>();
+            }
+            operations.put(operation, handler);
+
+            return this;
+        }
+
+        Builder setRuntimeCapabilities(RuntimeCapability<?> ... runtimeCapabilities) {
+            this.runtimeCapabilities = runtimeCapabilities;
+
+            return this;
+        }
+
+        Builder addChild(ResourceDefinition child) {
+            if (children == null) {
+                children = new ArrayList<>();
+            }
+
+            children.add(child);
+
+            return this;
+        }
+
+        ResourceDefinition build() {
+            ResourceDescriptionResolver resourceDescriptionResolver = this.resourceDescriptionResolver != null ? this.resourceDescriptionResolver : ElytronTlsExtension.getResourceDescriptionResolver(pathKey);
+            return new TrivialResourceDefinition(pathKey, resourceDescriptionResolver, addHandler,
+                    removeHandler != null ? removeHandler : new TrivialCapabilityServiceRemoveHandler(addHandler, runtimeCapabilities),
+                    attributes, readOnlyAttributes, operations, children, runtimeCapabilities);
+        }
+
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialService.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialService.java
new file mode 100644
index 0000000..235e0c1
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/TrivialService.java
@@ -0,0 +1,90 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2015 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.common.Assert.checkNotNullParam;
+
+import java.util.function.Consumer;
+import java.util.function.Supplier;
+
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.StartContext;
+import org.jboss.msc.service.StartException;
+import org.jboss.msc.service.StopContext;
+
+/**
+ * A very trivial {@link Service} implementation where creation of the value type can easily be wrapped using a {@link Supplier}
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+class TrivialService<T> implements Service<T> {
+
+    private volatile ValueSupplier<T> valueSupplier;
+    private final Consumer<T> valueConsumer;
+
+    private volatile T value;
+
+    TrivialService() {
+        this.valueConsumer = null;
+    }
+
+    TrivialService(ValueSupplier<T> valueSupplier, Consumer<T> valueConsumer) {
+        this.valueSupplier = checkNotNullParam("valueSupplier", valueSupplier);
+        this.valueConsumer = valueConsumer;
+    }
+
+    TrivialService(ValueSupplier<T> valueSupplier) {
+        this(valueSupplier, null);
+    }
+
+    void setValueSupplier(ValueSupplier<T> valueSupplier) {
+        this.valueSupplier = checkNotNullParam("valueSupplier", valueSupplier);
+    }
+
+    @Override
+    public void start(StartContext context) throws StartException {
+        value = checkNotNullParam("valueSupplier", valueSupplier).get();
+        if (valueConsumer != null) {
+            valueConsumer.accept(value);
+        }
+    }
+
+    @Override
+    public void stop(StopContext context) {
+        valueSupplier.dispose();
+        value = null;
+    }
+
+    @Override
+    public T getValue() throws IllegalStateException, IllegalArgumentException {
+        return value;
+    }
+
+    /**
+     * A supplier for the value returned by this service, the {@link #get()} methods allows for a {@link StartException} to be
+     * thrown so can be used with failed mandatory service injection.
+     */
+    @FunctionalInterface
+    interface ValueSupplier<T> {
+
+        T get() throws StartException;
+
+        default void dispose() {}
+
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Validators.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Validators.java
new file mode 100644
index 0000000..70f0ffc
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/Validators.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
+
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.operations.validation.ModelTypeValidator;
+import org.jboss.as.controller.operations.validation.ParameterValidator;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.wildfly.security.ssl.CipherSuiteSelector;
+
+public class Validators {
+
+
+    static class CipherSuiteFilterValidator extends ModelTypeValidator {
+
+        CipherSuiteFilterValidator() {
+            super(ModelType.STRING, true, true, false);
+        }
+
+        @Override
+        public void validateParameter(String parameterName, ModelNode value) throws OperationFailedException {
+            super.validateParameter(parameterName, value);
+            if (value.isDefined()) {
+                try {
+                    CipherSuiteSelector.fromString(value.asString());
+                } catch (IllegalArgumentException e) {
+                    throw LOGGER.invalidCipherSuiteFilter(e, e.getLocalizedMessage());
+                }
+            }
+        }
+    }
+    static class CipherSuiteNamesValidator extends ModelTypeValidator {
+
+        CipherSuiteNamesValidator() {
+            super(ModelType.STRING, true, true, false);
+        }
+
+        @Override
+        public void validateParameter(String parameterName, ModelNode value) throws OperationFailedException {
+            super.validateParameter(parameterName, value);
+            if (value.isDefined()) {
+                try {
+                    CipherSuiteSelector.fromNamesString(value.asString());
+                } catch (IllegalArgumentException e) {
+                    throw LOGGER.invalidCipherSuiteNames(e, e.getLocalizedMessage());
+                }
+            }
+        }
+    }
+
+    static class HostContextMapValidator implements ParameterValidator {
+        // Hostnames can contain ASCII letters a-z (case-insensitive), digits 0-9, hyphens and dots.
+        // This pattern allows also [,],*,? characters to make regular expressions possible. Non-escaped dot represents any character, escaped dot is delimeter.
+        static Pattern hostnameRegexPattern = Pattern.compile("[0-9a-zA-Z\\[.*]" + // first character can be digit, letter, left square bracket, non-escaped dot or asterisk
+                "([0-9a-zA-Z*.\\[\\]?^-]" + // any combination of digits, letters, asterisks, non-escaped dots, square brackets, question marks, hyphens and carets
+                "|" +                       // OR
+                "(?<!\\\\\\.)\\\\\\.)*" +   // if there is an escaped dot, there cannot be another escaped dot right behind it
+                // backslash must be escaped, so '\\\\' translates to literally slash, and '\\.' translates to literally dot
+                "[0-9a-zA-Z*.\\[\\]?]");   // escaped dot or hyphen cannot be at the end
+
+        @Override
+        public void validateParameter(String parameterName, ModelNode value) throws OperationFailedException {
+            if (value.isDefined()) {
+                for (String hostname : value.keys()) {
+                    if (!hostnameRegexPattern.matcher(hostname).matches()) {
+                        throw LOGGER.invalidHostContextMapValue(hostname);
+                    }
+                    try {
+                        Pattern.compile(hostname);  // make sure the input is valid regex as well (eg. will check that the square brackets are paired)
+                    } catch (PatternSyntaxException exception) {
+                        throw LOGGER.invalidHostContextMapValue(hostname);
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/_private/ElytronTLSMessages.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/_private/ElytronTLSMessages.java
new file mode 100644
index 0000000..950af8b
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/_private/ElytronTLSMessages.java
@@ -0,0 +1,411 @@
+/*
+ * Copyright 2022 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls._private;
+
+import static org.jboss.logging.Logger.Level.INFO;
+import static org.jboss.logging.Logger.Level.WARN;
+
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.NoSuchProviderException;
+
+import org.jboss.as.controller.ExpressionResolver;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.logging.BasicLogger;
+import org.jboss.logging.Logger;
+import org.jboss.logging.annotations.Cause;
+import org.jboss.logging.annotations.LogMessage;
+import org.jboss.logging.annotations.Message;
+import org.jboss.logging.annotations.MessageLogger;
+import org.jboss.msc.service.Service;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.jboss.msc.service.StartException;
+import org.wildfly.security.x500.cert.acme.AcmeException;
+
+/**
+ * Log messages for Elytron TLS subsystem
+ *
+ * @author <a href="mmazanek@redhat.com">Martin Mazanek</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+@MessageLogger(projectCode = "ELYTLS", length = 5)
+public interface ElytronTLSMessages extends BasicLogger {
+
+    ElytronTLSMessages LOGGER = Logger.getMessageLogger(ElytronTLSMessages.class, "org.wildfly.extension.elytron.tls.subsystem");
+
+    /*
+     * 000xx: Core subsystem, service, provider, and generic messages section.
+     */
+
+    @LogMessage(level = INFO)
+    @Message(id = 1, value = "Activating Elytron TLS Subsystem")
+    void activatingSubsystem();
+
+    @Message(id = 2, value = "The operation did not contain an address with a value for '%s'.")
+    IllegalArgumentException operationAddressMissingKey(final String key);
+
+    /**
+     * An {@link OperationFailedException} where the name of the operation does not match the expected names.
+     *
+     * @param actualName the operation name contained within the request.
+     * @param expectedNames the expected operation names.
+     * @return The {@link OperationFailedException} for the error.
+     */
+    @Message(id = 3, value = "Invalid operation name '%s', expected one of '%s'")
+    OperationFailedException invalidOperationName(String actualName, String... expectedNames);
+
+    /**
+     * An {@link RuntimeException} where an operation can not be completed.
+     *
+     * @param cause the underlying cause of the failure.
+     * @return The {@link RuntimeException} for the error.
+     */
+    @Message(id = 4, value = "Unable to complete operation. '%s'")
+    RuntimeException unableToCompleteOperation(@Cause Throwable cause, String causeMessage);
+
+
+    /**
+     * A {@link StartException} if it is not possible to initialise the {@link Service}.
+     *
+     * @param cause the cause of the failure.
+     * @return The {@link StartException} for the error.
+     */
+    @Message(id = 20, value = "Unable to start the service.")
+    StartException unableToStartService(@Cause Exception cause);
+
+    /**
+     * An {@link OperationFailedException} where an operation can not proceed as it's required service is not UP.
+     *
+     * @param serviceName the name of the service that is required.
+     * @param state the actual state of the service.
+     * @return The {@link OperationFailedException} for the error.
+     */
+    @Message(id = 21, value = "The required service '%s' is not UP, it is currently '%s'.")
+    OperationFailedException requiredServiceNotUp(ServiceName serviceName, ServiceController.State state);
+
+    @Message(id = 22, value = "Unexpected name of ServiceName's parent - %s")
+    IllegalStateException invalidServiceNameParent(String canonicalName);
+
+    @Message(id = 23, value = "No '%s' found in injected value.")
+    StartException noTypeFound(final String type);
+
+    @Message(id = 40, value = "No suitable provider found for type '%s'")
+    StartException noSuitableProvider(String type);
+
+    @Message(id = 60, value = "Injected value is not of '%s' type.")
+    StartException invalidTypeInjected(final String type);
+
+    @Message(id = 61, value = "A cycle has been detected initialising the resources - %s")
+    OperationFailedException cycleDetected(String cycle);
+
+    /**
+     * 001xx: KeyStore Section.
+     */
+
+    /**
+     * An {@link OperationFailedException} if it is not possible to access the {@link KeyStore} at RUNTIME.
+     *
+     * @param cause the underlying cause of the failure
+     * @return The {@link OperationFailedException} for the error.
+     */
+    @Message(id = 100, value = "Unable to access KeyStore to complete the requested operation.")
+    OperationFailedException unableToAccessKeyStore(@Cause Exception cause);
+
+    /**
+     * An {@link OperationFailedException} where this an attempt to save a KeyStore without a File defined.
+     *
+     * @return The {@link OperationFailedException} for the error.
+     */
+    @Message(id = 101, value = "Unable to save KeyStore - KeyStore file '%s' does not exist.")
+    OperationFailedException cantSaveWithoutFile(final String file);
+
+    @Message(id = 102, value = "KeyStore file '%s' does not exist and required.")
+    StartException keyStoreFileNotExists(final String file);
+
+    @LogMessage(level = WARN)
+    @Message(id = 103, value = "KeyStore file '%s' does not exist. Used blank.")
+    void keyStoreFileNotExistsButIgnored(final String file);
+
+    @LogMessage(level = WARN)
+    @Message(id = 104, value = "Certificate [%s] in KeyStore is not valid")
+    void certificateNotValid(String alias, @Cause Exception cause);
+
+    /*
+     * 002xx - 004xx: Credential Store Section.
+     */
+
+    @Message(id = 200, value = "Credential store '%s' does not support given credential store entry type '%s'")
+    OperationFailedException credentialStoreEntryTypeNotSupported(String credentialStoreName, String entryType);
+
+    @Message(id = 201, value = "Password cannot be resolved for key-store '%s'")
+    IOException keyStorePasswordCannotBeResolved(String path);
+
+    @Message(id = 202, value = "Credential store '%s' protection parameter cannot be resolved")
+    IOException credentialStoreProtectionParameterCannotBeResolved(String name);
+
+    @Message(id = 203, value = "Credential alias '%s' of credential type '%s' already exists in the store")
+    OperationFailedException credentialAlreadyExists(String alias, String credentialType);
+
+    @Message(id = 204, value = "Provider loader '%s' cannot supply Credential Store provider of type '%s'")
+    NoSuchProviderException providerLoaderCannotSupplyProvider(String providerLoader, String type);
+
+    @Message(id = 205, value = "Credential alias '%s' of credential type '%s' does not exist in the store")
+    OperationFailedException credentialDoesNotExist(String alias, String credentialType);
+
+    @Message(id = 206, value = "Location parameter is not specified for filebased keystore type '%s'")
+    OperationFailedException filebasedKeystoreLocationMissing(String type);
+
+    @Message(id = Message.NONE, value = "Reload dependent services which might already have cached the secret value")
+    String reloadDependantServices();
+
+    @Message(id = Message.NONE, value = "Update dependent resources as alias '%s' does not exist anymore")
+    String updateDependantServices(String alias);
+
+    @Message(id = 208, value = "Unable to load credential from credential store.")
+    ExpressionResolver.ExpressionResolutionUserException unableToLoadCredential(@Cause Throwable cause);
+
+    @Message(id = 209, value = "Unable to encrypt the supplied clear text.")
+    OperationFailedException unableToEncryptClearText(@Cause Throwable cause);
+
+    @Message(id = 210, value = "Unable to create immediately available credential store.")
+    OperationFailedException unableToCreateCredentialStoreImmediately(@Cause Throwable cause);
+
+    @Message(id = 211, value = "Unable to reload the credential store.")
+    OperationFailedException unableToReloadCredentialStore(@Cause Throwable cause);
+
+    @Message(id = 212, value = "Unable to initialize the credential store.")
+    OperationFailedException unableToInitialiseCredentialStore(@Cause Throwable cause);
+
+    @Message(id = 213, value = "The secret key operation '%s' failed to complete due to '%s'.")
+    OperationFailedException secretKeyOperationFailed(String operationName, String error, @Cause Throwable cause);
+
+    @Message(id = 300, value = "Invalid value for cipher-suite-filter. %s")
+    OperationFailedException invalidCipherSuiteFilter(@Cause Throwable cause, String causeMessage);
+
+    @Message(id = 301, value = "Key password cannot be resolved for key-store '%s'")
+    IOException keyPasswordCannotBeResolved(String path);
+
+    @Message(id = 302, value = "Invalid value for not-before. %s")
+    OperationFailedException invalidNotBefore(@Cause Throwable cause, String causeMessage);
+
+    @Message(id = 303, value = "Alias '%s' does not exist in KeyStore")
+    OperationFailedException keyStoreAliasDoesNotExist(String alias);
+
+    @Message(id = 304, value = "Alias '%s' does not identify a PrivateKeyEntry in KeyStore")
+    OperationFailedException keyStoreAliasDoesNotIdentifyPrivateKeyEntry(String alias);
+
+    @Message(id = 305, value = "Unable to obtain PrivateKey for alias '%s'")
+    OperationFailedException unableToObtainPrivateKey(String alias);
+
+    @Message(id = 306, value = "Unable to obtain Certificate for alias '%s'")
+    OperationFailedException unableToObtainCertificate(String alias);
+
+    @Message(id = 307, value = "No certificates found in certificate reply")
+    OperationFailedException noCertificatesFoundInCertificateReply();
+
+    @Message(id = 308, value = "Public key from certificate reply does not match public key from certificate in KeyStore")
+    OperationFailedException publicKeyFromCertificateReplyDoesNotMatchKeyStore();
+
+    @Message(id = 309, value = "Certificate reply is the same as the certificate from PrivateKeyEntry in KeyStore")
+    OperationFailedException certificateReplySameAsCertificateFromKeyStore();
+
+    @Message(id = 310, value = "Alias '%s' already exists in KeyStore")
+    OperationFailedException keyStoreAliasAlreadyExists(String alias);
+
+    @Message(id = 311, value = "Top-most certificate from certificate reply is not trusted. Inspect the certificate carefully and if it is valid, execute import-certificate again with validate set to false.")
+    OperationFailedException topMostCertificateFromCertificateReplyNotTrusted();
+
+    @Message(id = 312, value = "Trusted certificate is already in KeyStore under alias '%s'")
+    OperationFailedException trustedCertificateAlreadyInKeyStore(String alias);
+
+    @Message(id = 313, value = "Trusted certificate is already in cacerts KeyStore under alias '%s'")
+    OperationFailedException trustedCertificateAlreadyInCacertsKeyStore(String alias);
+
+    @Message(id = 314, value = "Unable to determine if the certificate is trusted. Inspect the certificate carefully and if it is valid, execute import-certificate again with validate set to false.")
+    OperationFailedException unableToDetermineIfCertificateIsTrusted();
+
+    @Message(id = 315, value = "Certificate file does not exist")
+    OperationFailedException certificateFileDoesNotExist(@Cause Exception cause);
+
+    @Message(id = 316, value = "Unable to obtain Entry for alias '%s'")
+    OperationFailedException unableToObtainEntry(String alias);
+
+    @Message(id = 317, value = "Unable to create an account with the certificate authority: %s")
+    OperationFailedException unableToCreateAccountWithCertificateAuthority(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 318, value = "Unable to change the account key associated with the certificate authority: %s")
+    OperationFailedException unableToChangeAccountKeyWithCertificateAuthority(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 319, value = "Unable to deactivate the account associated with the certificate authority: %s")
+    OperationFailedException unableToDeactivateAccountWithCertificateAuthority(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 320, value = "Unable to obtain certificate authority account Certificate for alias '%s'")
+    StartException unableToObtainCertificateAuthorityAccountCertificate(String alias);
+
+    @Message(id = 321, value = "Unable to obtain certificate authority account PrivateKey for alias '%s'")
+    StartException unableToObtainCertificateAuthorityAccountPrivateKey(String alias);
+
+    @Message(id = 322, value = "Unable to update certificate authority account key store: %s")
+    OperationFailedException unableToUpdateCertificateAuthorityAccountKeyStore(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 323, value = "Unable to respond to challenge from certificate authority: %s")
+    AcmeException unableToRespondToCertificateAuthorityChallenge(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 324, value = "Invalid certificate authority challenge")
+    AcmeException invalidCertificateAuthorityChallenge();
+
+    @Message(id = 325, value = "Invalid certificate revocation reason '%s'")
+    OperationFailedException invalidCertificateRevocationReason(String reason);
+
+    @Message(id = 326, value = "Unable to instantiate AcmeClientSpi implementation")
+    IllegalStateException unableToInstatiateAcmeClientSpiImplementation();
+
+    @Message(id = 327, value = "Unable to update the account with the certificate authority: %s")
+    OperationFailedException unableToUpdateAccountWithCertificateAuthority(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 328, value = "Unable to get the metadata associated with the certificate authority: %s")
+    OperationFailedException unableToGetCertificateAuthorityMetadata(@Cause Exception cause, String causeMessage);
+
+    @Message(id = 329, value = "Invalid key size: %d")
+    OperationFailedException invalidKeySize(int keySize);
+
+    @Message(id = 330, value = "A certificate authority account with this account key already exists. To update the contact" +
+            " information associated with this existing account, use %s. To change the key associated with this existing account, use %s.")
+    OperationFailedException certificateAuthorityAccountAlreadyExists(String updateAccount, String changeAccountKey);
+
+    @Message(id = 331, value = "Unable to detect KeyStore '%s'")
+    StartException unableToDetectKeyStore(String path);
+
+    @Message(id = 332, value = "Fileless KeyStore needs to have a defined type.")
+    OperationFailedException filelessKeyStoreMissingType();
+
+    @Message(id = 333, value = "Invalid value of host context map: '%s' is not valid hostname pattern.")
+    OperationFailedException invalidHostContextMapValue(String hostname);
+    
+    @Message(id = 334, value = "LetsEncrypt certificate authority is configured by default.")
+    OperationFailedException letsEncryptNameNotAllowed();
+
+    @Message(id = 335, value = "Failed to load OCSP responder certificate '%s'.")
+    StartException failedToLoadResponderCert(String alias, @Cause Exception exception);
+
+    @Message(id = 336, value = "Multiple maximum-cert-path definitions found.")
+    OperationFailedException multipleMaximumCertPathDefinitions();
+
+    @Message(id = 337, value = "Invalid value for cipher-suite-names. %s")
+    OperationFailedException invalidCipherSuiteNames(@Cause Throwable cause, String causeMessage);
+
+    @Message(id = 338, value = "Non existing key store needs to have defined type.")
+    OperationFailedException nonexistingKeyStoreMissingType();
+
+    @Message(id = 339, value = "Failed to lazily initialize key manager")
+    RuntimeException failedToLazilyInitKeyManager(@Cause  Exception e);
+
+    @Message(id = 340, value = "Failed to store generated self-signed certificate")
+    RuntimeException failedToStoreGeneratedSelfSignedCertificate(@Cause  Exception e);
+
+    @Message(id = 341, value = "No '%s' found in injected value.")
+    RuntimeException noTypeFoundForLazyInitKeyManager(final String type);
+
+    @Message(id = 342, value = "KeyStore %s not found, it will be auto generated on first use with a self-signed certificate for host %s")
+    @LogMessage(level = WARN)
+    void selfSignedCertificateWillBeCreated(String file, String host);
+
+    @Message(id = 343, value = "Generated self-signed certificate at %s. Please note that self-signed certificates are not secure and should only be used for testing purposes. Do not use this self-signed certificate in production.\nSHA-1 fingerprint of the generated key is %s\nSHA-256 fingerprint of the generated key is %s")
+    @LogMessage(level = WARN)
+    void selfSignedCertificateHasBeenCreated(String file, String sha1, String sha256);
+
+
+    @Message(id = 344, value = "Missing certificate authority challenge")
+    AcmeException missingCertificateAuthorityChallenge();
+
+    @Message(id = 345, value = "Multiple keystore definitions")
+    OperationFailedException multipleKeyStoreDefinitions();
+
+    @Message(id = 346, value = "Multiple key manager definitions")
+    OperationFailedException multipleKeyManagerDefinitions();
+
+    @Message(id = 347, value = "Multiple trust manager definitions")
+    OperationFailedException multipleTrustManagerDefinitions();
+
+    @Message(id = 348, value = "Missing keystore definition")
+    OperationFailedException missingKeyStoreDefinition();
+    @Message(id = 349, value = "Missing key manager definition")
+    OperationFailedException missingKeyManagerDefinition();
+    @Message(id = 350, value = "Missing trust manager definition")
+    OperationFailedException missingTrustManagerDefinition();
+
+    @Message(id = 400, value = "The name of the resolver to use was not specified and no default-resolver has been defined.")
+    OperationFailedException noResolverSpecifiedAndNoDefault();
+
+    @Message(id = 401, value = "No expression resolver has been defined with the name '%s'.")
+    OperationFailedException noResolverWithSpecifiedName(String name);
+
+    @Message(id = 402, value = "A cycle has been detected initialising the expression resolver for '%s' and '%s'.")
+    ExpressionResolver.ExpressionResolutionUserException cycleDetectedInitialisingExpressionResolver(String firstExpression, String secondExpression);
+
+    @Message(id = 403, value = "Expression resolver initialisation has already failed.")
+    ExpressionResolver.ExpressionResolutionUserException expressionResolverInitialisationAlreadyFailed(@Cause Throwable cause);
+
+    @Message(id = 404, value = "The expression '%s' does not specify a resolver and no default is defined.")
+    ExpressionResolver.ExpressionResolutionUserException expressionResolutionWithoutResolver(String expression);
+
+    @Message(id = 405, value = "The expression '%s' specifies a resolver configuration which does not exist.")
+    ExpressionResolver.ExpressionResolutionUserException invalidResolver(String expression);
+
+    @Message(id = 406, value = "Unable to decrypt expression '%s'.")
+    ExpressionResolver.ExpressionResolutionUserException unableToDecryptExpression(String expression, @Cause Throwable cause);
+
+    @Message(id = 407, value = "Resolution of credential store expressions is not supported in the MODEL stage of operation execution.")
+    ExpressionResolver.ExpressionResolutionServerException modelStageResolutionNotSupported(@Cause IllegalStateException cause);
+
+    @Message(id = 408, value = "Unable to resolve CredentialStore %s -- %s")
+    ExpressionResolver.ExpressionResolutionServerException unableToResolveCredentialStore(String storeName, String details, @Cause Exception cause);
+
+    @Message(id = 409, value = "Unable to initialize CredentialStore %s -- %s")
+    ExpressionResolver.ExpressionResolutionUserException unableToInitializeCredentialStore(String storeName, String details, @Cause Exception cause);
+
+    @Message(id = 410, value = "Initialisation of an %s without an active management OperationContext is not allowed.")
+    ExpressionResolver.ExpressionResolutionServerException illegalNonManagementInitialization(Class<?> initialzingClass);
+
+    /**
+     * 005xx: Certificate Authority (Account) Section.
+     */
+
+    @Message(id = 500, value = "Failed to parse URL '%s'")
+    OperationFailedException invalidURL(String url, @Cause Exception cause);
+
+    @Message(id = 501, value = "Unable to access CRL file.")
+    StartException unableToAccessCRL(@Cause Exception cause);
+
+    @Message(id = 502, value = "Unable to reload CRL file.")
+    RuntimeException unableToReloadCRL(@Cause Exception cause);
+
+    @Message(id = 503, value = "Unable to reload CRL file - TrustManager is not reloadable")
+    OperationFailedException unableToReloadCRLNotReloadable();
+
+    /**
+     * 006xx: Key Manager & Trust Manager Section.
+     */
+
+    @Message(id = 602, value = "Unable to create %s for algorithm '%s'.")
+    StartException unableToCreateManagerFactory(final String type, final String algorithm);
+    /**
+     * SSLContext Section.
+     */
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/_private/WildFlyAcmeClient.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/_private/WildFlyAcmeClient.java
new file mode 100644
index 0000000..c061098
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/_private/WildFlyAcmeClient.java
@@ -0,0 +1,91 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2018 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls._private;
+
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+
+import org.wildfly.common.Assert;
+import org.wildfly.security.manager.WildFlySecurityManager;
+import org.wildfly.security.x500.cert.acme.AcmeAccount;
+import org.wildfly.security.x500.cert.acme.AcmeChallenge;
+import org.wildfly.security.x500.cert.acme.AcmeClientSpi;
+import org.wildfly.security.x500.cert.acme.AcmeException;
+
+/**
+ * Implementation of the <a href="https://www.ietf.org/id/draft-ietf-acme-acme-12.txt">Automatic Certificate Management
+ * Environment (ACME)</a> protocol.
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+public final class WildFlyAcmeClient extends AcmeClientSpi {
+    private static final String ACME_CHALLENGE_PREFIX = "/.well-known/acme-challenge/";
+    private static final String TOKEN_REGEX = "[A-Za-z0-9_-]+";
+
+    public AcmeChallenge proveIdentifierControl(AcmeAccount account, List<AcmeChallenge> challenges) throws AcmeException {
+        Assert.checkNotNullParam("account", account);
+        Assert.checkNotNullParam("challenges", challenges);
+        AcmeChallenge selectedChallenge = null;
+        for (AcmeChallenge challenge : challenges) {
+            if (challenge.getType() == AcmeChallenge.Type.HTTP_01) {
+                selectedChallenge = challenge;
+                break;
+            }
+        }
+        if (selectedChallenge == null) {
+            throw LOGGER.missingCertificateAuthorityChallenge();
+        }
+        // ensure the token is valid before proceeding
+        String token = selectedChallenge.getToken();
+        if (! token.matches(TOKEN_REGEX)) {
+            throw LOGGER.invalidCertificateAuthorityChallenge();
+        }
+
+        // respond to the http challenge
+        String responseFilePath = WildFlySecurityManager.getPropertyPrivileged("jboss.home.dir", ".") + ACME_CHALLENGE_PREFIX + token;
+        try (FileOutputStream fos = new FileOutputStream(responseFilePath)) {
+            fos.write(selectedChallenge.getKeyAuthorization(account).getBytes(StandardCharsets.US_ASCII));
+        } catch (IOException e) {
+            throw LOGGER.unableToRespondToCertificateAuthorityChallenge(e, e.getLocalizedMessage());
+        }
+        return selectedChallenge;
+    }
+
+    public void cleanupAfterChallenge(AcmeAccount account, AcmeChallenge challenge) throws AcmeException {
+        Assert.checkNotNullParam("account", account);
+        Assert.checkNotNullParam("challenge", challenge);
+        // ensure the token is valid before proceeding
+        String token = challenge.getToken();
+        if (! token.matches(TOKEN_REGEX)) {
+            throw LOGGER.invalidCertificateAuthorityChallenge();
+        }
+
+        // delete the file that was created to prove identifier control
+        String responseFilePath = WildFlySecurityManager.getPropertyPrivileged("jboss.home.dir", ".") + ACME_CHALLENGE_PREFIX + token;
+        File responseFile = new File(responseFilePath);
+        if (responseFile.exists()) {
+            responseFile.delete();
+        }
+    }
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/deployment/DependencyProcessor.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/deployment/DependencyProcessor.java
new file mode 100644
index 0000000..a7f85db
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/deployment/DependencyProcessor.java
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2019 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls.deployment;
+
+import org.jboss.as.server.deployment.Attachments;
+import org.jboss.as.server.deployment.DeploymentPhaseContext;
+import org.jboss.as.server.deployment.DeploymentUnit;
+import org.jboss.as.server.deployment.DeploymentUnitProcessor;
+import org.jboss.as.server.deployment.module.ModuleDependency;
+import org.jboss.as.server.deployment.module.ModuleSpecification;
+import org.jboss.modules.Module;
+import org.jboss.modules.ModuleLoader;
+
+/**
+ * @author <a href="mailto:kabir.khan@jboss.com">Kabir Khan</a>
+ */
+public class DependencyProcessor implements DeploymentUnitProcessor {
+
+    @Override
+    public void deploy(DeploymentPhaseContext phaseContext) {
+        DeploymentUnit deploymentUnit = phaseContext.getDeploymentUnit();
+
+        addModuleDependencies(deploymentUnit);
+    }
+
+    @Override
+    public void undeploy(DeploymentUnit context) {
+    }
+
+    private void addModuleDependencies(DeploymentUnit deploymentUnit) {
+        final ModuleSpecification moduleSpecification = deploymentUnit.getAttachment(Attachments.MODULE_SPECIFICATION);
+        final ModuleLoader moduleLoader = Module.getBootModuleLoader();
+
+        // Pull in dependencies needed by deployments in the subsystem
+
+        // This is needed if running with a security manager, and seems to be needed by arquillian in all cases
+        moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, "org.wildfly.security.manager", false, false, true, false));
+        moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, "org.wildfly.extension.elytron-tls", false, false, true, false));
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/DeploymentExpressionResolverProcessor.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/DeploymentExpressionResolverProcessor.java
new file mode 100644
index 0000000..cbe049e
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/DeploymentExpressionResolverProcessor.java
@@ -0,0 +1,50 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls.expression;
+
+import org.jboss.as.controller.capability.CapabilityServiceSupport;
+import org.jboss.as.server.deployment.Attachments;
+import org.jboss.as.server.deployment.DeploymentPhaseContext;
+import org.jboss.as.server.deployment.DeploymentUnit;
+import org.jboss.as.server.deployment.DeploymentUnitProcessingException;
+import org.jboss.as.server.deployment.DeploymentUnitProcessor;
+
+/**
+ * Attaches a function to the {@link DeploymentUnit} that can be used to resolve credential store expressions
+ * in deployment resources.
+ */
+public final class DeploymentExpressionResolverProcessor implements DeploymentUnitProcessor {
+
+    @Override
+    public void deploy(DeploymentPhaseContext phaseContext) throws DeploymentUnitProcessingException {
+        DeploymentUnit deploymentUnit = phaseContext.getDeploymentUnit();
+        CapabilityServiceSupport serviceSupport = deploymentUnit.getAttachment(Attachments.CAPABILITY_SERVICE_SUPPORT);
+        try {
+            final ElytronExpressionResolver resolver = serviceSupport.getCapabilityRuntimeAPI("org.wildfly.security.expression-resolver", ElytronExpressionResolver.class);
+            deploymentUnit.addToAttachmentList(Attachments.DEPLOYMENT_EXPRESSION_RESOLVERS, (s) -> resolver.resolveDeploymentExpression(s, serviceSupport));
+        } catch (CapabilityServiceSupport.NoSuchCapabilityException e) {
+            // /subsystem=elytron/expression=encryption resource is not present, so there's nothing to do.
+        }
+    }
+
+    @Override
+    public void undeploy(DeploymentUnit context) {
+
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/ElytronExpressionResolver.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/ElytronExpressionResolver.java
new file mode 100644
index 0000000..3bd9fd1
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/ElytronExpressionResolver.java
@@ -0,0 +1,322 @@
+/*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls.expression;
+
+import static org.wildfly.common.Assert.checkNotNullParam;
+import static org.wildfly.extension.elytron.tls._private.ElytronTLSMessages.LOGGER;
+import static org.wildfly.security.encryption.CipherUtil.decrypt;
+import static org.wildfly.security.encryption.CipherUtil.encrypt;
+
+import java.security.GeneralSecurityException;
+import java.util.Collections;
+import java.util.Map;
+
+import javax.crypto.SecretKey;
+
+import org.jboss.as.controller.ExpressionResolver;
+import org.jboss.as.controller.OperationClientException;
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+import org.jboss.as.controller.capability.CapabilityServiceSupport;
+import org.jboss.as.controller.extension.ExpressionResolverExtension;
+import org.wildfly.common.function.ExceptionBiConsumer;
+import org.wildfly.common.function.ExceptionFunction;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.credential.store.CredentialStoreException;
+
+/**
+ * An Elytron backed {@code ExpressionResolver} implementation to handle the decryption of encrypted expressions.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+public class ElytronExpressionResolver implements ExpressionResolverExtension {
+
+    private static final String CREDENTIAL_STORE_API_CAPABILITY = "org.wildfly.security.credential-store-api";
+
+    private volatile boolean initialised = false;
+    private final ThreadLocal<String> initialisingFor = new ThreadLocal<>();
+    private volatile OperationFailedException firstFailure = null;
+
+    private final ExceptionBiConsumer<ElytronExpressionResolver, OperationContext, OperationFailedException> configurator;
+
+    private volatile String prefix;
+    private volatile String completePrefix;
+    private volatile String defaultResolver;
+    private volatile Map<String, ResolverConfiguration> resolverConfigurations;
+
+    public ElytronExpressionResolver(ExceptionBiConsumer<ElytronExpressionResolver, OperationContext, OperationFailedException> configurator) {
+        this.configurator = configurator;
+    }
+
+    @Override
+    public void initialize(OperationContext context) throws OperationFailedException {
+        ensureInitialised(null, context);
+    }
+
+    @Override
+    public String resolveExpression(String expression, OperationContext context) {
+        checkNotNullParam("expression", expression);
+        checkNotNullParam("context", context);
+        return resolveExpressionInternal(expression, context, null);
+    }
+
+    /**
+     * Resolves expressions found in deployment resources.
+     *
+     * @param expression the expression string. Cannot be {@code null}
+     * @param serviceSupport support object to use to resolve the needed {@link CredentialStore}. Cannot be {@code null}
+     * @return the resolved expression string or {@code null} if {@code expression} isn't a credential store expression
+     *         or 'looks like' one but doesn't use the prefix supported by this resolver.
+     */
+    String resolveDeploymentExpression(String expression, CapabilityServiceSupport serviceSupport) {
+        return resolveExpressionInternal(expression, null, serviceSupport);
+    }
+
+    private String resolveExpressionInternal(String fullExpression, OperationContext operationContext, CapabilityServiceSupport serviceSupport) {
+        assert operationContext == null || serviceSupport == null;
+        assert operationContext != null || serviceSupport != null;
+
+        if (fullExpression.length() > 3) {
+            String expression = fullExpression.substring(2, fullExpression.length() - 1);
+
+            try {
+                ensureInitialised(fullExpression, operationContext);
+            } catch (OperationFailedException e) {
+                // Shouldn't happen. Any use that provides an OperationContext should have
+                // called initialize before trying to resolve. And ensureInitialized should not
+                // throw OFE if no OperationContext is provided
+                throw new IllegalStateException(e);
+            }
+
+            if (expression.startsWith(completePrefix)) {
+                int delimiter = expression.indexOf(':', completePrefix.length());
+                String resolver = delimiter > 0 ? expression.substring(completePrefix.length(), delimiter) : defaultResolver;
+                if (resolver == null) {
+                    throw LOGGER.expressionResolutionWithoutResolver(fullExpression);
+                }
+
+                ResolverConfiguration resolverConfiguration = resolverConfigurations.get(resolver);
+                if (resolverConfiguration == null) {
+                    throw LOGGER.invalidResolver(fullExpression);
+                }
+
+                LOGGER.tracef("Attempting to decrypt expression '%s' using credential store '%s' and alias '%s'.",
+                        fullExpression, resolverConfiguration.credentialStore, resolverConfiguration.alias);
+                CredentialStore credentialStore = resolveCredentialStore(resolverConfiguration.getCredentialStore(), operationContext, serviceSupport);
+                SecretKey secretKey;
+                try {
+                    SecretKeyCredential credential = credentialStore.retrieve(resolverConfiguration.getAlias(),
+                            SecretKeyCredential.class);
+                    secretKey = credential.getSecretKey();
+                } catch (CredentialStoreException e) {
+                    throw LOGGER.unableToLoadCredential(e);
+                }
+
+                String token = expression.substring(expression.lastIndexOf(':') + 1);
+
+                try {
+                    return decrypt(token, secretKey);
+                } catch (GeneralSecurityException e) {
+                    throw LOGGER.unableToDecryptExpression(fullExpression, e);
+                }
+            }
+        }
+        return null;
+    }
+
+    public String createExpression(final String resolver, final String clearText, OperationContext context) throws OperationFailedException {
+        ensureInitialised(null, context);
+        String resolvedResolver = resolver != null ? resolver : defaultResolver;
+        if (resolvedResolver == null) {
+            throw LOGGER.noResolverSpecifiedAndNoDefault();
+        }
+
+        ResolverConfiguration resolverConfiguration = resolverConfigurations.get(resolvedResolver);
+        if (resolverConfiguration == null) {
+            throw LOGGER.noResolverWithSpecifiedName(resolvedResolver);
+        }
+
+        CredentialStore credentialStore = resolveCredentialStore(resolverConfiguration.getCredentialStore(), context, null);
+        SecretKey secretKey;
+        try {
+            SecretKeyCredential credential = credentialStore.retrieve(resolverConfiguration.getAlias(), SecretKeyCredential.class);
+            if (credential == null) {
+                throw LOGGER.credentialDoesNotExist(resolverConfiguration.getAlias(), SecretKeyCredential.class.getSimpleName());
+            }
+            secretKey = credential.getSecretKey();
+        } catch (CredentialStoreException e) {
+            throw new OperationFailedException(LOGGER.unableToLoadCredential(e));
+        }
+
+        String cipherTextToken;
+        try {
+            cipherTextToken = encrypt(clearText, secretKey);
+        } catch (GeneralSecurityException e) {
+            throw LOGGER.unableToEncryptClearText(e);
+        }
+
+        return resolver == null ? String.format("${%s::%s}", prefix, cipherTextToken)
+                : String.format("${%s::%s:%s}", prefix, resolvedResolver, cipherTextToken);
+    }
+
+    public ElytronExpressionResolver setPrefix(final String prefix) {
+        this.prefix = prefix;
+        this.completePrefix = prefix + "::";
+
+        return this;
+    }
+
+    public ElytronExpressionResolver setDefaultResolver(final String defaultResolver) {
+        this.defaultResolver = defaultResolver;
+
+        return this;
+    }
+
+    public ElytronExpressionResolver setResolverConfigurations(final Map<String, ResolverConfiguration> resolverConfigurations) {
+        this.resolverConfigurations = Collections.unmodifiableMap(resolverConfigurations);
+
+        return this;
+    }
+
+    // Package-protected so ExpressionResolverRuntimeHandler can initialize
+    // on behalf of the add op that adds the /subsystem=elytron/expression=encryption resource
+    void ensureInitialised(String initialisingFor, OperationContext context) throws OperationFailedException {
+        if (!initialised) {
+
+            if (firstFailure != null) {
+                // We wrap the original OperationFaileException to ensure we have an appropriate stack trace on the
+                // subsequent error. Wrap with IllegalStateException as we don't want to repeatedly
+                // treat this failure as a user mistake; the user mistake was reported with the throw
+                // of the initial OFE. Don't wrap with ResolverExtensionException because that
+                // is only used if we tried to resolve an expression we know is appropriate for us,
+                // and this method is called before we know that.
+                throw LOGGER.expressionResolverInitialisationAlreadyFailed(firstFailure);
+            }
+
+            if (initialisingFor != null) {
+                String existingInitialisation = this.initialisingFor.get();
+                if (existingInitialisation != null) {
+                    throw LOGGER.cycleDetectedInitialisingExpressionResolver(existingInitialisation,
+                            existingInitialisation);
+                }
+            }
+
+            synchronized (this) {
+                if (!initialised) {
+                    try {
+                        this.initialisingFor.set(initialisingFor);
+                        if (context == null) {
+                            // If a caller that can't provide an OperationContext needs to initialize,
+                            // there's a programming bug as this object should be initialized
+                            // before any call paths are executed that don't come through
+                            // the OperationStepHandlers that provide a context.
+                            throw LOGGER.illegalNonManagementInitialization(getClass());
+                        }
+                        configurator.accept(this, context);
+                        initialised = true;
+                    } catch (OperationFailedException e) {
+                        firstFailure = e;
+                        throw e;
+                    } finally {
+                        this.initialisingFor.set(null);
+                    }
+                }
+            }
+        }
+    }
+
+    /**
+     * Gets the CredentialStore provided by the management resource with the given name.
+     *
+     * @param credentialStore the credential store resource name. Cannot be {@code null}.
+     * @param operationContext OperationContext to use for capability resolution. Can be {@code null} if {@code serviceSupport} is not {@code null}
+     * @param serviceSupport CapabilityServiceSupport to use for capability resolution. Can be {@code null} if {@code operationContext} is not {@code null}
+     * @return the CredentialStore
+     *
+     * @throws ExpressionResolver.ExpressionResolutionUserException if the credential store is not initialized and a failure occurs initializing it
+     * @throws ExpressionResolver.ExpressionResolutionServerException if capability lookup is disabled due to being in Stage.MODEL,
+     *                               if there is no credential store resource with the given name or if there is one
+     *                               but the store wasn't initialized and no OperationContext was provided to
+     *                               initialize it. (Both would indicate program flaws; the former a flaw in validating
+     *                               the data in a ResolverConfiguration; the latter an unexpected call pattern where
+     *                               deployment resource expression resolution can occur before credential store resources
+     *                               have been initialized by their OperationStepHandler.)
+     */
+    @SuppressWarnings("unchecked")
+    private CredentialStore resolveCredentialStore(String credentialStore, OperationContext operationContext, CapabilityServiceSupport serviceSupport) {
+
+        ExceptionFunction<OperationContext, CredentialStore, OperationFailedException> function;
+        RuntimeException toThrow;
+        try {
+            if (operationContext != null) {
+                try {
+                    function = operationContext.getCapabilityRuntimeAPI(CREDENTIAL_STORE_API_CAPABILITY, credentialStore, ExceptionFunction.class);
+                } catch (IllegalStateException re) {
+                    if (operationContext.getCurrentStage() == OperationContext.Stage.MODEL) {
+                        // Assume ISE is because capability lookups are not allowed in Stage.MODEL
+                        throw LOGGER.modelStageResolutionNotSupported(re);
+                    } else {
+                        throw re;
+                    }
+                }
+            } else {
+                checkNotNullParam("serviceSupport", serviceSupport);
+                function = serviceSupport.getCapabilityRuntimeAPI(CREDENTIAL_STORE_API_CAPABILITY, credentialStore, ExceptionFunction.class);
+            }
+
+            return function.apply(operationContext);
+        } catch (ExpressionResolver.ExpressionResolutionServerException | ExpressionResolver.ExpressionResolutionUserException ree) {
+            // Initializing the CredentialStore can itself trigger expression resolution, which can fail. Just propagate those.
+            toThrow = ree;
+        } catch (OperationFailedException | CapabilityServiceSupport.NoSuchCapabilityException | RuntimeException e) {
+            // Wrap in one of the ExpressionResolver.ResolverExtension exception types
+            // so exception handlers know the expression was relevant to us
+            if (e instanceof OperationClientException) {
+                // Use ExpressionResolutionUserException to wrap user failures
+                toThrow = LOGGER.unableToInitializeCredentialStore(credentialStore, e.getLocalizedMessage(), e);
+            } else {
+                // Use ExpressionResolutionServerException to wrap other failures
+                toThrow = LOGGER.unableToResolveCredentialStore(credentialStore, e.getLocalizedMessage(), e);
+            }
+        }
+
+        throw toThrow;
+    }
+
+    public static class ResolverConfiguration {
+
+        private final String credentialStore;
+        private final String alias;
+
+        public ResolverConfiguration(final String credentialStore, final String alias) {
+            this.credentialStore = checkNotNullParam("credentialStore", credentialStore);
+            this.alias = checkNotNullParam("alias", alias);
+        }
+
+        public String getCredentialStore() {
+            return credentialStore;
+        }
+
+        public String getAlias() {
+            return alias;
+        }
+    }
+
+
+
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/ExpressionResolverRuntimeHandler.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/ExpressionResolverRuntimeHandler.java
new file mode 100644
index 0000000..2cd16c4
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/ExpressionResolverRuntimeHandler.java
@@ -0,0 +1,34 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls.expression;
+
+import org.jboss.as.controller.OperationContext;
+import org.jboss.as.controller.OperationFailedException;
+
+/**
+ * Utility to allow the add handler for the /subsystem=elytron/expression=encryption resource
+ * to initialize the {@link ElytronExpressionResolver}.
+ */
+public final class ExpressionResolverRuntimeHandler {
+
+    public static void initializeResolver(OperationContext context) throws OperationFailedException {
+        ElytronExpressionResolver resolver = context.getCapabilityRuntimeAPI("org.wildfly.security.expression-resolver", ElytronExpressionResolver.class);
+        resolver.ensureInitialised(null, context);
+    }
+}
diff --git a/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/package-info.java b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/package-info.java
new file mode 100644
index 0000000..7a99c08
--- /dev/null
+++ b/subsystem/src/main/java/org/wildfly/extension/elytron/tls/expression/package-info.java
@@ -0,0 +1,22 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * ExpressionResolver implementation and integration.
+ */
+package org.wildfly.extension.elytron.tls.expression;
\ No newline at end of file
diff --git a/subsystem/src/main/resources/META-INF/services/org.jboss.as.controller.Extension b/subsystem/src/main/resources/META-INF/services/org.jboss.as.controller.Extension
new file mode 100644
index 0000000..17b60a9
--- /dev/null
+++ b/subsystem/src/main/resources/META-INF/services/org.jboss.as.controller.Extension
@@ -0,0 +1,17 @@
+#
+# Copyright 2022 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.wildfly.extension.elytron.tls.ElytronTlsExtension
diff --git a/subsystem/src/main/resources/META-INF/services/org.wildfly.security.x500.cert.acme.AcmeClientSpi b/subsystem/src/main/resources/META-INF/services/org.wildfly.security.x500.cert.acme.AcmeClientSpi
new file mode 100644
index 0000000..62c0060
--- /dev/null
+++ b/subsystem/src/main/resources/META-INF/services/org.wildfly.security.x500.cert.acme.AcmeClientSpi
@@ -0,0 +1 @@
+org.wildfly.extension.elytron.tls._private.WildFlyAcmeClient
diff --git a/subsystem/src/main/resources/org/wildfly/extension/elytron/tls/LocalDescriptions.properties b/subsystem/src/main/resources/org/wildfly/extension/elytron/tls/LocalDescriptions.properties
new file mode 100644
index 0000000..5c441bc
--- /dev/null
+++ b/subsystem/src/main/resources/org/wildfly/extension/elytron/tls/LocalDescriptions.properties
@@ -0,0 +1,609 @@
+#
+# Copyright 2022 Red Hat, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+elytron-tls=Elytron based subsystem for providing basic SSL/TLS features
+# Operations
+elytron-tls.add=Adds the Elytron TLS subsystem
+elytron-tls.remove=Removes the Elytron TLS subsystem
+# Attributes
+elytron-tls.initial-providers=Reference to the Providers that should be registered ahead of all existing Providers.
+elytron-tls.final-providers=Reference to the Providers that should be registered after all existing Providers.
+elytron-tls.disallowed-providers=A list of providers that are not allowed, and will be removed from the providers list.
+elytron-tls.default-ssl-context=Reference to the SSLContext which should be globally registered as the default.
+
+
+#####################################
+# Security Properties and Providers #
+#####################################
+
+elytron-tls.security-properties=Security properties to be set.
+
+elytron-tls.aggregate-providers=An aggregation of two or more Provider[] resources.
+# Operations
+elytron-tls.aggregate-providers.add=The add operation for the aggregated providers resource
+elytron-tls.aggregate-providers.remove=The remove operation for the aggregated providers resource
+# Attributes
+elytron-tls.aggregate-providers.providers=The referenced Provider[] resources to aggregate.
+
+elytron-tls.provider-loader=A definition for a Provider loader.
+# Operations
+elytron-tls.provider-loader.add=Add a new provider loader definition.
+elytron-tls.provider-loader.remove=Remove a provider loader definition.
+# Configuration Attributes
+elytron-tls.provider-loader.module=The name of the module to load the provider from.
+elytron-tls.provider-loader.class-names=The fully qualified class names of the providers to load, these are loaded after the service-loader discovered providers and duplicates will be skipped.
+elytron-tls.provider-loader.path=The path of the file to use to initialise the providers.
+elytron-tls.provider-loader.relative-to=The base path of the configuration file.
+elytron-tls.provider-loader.argument=An argument to be passed into the constructor as the Provider is instantiated.
+elytron-tls.provider-loader.configuration=The key/value configuration to be passed to the Provider to initialise it.
+# Runtime Attributes
+elytron-tls.provider-loader.loaded-providers=The list of providers loaded by this provider loader.
+elytron-tls.provider-loader.loaded-providers.name=The name reported by the provider instance.
+elytron-tls.provider-loader.loaded-providers.info=The information reported by the provider instance.
+elytron-tls.provider-loader.loaded-providers.version=The version reported by the provider instance.
+elytron-tls.provider-loader.loaded-providers.services=List of services available from this provider.
+elytron-tls.provider-loader.loaded-providers.type=The service type.
+elytron-tls.provider-loader.loaded-providers.algorithm=The algorithm supported by the service.
+elytron-tls.provider-loader.loaded-providers.class-name=The class name of the implementation of the service SPI.
+
+####################################
+#expression Resolver (Encryption) #
+####################################
+
+elytron-tls.expression=Definition of an expression resolver to decrypt encrypted expressions.
+elytron-tls.expression.encryption=Definition of an expression resolver to decrypt encrypted expressions.
+# Operations
+elytron-tls.expression.encryption.add=Add operation for the expression resolver.
+elytron-tls.expression.encryption.remove=Remove operation for the expression resolver.
+elytron-tls.expression.encryption.create-expression=Operation to encrypt the supplied clear text using the specified resolver and return a usable expression.
+elytron-tls.expression.encryption.create-expression.resolver=The resolver configuration to use to encrypt the clear text.  If omitted the default-resolver will be used instead.
+elytron-tls.expression.encryption.create-expression.clear-text=The clear text value to encrypt.
+
+# Attributes
+elytron-tls.expression.encryption.resolvers=List of expressions resolver definitions.
+elytron-tls.expression.encryption.resolvers.name=The name of the expression resolver definition.
+elytron-tls.expression.encryption.resolvers.credential-store=Reference to the credential store to be used by this resolver.
+elytron-tls.expression.encryption.resolvers.secret-key=The alias of the SecretKey within the credential store to use for encryption.
+elytron-tls.expression.encryption.default-resolver=The default expression resolver to use if not specified within the expression.  If not set there is no default.
+elytron-tls.expression.encryption.prefix=The prefix in use for encrypted expressions.
+
+
+#####################
+# Credential Stores #
+#####################
+
+# Original credential-store
+elytron-tls.credential-store=Credential store to keep alias for sensitive information such as passwords for external services.
+elytron-tls.credential-store.name=Name of the credential store.
+elytron-tls.credential-store.type=The credential store type, e.g. KeyStoreCredentialStore.
+elytron-tls.credential-store.credential-reference=Credential reference to be used to create protection parameter.
+elytron-tls.credential-store.credential-reference.store=The name of the credential store holding the alias to credential.
+elytron-tls.credential-store.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+elytron-tls.credential-store.credential-reference.type=The type of credential this reference is denoting.
+elytron-tls.credential-store.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+elytron-tls.credential-store.loaded-provider=Information about the provider that loaded implementation of this credential store type.
+elytron-tls.credential-store.loaded-provider.name=The name of the provider loader.
+elytron-tls.credential-store.loaded-provider.info=The information string about the provider loader.
+elytron-tls.credential-store.loaded-provider.version=The version of the provider used to load the credential store.
+elytron-tls.credential-store.providers=The name of the providers defined within the subsystem to obtain the Providers to search for the one that can create the required CredentialStore type. If this is not specified then the global list of Providers is used instead.
+elytron-tls.credential-store.other-providers=The name of the providers defined within the subsystem to obtain the Providers to search for the one that can create the required Jakarta Connectors objects within credential store. This is valid only for key-store based CredentialStore. If this is not specified then the global list of Providers is used instead.
+elytron-tls.credential-store.provider-name=The name of the provider to use to instantiate the CredentialStoreSpi. If the provider is not specified then the first provider found that can create an instance of the specified 'type' will be used.
+elytron-tls.credential-store.implementation-properties=Map of credentials store implementation specific properties.
+elytron-tls.credential-store.path=File name of credential store storage.
+elytron-tls.credential-store.location=File name of credential store storage.
+elytron-tls.credential-store.location.deprecated=Use the 'path' attribute instead.
+elytron-tls.credential-store.modifiable=Specifies whether credential store is modifiable.
+elytron-tls.credential-store.create=Specifies whether credential store should create storage when it does not exist.
+elytron-tls.credential-store.relative-to=A reference to a previously defined path that the file name is relative to.
+elytron-tls.credential-store.add=Add another credential store to the configuration.
+elytron-tls.credential-store.remove=Remove credential store from the configuration.
+elytron-tls.credential-store.reload=Reload credential store (reinitialize and load new data if present).
+elytron-tls.credential-store.state=The state of the underlying service that represents this credential store at runtime.
+
+# secret-key-credential-store
+elytron-tls.secret-key-credential-store=A simple credential store to manage secret keys store clearly.
+# Attributes
+elytron-tls.secret-key-credential-store.relative-to=A reference to a previously defined path that the path is relative to.
+elytron-tls.secret-key-credential-store.path=The path to the credential store.
+elytron-tls.secret-key-credential-store.create=If the credential store does not exist should it be dynamically created?
+elytron-tls.secret-key-credential-store.populate=If the credential store does not contain the default-alias should it be dynamically added?
+elytron-tls.secret-key-credential-store.key-size=The default size for any generated keys.
+elytron-tls.secret-key-credential-store.default-alias=The alias name of any key generated by default.
+elytron-tls.secret-key-credential-store.state=The state of the credential store service.
+# Operations
+elytron-tls.secret-key-credential-store.add=The add operation for the credential store.
+elytron-tls.secret-key-credential-store.remove=The remove operation for the credential store.
+
+# Operations For Credential Stores
+elytron-tls.credential-store.operations.add-alias=Add an alias to the credential store.
+elytron-tls.credential-store.operations.add-alias.alias=The alias of the credential store item to add.
+elytron-tls.credential-store.operations.add-alias.entry-type=Type of a credential (entry) stored in the credential store.
+elytron-tls.credential-store.operations.add-alias.secret-value=Secret value such as a password.
+elytron-tls.credential-store.operations.reload=Reload credential store (reinitialize and load new data if present).
+elytron-tls.credential-store.operations.read-aliases=Read aliases (entries) from a credential store.
+elytron-tls.credential-store.operations.remove-alias=Remove a credential (entry) stored in the credential store.
+elytron-tls.credential-store.operations.remove-alias.alias=The alias of the credential store item to remove.
+elytron-tls.credential-store.operations.remove-alias.entry-type=The type of the credential to remove.
+elytron-tls.credential-store.operations.set-secret=Set the secret value of a credential (entry) stored in the credential store.
+elytron-tls.credential-store.operations.set-secret.alias=The alias of the credential store item to set.
+elytron-tls.credential-store.operations.set-secret.entry-type=Type of a credential (entry) stored in the credential store.
+elytron-tls.credential-store.operations.set-secret.secret-value=Secret value such as a password.
+elytron-tls.credential-store.operations.generate-secret-key=Generate a new SecretKey and store it in the credential store.
+elytron-tls.credential-store.operations.generate-secret-key.alias=The alias to use when storing the new SecretKey.
+elytron-tls.credential-store.operations.generate-secret-key.key-size=The size of key to generate (bits).
+elytron-tls.credential-store.operations.export-secret-key=Export an existing SecretKey.
+elytron-tls.credential-store.operations.export-secret-key.alias=The alias of the SecretKey to export.
+elytron-tls.credential-store.operations.import-secret-key=Import a previously exported SecretKey and add it to the credential store.
+elytron-tls.credential-store.operations.import-secret-key.alias=The alias to use when storing the imported SecretKey.
+elytron-tls.credential-store.operations.import-secret-key.key=The previously exported key to import.
+
+
+##################
+# KeyStore #
+##################
+
+elytron-tls.key-store=A KeyStore definition.
+# Operations
+elytron-tls.key-store.add=Add a new KeyStore definition.
+elytron-tls.key-store.remove=Remove the KeyStore definition.
+elytron-tls.key-store.load=Load the KeyStore, if the KeyStore is file backed this will involve re-reading the contents of the file.
+elytron-tls.key-store.store=Store the KeyStore to file, this operation will fail for any KeyStore instances not backed by a file.  If the file does not exist and it was not flagged as required it will be created.
+# Configuration Attributes
+elytron-tls.key-store.type=The type of the KeyStore, used when creating the new KeyStore instance.
+elytron-tls.key-store.provider-name=The name of the provider to use to load the KeyStore, disables searching for the first Provider that can create a KeyStore of the specified type.
+elytron-tls.key-store.credential-reference=The reference to credential stored in CredentialStore under defined alias or clear text password.
+elytron-tls.key-store.credential-reference.store=The name of the credential store holding the alias to credential.
+elytron-tls.key-store.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+elytron-tls.key-store.credential-reference.type=The type of credential this reference is denoting.
+elytron-tls.key-store.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+elytron-tls.key-store.relative-to=The base path this store is relative to.
+elytron-tls.key-store.path=The path to the KeyStore file.
+elytron-tls.key-store.required=Is the file required to exist at the time the KeyStore service starts?
+elytron-tls.key-store.providers=A reference to the providers that should be used to obtain the list of Provider instances to search, if not specified the global list of providers will be used instead.
+elytron-tls.key-store.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+# Runtime Attributes
+elytron-tls.key-store.state=The state of the underlying service that represents this KeyStore at runtime, if it is anything other than UP runtime operations will not be available.
+elytron-tls.key-store.synchronized=The time this KeyStore was last loaded or saved. Note: Some providers may continue to apply updates after the KeyStore was loaded within the application server.
+elytron-tls.key-store.modified=Indicates if the in-memory representation of the KeyStore has been changed since it was last loaded or stored.  Note: For some providers updates may be immediate without further load or store calls.
+elytron-tls.key-store.loaded-provider=Information about the provider that was used for this KeyStore.
+elytron-tls.key-store.loaded-provider.name=The name of the provider used to load the KeyStore.
+elytron-tls.key-store.loaded-provider.info=The information string about the provider used to load the KeyStore.
+elytron-tls.key-store.loaded-provider.version=The version of the provider used to load the KeyStore.
+elytron-tls.key-store.size=The number of entries in the KeyStore.
+
+elytron-tls.key-store.alias=An individual alias within the KeyStore.
+elytron-tls.key-store.alias.remove=Immediately remove the alias from the KeyStore, the success of this operation will be dependent on the underlying KeyStore provider supporting removals.
+elytron-tls.key-store.alias.creation-date=The creation date of the entry represented by this alias.
+elytron-tls.key-store.alias.entry-type=The type of the entry for this alias. Note: Unrecognised types will be reported as 'Other'.
+
+elytron-tls.key-store.alias.certificate=The certificate associated with the alias (Note: If the alias has a certificate chain this will always be undefined).
+elytron-tls.key-store.alias.certificate-chain=The certificate chain associated with the alias.
+
+elytron-tls.key-store.alias.certificate.type=The type of the certificate.
+elytron-tls.key-store.alias.certificate.algorithm=The algorithm of the public key.
+elytron-tls.key-store.alias.certificate.format=The format of the public key.
+elytron-tls.key-store.alias.certificate.public-key=The encoded public key associated with the certificate.
+elytron-tls.key-store.alias.certificate.sha-1-digest=The SHA-1 digest (finger print) of the certificate.
+elytron-tls.key-store.alias.certificate.sha-256-digest=The SHA-256 digest (finger print) of the certificate.
+elytron-tls.key-store.alias.certificate.encoded=The encoded value of the certificate.
+elytron-tls.key-store.alias.certificate.subject=The subject from the certificate.
+elytron-tls.key-store.alias.certificate.issuer=The issuer of the certificate.
+elytron-tls.key-store.alias.certificate.not-before=The starting date and time the certificate is valid.
+elytron-tls.key-store.alias.certificate.not-after=The expiration date and time of the certificate.
+elytron-tls.key-store.alias.certificate.serial-number=The serial number of the certificate.
+elytron-tls.key-store.alias.certificate.signature-algorithm=The algorithm used to generate the certificates signature.
+elytron-tls.key-store.alias.certificate.signature=The signature of the certificate.
+elytron-tls.key-store.alias.certificate.version=The certificate version.
+
+elytron-tls.key-store.alias.certificate-chain.type=The type of the certificate.
+elytron-tls.key-store.alias.certificate-chain.algorithm=The algorithm of the public key.
+elytron-tls.key-store.alias.certificate-chain.format=The format of the public key.
+elytron-tls.key-store.alias.certificate-chain.public-key=The encoded public key associated with the certificate.
+elytron-tls.key-store.alias.certificate-chain.sha-1-digest=The SHA-1 digest (finger print) of the certificate.
+elytron-tls.key-store.alias.certificate-chain.sha-256-digest=The SHA-256 digest (finger print) of the certificate.
+elytron-tls.key-store.alias.certificate-chain.encoded=The encoded value of the certificate.
+elytron-tls.key-store.alias.certificate-chain.subject=The subject from the certificate.
+elytron-tls.key-store.alias.certificate-chain.issuer=The issuer of the certificate.
+elytron-tls.key-store.alias.certificate-chain.not-before=The starting date and time the certificate is valid.
+elytron-tls.key-store.alias.certificate-chain.not-after=The expiration date and time of the certificate.
+elytron-tls.key-store.alias.certificate-chain.serial-number=The serial number of the certificate.
+elytron-tls.key-store.alias.certificate-chain.signature-algorithm=The algorithm used to generate the certificates signature.
+elytron-tls.key-store.alias.certificate-chain.signature=The signature of the certificate.
+elytron-tls.key-store.alias.certificate-chain.version=The certificate version.
+
+elytron-tls.modifiable-key-store.read-alias=Read an alias from a KeyStore.
+elytron-tls.modifiable-key-store.read-alias.alias=The alias of the KeyStore item to read.
+elytron-tls.modifiable-key-store.read-alias.verbose=Whether or not to include the public key and encoded form of a certificate in the output. The default value is true.
+elytron-tls.modifiable-key-store.read-aliases=Read aliases from a KeyStore.
+elytron-tls.modifiable-key-store.read-aliases.recursive=Include information about each alias in the KeyStore. The default value is false.
+elytron-tls.modifiable-key-store.read-aliases.verbose=Whether or not to include the public key and encoded form of a certificate in the output. The default value is true.
+elytron-tls.modifiable-key-store.remove-alias=Remove an alias from a KeyStore.
+elytron-tls.modifiable-key-store.remove-alias.alias=The alias of the KeyStore item to remove.
+
+elytron-tls.modifiable-key-store.generate-key-pair=Generate a key pair and wrap the resulting public key in a self-signed X.509 certificate. The generated private key and self-signed certificate will be added to the KeyStore.
+elytron-tls.modifiable-key-store.generate-key-pair.alias=The alias of the new KeyStore entry.
+elytron-tls.modifiable-key-store.generate-key-pair.algorithm=The algorithm to be used to generate the key pair.
+elytron-tls.modifiable-key-store.generate-key-pair.key-size=The key size to use when generating the key pair.
+elytron-tls.modifiable-key-store.generate-key-pair.signature-algorithm=The signature algorithm name to use when signing the self-signed certificate.
+elytron-tls.modifiable-key-store.generate-key-pair.distinguished-name=The DN to use as both the subject DN and the issuer DN.
+elytron-tls.modifiable-key-store.generate-key-pair.not-before=The starting date and time the self-signed certificate is valid.
+elytron-tls.modifiable-key-store.generate-key-pair.validity=The number of days for which the self-signed certificate should be considered valid. The default value is 90 days.
+elytron-tls.modifiable-key-store.generate-key-pair.extensions=The list of X.509 certificate extensions to include in the self-signed certificate.
+elytron-tls.modifiable-key-store.generate-key-pair.credential-reference=The credential reference to be used to protect the generated private key.
+
+elytron-tls.modifiable-key-store.generate-certificate-signing-request=Generate a PKCS #10 certificate signing request.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.alias=The alias that identifies the PrivateKeyEntry to use to generate the certificate signing request.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.signature-algorithm=The signature algorithm name to use when signing the certificate signing request.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.distinguished-name=The DN to use in the certificate signing request. If not specified, the DN from the certificate will be used.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.extensions=The list of X.509 certificate extensions to include in the certificate signing request.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.credential-reference=The credential reference to be used to access the private key.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.path=The path to the file where the certificate signing request should be stored.
+elytron-tls.modifiable-key-store.generate-certificate-signing-request.relative-to=The base path of the certificate signing request file.
+
+elytron-tls.modifiable-key-store.extensions.name=The name of the X.509 certificate extension.
+elytron-tls.modifiable-key-store.extensions.critical=Specifies whether the X.509 certificate extension should be marked as critical. The default value is false.
+elytron-tls.modifiable-key-store.extensions.value=The value of the X.509 certificate extension.
+elytron-tls.modifiable-key-store.credential-reference.store=The name of the credential store holding the alias to the credential.
+elytron-tls.modifiable-key-store.credential-reference.alias=The alias which denotes the stored secret or credential in the store.
+elytron-tls.modifiable-key-store.credential-reference.type=The type of credential this reference is denoting.
+elytron-tls.modifiable-key-store.credential-reference.clear-text=Secret specified using clear text.
+
+elytron-tls.modifiable-key-store.import-certificate=Import a certificate or certificate chain from a file into a KeyStore entry.
+elytron-tls.modifiable-key-store.import-certificate.alias=The alias that identifies the KeyStore entry.
+elytron-tls.modifiable-key-store.import-certificate.credential-reference=The credential reference to be used to access the private key.
+elytron-tls.modifiable-key-store.import-certificate.path=The path to the file that contains the certificate or certificate chain to import in binary encoding format or printable encoding format.
+elytron-tls.modifiable-key-store.import-certificate.relative-to=The base path of the certificate file.
+elytron-tls.modifiable-key-store.import-certificate.trust-cacerts=Specifies whether certificates from the cacerts file should be included when creating / validating the certificate chain.
+elytron-tls.modifiable-key-store.import-certificate.validate=Specifies whether to validate that the top-most certificate is actually trusted when importing a certificate chain or whether to validate the certificate is actually trusted when importing a certificate. The default value is true. When this is set to true and validation fails, the certificate or certificate chain will not be imported into a KeyStore entry.
+
+elytron-tls.modifiable-key-store.export-certificate=Export a certificate from a KeyStore entry to a file.
+elytron-tls.modifiable-key-store.export-certificate.alias=The alias that identifies the KeyStore entry.
+elytron-tls.modifiable-key-store.export-certificate.path=The path to the file to export the certificate to.
+elytron-tls.modifiable-key-store.export-certificate.relative-to=The base path of the export file.
+elytron-tls.modifiable-key-store.export-certificate.pem=Specifies whether to export the certificate in printable encoding format. If not specified, the certificate will be exported in binary encoding format.
+
+elytron-tls.modifiable-key-store.change-alias=Move an existing KeyStore entry to a new alias.
+elytron-tls.modifiable-key-store.change-alias.alias=The alias that identifies the existing KeyStore entry to move.
+elytron-tls.modifiable-key-store.change-alias.new-alias=The new alias to use.
+elytron-tls.modifiable-key-store.change-alias.credential-reference=The credential reference to be used to access the existing KeyStore entry, if needed.
+
+elytron-tls.modifiable-key-store.obtain-certificate=Obtain a signed certificate from a certificate authority and store it in a KeyStore entry.
+elytron-tls.modifiable-key-store.obtain-certificate.alias=The alias of the KeyStore entry.
+elytron-tls.modifiable-key-store.obtain-certificate.domain-names=The list of DNS name(s) to request the certificate for.
+elytron-tls.modifiable-key-store.obtain-certificate.certificate-authority-account=A reference to the certificate authority account information that should be used to obtain the certificate.
+elytron-tls.modifiable-key-store.obtain-certificate.agree-to-terms-of-service=Indicates whether or not the user agrees to the certificate authority terms of service.
+elytron-tls.modifiable-key-store.obtain-certificate.staging=Indicates whether or not the certificate authority staging URL should be used. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+elytron-tls.modifiable-key-store.obtain-certificate.algorithm=The algorithm to be used to generate the key pair. The default value is RSA.
+elytron-tls.modifiable-key-store.obtain-certificate.key-size=The key size to use when generating the key pair. The default value is 2048.
+elytron-tls.modifiable-key-store.obtain-certificate.credential-reference=The credential reference to be used to protect the generated private key.
+
+elytron-tls.modifiable-key-store.revoke-certificate=Revoke a signed certificate.
+elytron-tls.modifiable-key-store.revoke-certificate.alias=The alias that identifies the KeyStore entry that contains the certificate to be revoked.
+elytron-tls.modifiable-key-store.revoke-certificate.reason=The reason for revocation.
+elytron-tls.modifiable-key-store.revoke-certificate.certificate-authority-account=A reference to the certificate authority account information that should be uesd to revoke the certificate.
+elytron-tls.modifiable-key-store.revoke-certificate.staging=Indicates whether or not the certificate authority staging URL should be used. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+
+elytron-tls.modifiable-key-store.should-renew-certificate=Check if a signed certificate is due for renewal.
+elytron-tls.modifiable-key-store.should-renew-certificate.alias=The alias that identifies the KeyStore entry that contains the certificate to check.
+elytron-tls.modifiable-key-store.should-renew-certificate.expiration=The number of days to expiry to be checked.
+
+
+##################
+# Managers #
+##################
+
+elytron-tls.key-manager=A key manager definition for creating the KeyManager as used to create an SSLContext.
+#operations
+elytron-tls.key-manager.add=Add the new key manager definition.
+elytron-tls.key-manager.remove=Remove the key manager definition.
+elytron-tls.key-manager.init=Reinitialize key manager.
+# Attributes
+elytron-tls.key-manager.algorithm=The name of the algorithm to use to create the underlying KeyManagerFactory.
+elytron-tls.key-manager.providers=Reference to obtain the Provider[] to use when creating the underlying KeyManagerFactory.
+elytron-tls.key-manager.provider-name=The name of the provider to use to create the underlying KeyManagerFactory.
+elytron-tls.key-manager.credential-reference=The credential reference to decrypt KeyStore item. (Not a password of the KeyStore.)
+elytron-tls.key-manager.credential-reference.store=The name of the credential store holding the alias to credential.
+elytron-tls.key-manager.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+elytron-tls.key-manager.credential-reference.type=The type of credential this reference is denoting.
+elytron-tls.key-manager.credential-reference.clear-text=The secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+elytron-tls.key-manager.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+elytron-tls.key-manager.generate-self-signed-certificate-host=If the file that backs the KeyStore does not exist and this attribute is set, then a self-signed certificate will be generated for the specified host name. This is not intended for production use.
+
+elytron-tls.key-manager.key-store=Reference to the KeyStore to use to initialise the underlying KeyManagerFactory.
+#elytron-tls.key-manager.key-store-object=KeyStore object to use to initialise the underlying KeyManagerFactory.
+#elytron-tls.key-manager.key-store-object.type=The type of the KeyStore, used when creating the new KeyStore instance.
+#elytron-tls.key-manager.key-store-object.provider-name=The name of the provider to use to load the KeyStore, disables searching for the first Provider that can create a KeyStore of the specified type.
+#elytron-tls.key-manager.key-store-object.credential-reference=The reference to credential stored in CredentialStore under defined alias or clear text password.
+#elytron-tls.key-manager.key-store-object.credential-reference.store=The name of the credential store holding the alias to credential.
+#elytron-tls.key-manager.key-store-object.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+#elytron-tls.key-manager.key-store-object.credential-reference.type=The type of credential this reference is denoting.
+#elytron-tls.key-manager.key-store-object.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+#elytron-tls.key-manager.key-store-object.relative-to=The base path this store is relative to.
+#elytron-tls.key-manager.key-store-object.path=The path to the KeyStore file.
+#elytron-tls.key-manager.key-store-object.required=Is the file required to exist at the time the KeyStore service starts?
+#elytron-tls.key-manager.key-store-object.providers=A reference to the providers that should be used to obtain the list of Provider instances to search, if not specified the global list of providers will be used instead.
+#elytron-tls.key-manager.key-store-object.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+
+elytron-tls.trust-manager=A trust manager definition for creating the TrustManager[] as used to create an SSLContext.
+#operations
+elytron-tls.trust-manager.add=Add the new trust manager definition.
+elytron-tls.trust-manager.remove=Remove the trust manager definition.
+elytron-tls.trust-manager.init=Reinitialize trust manager.
+# Attributes
+elytron-tls.trust-manager.algorithm=The name of the algorithm to use to create the underlying TrustManagerFactory.
+elytron-tls.trust-manager.providers=Reference to obtain the Provider[] to use when creating the underlying TrustManagerFactory.
+elytron-tls.trust-manager.provider-name=The name of the provider to use to create the underlying TrustManagerFactory.
+elytron-tls.trust-manager.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+elytron-tls.trust-manager.maximum-cert-path=The maximum number of non-self-issued intermediate certificates that may exist in a certification path for OCSP and CRL checks. If neither OCSP and CRL is configured, this attribute has no effect.
+elytron-tls.trust-manager.only-leaf-cert=Whether only leaf certificate should be checked for revocation status.
+elytron-tls.trust-manager.soft-fail=Whether a certificate with unknown OCSP response should be accepted.
+elytron-tls.trust-manager.certificate-revocation-list=Enables certificate revocation list checks to a trust manager.
+elytron-tls.trust-manager.certificate-revocation-list.path=The path to the configuration to use to initialise the provider.
+elytron-tls.trust-manager.certificate-revocation-list.relative-to=The base path of the certificate revocation list file.
+elytron-tls.trust-manager.certificate-revocation-list.maximum-cert-path=The maximum number of non-self-issued intermediate certificates that may exist in a certification path.
+elytron-tls.trust-manager.ocsp=Enables online certificate status protocol checks to a trust manager.
+elytron-tls.trust-manager.ocsp.prefer-crls=Whether a certificate-revocation-list should be preferred over OCSP.
+elytron-tls.trust-manager.ocsp.responder=The URL of OCSP responder to use. Keep undefined to use responder from the certificate.
+elytron-tls.trust-manager.ocsp.responder-certificate=The alias for OCSP Responder certificate. Keep undefined to use the issuer of certificate in validation.
+elytron-tls.trust-manager.ocsp.responder-keystore=Reference to the keystore for responder-certificate. Keep undefined to use trust-manager keystore. Requires responder-certificate to be defined.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object=Keystore object for responder-certificate. Keep undefined to use trust-manager keystore. Requires responder-certificate to be defined.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.type=The type of the KeyStore, used when creating the new KeyStore instance.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.provider-name=The name of the provider to use to load the KeyStore, disables searching for the first Provider that can create a KeyStore of the specified type.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.credential-reference=The reference to credential stored in CredentialStore under defined alias or clear text password.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.credential-reference.store=The name of the credential store holding the alias to credential.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.credential-reference.type=The type of credential this reference is denoting.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.relative-to=The base path this store is relative to.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.path=The path to the KeyStore file.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.required=Is the file required to exist at the time the KeyStore service starts?
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.providers=A reference to the providers that should be used to obtain the list of Provider instances to search, if not specified the global list of providers will be used instead.
+#elytron-tls.trust-manager.ocsp.responder-keystore-object.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+elytron-tls.trust-manager.reload-certificate-revocation-list=Notify the trust manager in order to reload the certificate revocation list, if defined.
+elytron-tls.trust-manager.certificate-revocation-lists=Enables certificate revocation list checks to a trust manager using multiple certificate revocation lists.
+elytron-tls.trust-manager.certificate-revocation-lists.path=The path to the certificate revocation list.
+elytron-tls.trust-manager.certificate-revocation-lists.relative-to=The base path of the certificate revocation list file.
+
+elytron-tls.trust-manager.key-store=Reference to the KeyStore to use to initialise the underlying TrustManagerFactory.
+#elytron-tls.trust-manager.key-store-object=KeyStore object to use to initialise the underlying TrustManagerFactory.
+#elytron-tls.trust-manager.key-store-object.type=The type of the KeyStore, used when creating the new KeyStore instance.
+#elytron-tls.trust-manager.key-store-object.provider-name=The name of the provider to use to load the KeyStore, disables searching for the first Provider that can create a KeyStore of the specified type.
+#elytron-tls.trust-manager.key-store-object.credential-reference=The reference to credential stored in CredentialStore under defined alias or clear text password.
+#elytron-tls.trust-manager.key-store-object.credential-reference.store=The name of the credential store holding the alias to credential.
+#elytron-tls.trust-manager.key-store-object.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+#elytron-tls.trust-manager.key-store-object.credential-reference.type=The type of credential this reference is denoting.
+#elytron-tls.trust-manager.key-store-object.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+#elytron-tls.trust-manager.key-store-object.relative-to=The base path this store is relative to.
+#elytron-tls.trust-manager.key-store-object.path=The path to the KeyStore file.
+#elytron-tls.trust-manager.key-store-object.required=Is the file required to exist at the time the KeyStore service starts?
+#elytron-tls.trust-manager.key-store-object.providers=A reference to the providers that should be used to obtain the list of Provider instances to search, if not specified the global list of providers will be used instead.
+#elytron-tls.trust-manager.key-store-object.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+
+
+##################
+# Certificate Authorities #
+##################
+
+elytron-tls.certificate-authority=A certificate authority definition.
+# Operations
+elytron-tls.certificate-authority.add=Add a new certificate authority definition.
+elytron-tls.certificate-authority.remove=Remove the certificate authority definition.
+# Configuration Attributes
+elytron-tls.certificate-authority.url=URL of the certificate authority.
+elytron-tls.certificate-authority.staging-url=URL of the certificate authority to use in pre-production.
+
+elytron-tls.certificate-authority-account=A certificate authority account definition.
+# Operations
+elytron-tls.certificate-authority-account.add=Add a new certificate authority account definition.
+elytron-tls.certificate-authority-account.remove=Remove the certificate authority account definition.
+elytron-tls.certificate-authority-account.create-account=Create an account with the certificate authority if one does not already exist.
+elytron-tls.certificate-authority-account.create-account.agree-to-terms-of-service=Indicates whether or not the user agrees to the certificate authority terms of service.
+elytron-tls.certificate-authority-account.create-account.staging=Indicates whether or not the certificate authority staging URL should be used. The default value is false. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+elytron-tls.certificate-authority-account.update-account=Update an account with the certificate authority.
+elytron-tls.certificate-authority-account.update-account.agree-to-terms-of-service=Indicates whether or not the user agrees to the certificate authority terms of service.
+elytron-tls.certificate-authority-account.update-account.staging=Indicates whether or not the certificate authority staging URL should be used. The default value is false. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+elytron-tls.certificate-authority-account.change-account-key=Change the key associated with this certificate authority account.
+elytron-tls.certificate-authority-account.change-account-key.staging=Indicates whether or not the certificate authority staging URL should be used. The default value is false. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+elytron-tls.certificate-authority-account.deactivate-account=Deactivate this certificate authority account.
+elytron-tls.certificate-authority-account.deactivate-account.staging=Indicates whether or not the certificate authority staging URL should be used. The default value is false. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+elytron-tls.certificate-authority-account.get-metadata=Get the metadata associated with the certificate authority.
+elytron-tls.certificate-authority-account.get-metadata.staging=Indicates whether or not the certificate authority staging URL should be used. The default value is false. This should only be set to true for testing purposes. This should never be set to true in a production environment.
+
+# Configuration Attributes
+elytron-tls.certificate-authority-account.certificate-authority=The name of the certificate authority to use.
+elytron-tls.certificate-authority-account.contact-urls=A list of URLs that the certificate authority can contact about any issues related to this account.
+elytron-tls.certificate-authority-account.alias=The alias of certificate authority account key in the keystore. If the alias does not already exist in the keystore, a certificate authority account key will be automatically generated and stored as a PrivateKeyEntry under the alias.
+elytron-tls.certificate-authority-account.credential-reference=Credential to be used when accessing the certificate authority account key.
+elytron-tls.certificate-authority-account.credential-reference.store=The name of the credential store holding the alias to credential.
+elytron-tls.certificate-authority-account.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+elytron-tls.certificate-authority-account.credential-reference.type=The type of credential this reference is denoting.
+elytron-tls.certificate-authority-account.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+elytron-tls.server-ssl-sni-context=A server side SNI Aware SSLContext that selects between an underlying context based on the provided SNI name
+elytron-tls.server-ssl-sni-context.add=Adds a SNI context
+elytron-tls.server-ssl-sni-context.remove=Removes a SNI context
+elytron-tls.server-ssl-sni-context.default-ssl-context=The context to use if no SNI information is present, or if it does not match any mappings
+elytron-tls.server-ssl-sni-context.host-context-map=A mapping between a server name and an SSContext
+
+elytron-tls.certificate-authority-account.key-store=Reference to the keystore that contains the certificate authority account key.
+#elytron-tls.certificate-authority-account.key-store-object=KeyStore object that contains the certificate authority account key.
+#elytron-tls.certificate-authority-account.key-store-object.type=The type of the KeyStore, used when creating the new KeyStore instance.
+#elytron-tls.certificate-authority-account.key-store-object.provider-name=The name of the provider to use to load the KeyStore, disables searching for the first Provider that can create a KeyStore of the specified type.
+#elytron-tls.certificate-authority-account.key-store-object.credential-reference=The reference to credential stored in CredentialStore under defined alias or clear text password.
+#elytron-tls.certificate-authority-account.key-store-object.credential-reference.store=The name of the credential store holding the alias to credential.
+#elytron-tls.certificate-authority-account.key-store-object.credential-reference.alias=The alias which denotes stored secret or credential in the store.
+#elytron-tls.certificate-authority-account.key-store-object.credential-reference.type=The type of credential this reference is denoting.
+#elytron-tls.certificate-authority-account.key-store-object.credential-reference.clear-text=Secret specified using clear text. Check credential store way of supplying credential/secrets to services.
+#elytron-tls.certificate-authority-account.key-store-object.relative-to=The base path this store is relative to.
+#elytron-tls.certificate-authority-account.key-store-object.path=The path to the KeyStore file.
+#elytron-tls.certificate-authority-account.key-store-object.required=Is the file required to exist at the time the KeyStore service starts?
+#elytron-tls.certificate-authority-account.key-store-object.providers=A reference to the providers that should be used to obtain the list of Provider instances to search, if not specified the global list of providers will be used instead.
+#elytron-tls.certificate-authority-account.key-store-object.alias-filter=A filter to apply to the aliases returned from the KeyStore, can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+
+##################
+# SSL Contexts #
+##################
+
+# TODO: enable creating objects for SSL contexts
+
+elytron-tls.client-ssl-context=An SSLContext for use on the client side of a connection.
+# operations
+elytron-tls.client-ssl-context.add=Add the SSLContext definition.
+elytron-tls.client-ssl-context.remove=Remove the SSLContext definition.
+# Attributes
+elytron-tls.client-ssl-context.cipher-suite-filter=The filter to apply to specify the enabled cipher suites for TLSv1.2 and below.
+elytron-tls.client-ssl-context.cipher-suite-names=The filter to apply to specify the enabled cipher suites for TLSv1.3.
+elytron-tls.client-ssl-context.protocols=The enabled protocols.
+elytron-tls.client-ssl-context.use-cipher-suites-order=To honor local cipher suites preference.
+elytron-tls.client-ssl-context.maximum-session-cache-size=The maximum number of SSL sessions in the cache. The default value -1 means use the JVM default value. Value zero means there is no limit.
+elytron-tls.client-ssl-context.session-timeout=The timeout for SSL sessions, in seconds. The default value -1 means use the JVM default value. Value zero means there is no limit.
+elytron-tls.client-ssl-context.key-manager=Reference to the key manager to use within the SSLContext.
+#elytron-tls.client-ssl-context.key-manager-object=Key manager object to use within the SSLContext.
+elytron-tls.client-ssl-context.key-refresh=Refresh KeyManager used by SSLContext.
+elytron-tls.client-ssl-context.trust-manager=Reference to the trust manager to use within the SSLContext.
+#elytron-tls.client-ssl-context.trust-manager-object=Trust manager object to use within the SSLContext.
+elytron-tls.client-ssl-context.provider-name=The name of the provider to use. If not specified, all providers from providers will be passed to the SSLContext.
+elytron-tls.client-ssl-context.providers=The name of the providers to obtain the Provider[] to use to load the SSLContext.
+
+# Runtime Attributes
+elytron-tls.client-ssl-context.active-session-count=The count of current active sessions.
+
+elytron-tls.client-ssl-context.ssl-session=A currently established SSL session.
+elytron-tls.client-ssl-context.ssl-session.application-buffer-size=The application buffer size as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.cipher-suite=The selected cipher suite as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.creation-time=The creation time as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.last-accessed-time=The last accessed time as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.local-principal=The local principal as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.packet-buffer-size=The packet buffer size as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.peer-host=The peer host as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.peer-port=The peer port as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.peer-principal=The peer principal as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.protocol=The protocol as reported by the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.valid=The validity of the session as reported by the SSLSession.
+
+elytron-tls.client-ssl-context.ssl-session.local-certificates=The local certificates from the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.type=The type of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.algorithm=The algorithm of the public key.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.format=The format of the public key.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.public-key=The encoded public key associated with the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.sha-1-digest=The SHA-1 digest (finger print) of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.sha-256-digest=The SHA-256 digest (finger print) of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.encoded=The encoded value of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.subject=The subject from the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.issuer=The issuer of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.not-before=The starting date and time the certificate is valid.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.not-after=The expiration date and time of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.serial-number=The serial number of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.signature-algorithm=The algorithm used to generate the certificates signature.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.signature=The signature of the certificate.
+elytron-tls.client-ssl-context.ssl-session.local-certificates.version=The certificate version.
+
+elytron-tls.client-ssl-context.ssl-session.peer-certificates=The peer certificates from the SSLSession.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.type=The type of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.algorithm=The algorithm of the public key.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.format=The format of the public key.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.public-key=The encoded public key associated with the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.sha-1-digest=The SHA-1 digest (finger print) of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.sha-256-digest=The SHA-256 digest (finger print) of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.encoded=The encoded value of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.subject=The subject from the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.issuer=The issuer of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.not-before=The starting date and time the certificate is valid.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.not-after=The expiration date and time of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.serial-number=The serial number of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.signature-algorithm=The algorithm used to generate the certificates signature.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.signature=The signature of the certificate.
+elytron-tls.client-ssl-context.ssl-session.peer-certificates.version=The certificate version.
+
+
+elytron-tls.server-ssl-context=An SSLContext for use on the server side of a connection.
+# operations
+elytron-tls.server-ssl-context.add=Add the SSLContext definition.
+elytron-tls.server-ssl-context.remove=Remove the SSLContext definition.
+# Attributes
+elytron-tls.server-ssl-context.security-domain=The security domain to use for authentication during SSL session establishment.
+elytron-tls.server-ssl-context.cipher-suite-filter=The filter to apply to specify the enabled cipher suites for TLSv1.2 and below.
+elytron-tls.server-ssl-context.cipher-suite-names=The filter to apply to specify the enabled cipher suites for TLSv1.3.
+elytron-tls.server-ssl-context.protocols=The enabled protocols.
+elytron-tls.server-ssl-context.want-client-auth=To request (but not to require) a client certificate on SSL handshake. If a security domain is referenced and supports X509 evidence, this will be set to true automatically. Ignored when need-client-auth is set.
+elytron-tls.server-ssl-context.need-client-auth=To require a client certificate on SSL handshake. Connection without trusted client certificate (see trust-manager) will be rejected.
+elytron-tls.server-ssl-context.authentication-optional=Rejecting of the client certificate by the security domain will not prevent the connection. Allows a fall through to use other authentication mechanisms (like form login) when the client certificate is rejected by security domain. Has an effect only when the security domain is set.
+elytron-tls.server-ssl-context.use-cipher-suites-order=To honor local cipher suites preference.
+elytron-tls.server-ssl-context.maximum-session-cache-size=The maximum number of SSL sessions in the cache. The default value -1 means use the JVM default value. Value zero means there is no limit.
+elytron-tls.server-ssl-context.session-timeout=The timeout for SSL sessions, in seconds. The default value -1 means use the JVM default value. Value zero means there is no limit.
+elytron-tls.server-ssl-context.wrap=Should the SSLEngine, SSLSocket, and SSLServerSocket instances returned be wrapped to protect against further modification.
+elytron-tls.server-ssl-context.key-manager=Reference to the key manager to use within the SSLContext.
+#elytron-tls.server-ssl-context.key-manager-object=Key manager object to use within the SSLContext.
+elytron-tls.server-ssl-context.key-refresh=Refresh KeyManager used by SSLContext.
+elytron-tls.server-ssl-context.trust-manager=Reference to the trust manager to use within the SSLContext.
+#elytron-tls.server-ssl-context.trust-manager-object=Trust manager object to use within the SSLContext.
+elytron-tls.server-ssl-context.pre-realm-principal-transformer=A principal transformer to apply before the realm is selected.
+elytron-tls.server-ssl-context.post-realm-principal-transformer=A principal transformer to apply after the realm is selected.
+elytron-tls.server-ssl-context.final-principal-transformer=A final principal transformer to apply for this mechanism realm.
+elytron-tls.server-ssl-context.realm-mapper=The realm mapper to be used for SSL authentication.
+elytron-tls.server-ssl-context.provider-name=The name of the provider to use. If not specified, all providers from providers will be passed to the SSLContext.
+elytron-tls.server-ssl-context.providers=The name of the providers to obtain the Provider[] to use to load the SSLContext.
+# Runtime Attributes
+elytron-tls.server-ssl-context.active-session-count=The count of current active sessions.
+
+elytron-tls.server-ssl-context.ssl-session=A currently established SSL session.
+elytron-tls.server-ssl-context.ssl-session.application-buffer-size=The application buffer size as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.cipher-suite=The selected cipher suite as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.creation-time=The creation time as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.last-accessed-time=The last accessed time as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.local-principal=The local principal as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.packet-buffer-size=The packet buffer size as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.peer-host=The peer host as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.peer-port=The peer port as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.peer-principal=The peer principal as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.protocol=The protocol as reported by the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.valid=The validity of the session as reported by the SSLSession.
+
+elytron-tls.server-ssl-context.ssl-session.local-certificates=The local certificates from the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.type=The type of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.algorithm=The algorithm of the public key.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.format=The format of the public key.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.public-key=The encoded public key associated with the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.sha-1-digest=The SHA-1 digest (finger print) of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.sha-256-digest=The SHA-256 digest (finger print) of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.encoded=The encoded value of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.subject=The subject from the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.issuer=The issuer of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.not-before=The starting date and time the certificate is valid.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.not-after=The expiration date and time of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.serial-number=The serial number of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.signature-algorithm=The algorithm used to generate the certificates signature.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.signature=The signature of the certificate.
+elytron-tls.server-ssl-context.ssl-session.local-certificates.version=The certificate version.
+
+elytron-tls.server-ssl-context.ssl-session.peer-certificates=The peer certificates from the SSLSession.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.type=The type of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.algorithm=The algorithm of the public key.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.format=The format of the public key.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.public-key=The encoded public key associated with the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.sha-1-digest=The SHA-1 digest (finger print) of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.sha-256-digest=The SHA-256 digest (finger print) of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.encoded=The encoded value of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.subject=The subject from the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.issuer=The issuer of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.not-before=The starting date and time the certificate is valid.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.not-after=The expiration date and time of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.serial-number=The serial number of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.signature-algorithm=The algorithm used to generate the certificates signature.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.signature=The signature of the certificate.
+elytron-tls.server-ssl-context.ssl-session.peer-certificates.version=The certificate version.
+
+# Operations
+elytron-tls.server-ssl-context.ssl-session.invalidate=Invalidate the SSLSession (Note: This does not terminate current connections, only prevents future connections from joining or resuming this session).
diff --git a/subsystem/src/main/resources/schema/elytron-tls-subsystem_1_0.xsd b/subsystem/src/main/resources/schema/elytron-tls-subsystem_1_0.xsd
new file mode 100644
index 0000000..5dca1f6
--- /dev/null
+++ b/subsystem/src/main/resources/schema/elytron-tls-subsystem_1_0.xsd
@@ -0,0 +1,1336 @@
+<!--
+  ~ Copyright 2022 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           targetNamespace="urn:wildfly:elytron-tls-subsystem:1.0"
+           xmlns="urn:wildfly:elytron-tls-subsystem:1.0"
+           xmlns:credential-reference="urn:wildfly:credential-reference:1.1"
+           elementFormDefault="qualified"
+           attributeFormDefault="unqualified"
+           version="1.0">
+
+    <!-- Shared credential reference schema -->
+    <xs:import namespace="urn:wildfly:credential-reference:1.1" schemaLocation="wildfly-credential-reference_1_1.xsd"/>
+
+    <!-- The subsystem root element -->
+    <xs:element name="subsystem" type="subsystemType"/>
+
+    <xs:complexType name="subsystemType">
+        <xs:all>
+            <xs:element name="security-properties" type="securityPropertiesType" minOccurs="0" />
+            <xs:element name="providers" type="providersType" minOccurs="0" />
+            <xs:element name="tls" type="tlsType" minOccurs="0" />
+            <xs:element name="credential-stores" type="credentialStoresType" minOccurs="0" />
+            <xs:element name="expression-resolver" type="expressionResolverType" minOccurs="0" />
+        </xs:all>
+        <xs:attribute name="initial-providers" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to a capability providing a Provider[] which will be registered globally ahead of all existing Provider registrations.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="final-providers" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to a capability providing a Provider[] which will be registered globally after all existing Provider registrations.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="disallowed-providers" type="stringListType">
+            <xs:annotation>
+                <xs:documentation>
+                    A list of providers that are disallowed, and will be removed from the providers list.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="default-ssl-context" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to an SSLContext which should be globally registered as the default.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!--
+        Security Properties
+     -->
+
+    <xs:complexType name="securityPropertiesType">
+        <xs:annotation>
+            <xs:documentation>
+                Type to contain a list of security properties to be set.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="security-property" type="propertyType" maxOccurs="unbounded" />
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="propertyType">
+        <xs:annotation>
+            <xs:documentation>
+                Representation of a key/value property pair.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The key for this property.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="value" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The value for this property.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!--
+        Providers
+     -->
+
+    <xs:complexType name="providersType">
+        <xs:annotation>
+            <xs:documentation>
+                Container of Provider configuration.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:choice maxOccurs="unbounded">
+            <xs:element name="aggregate-providers" type="aggregateProvidersType" />
+            <xs:element name="provider-loader" type="providerLoaderType" />
+        </xs:choice>
+    </xs:complexType>
+
+    <xs:complexType name="aggregateProvidersType">
+        <xs:annotation>
+            <xs:documentation>
+                A PrincipalDecoder definition that is actually an aggregation of other PrincipalDecoders.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="providers" type="providersRefType" minOccurs="2" maxOccurs="unbounded" />
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The name to use to represent this provider loader in the management model.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="providersRefType">
+        <xs:annotation>
+            <xs:documentation>
+                A reference to a Provider[] resource.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required" />
+    </xs:complexType>
+
+    <xs:complexType name="providerLoaderType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a single provider loader.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="configuration" minOccurs="0" >
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="property" type="propertyType" maxOccurs="unbounded" />
+                    </xs:sequence>
+                </xs:complexType>
+            </xs:element>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The name to use to represent this provider loader in the management model.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="module" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the module to use to load the providers.
+
+                    If this is not specified the ClassLoader used to load the service will be used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="class-names" type="stringListType">
+            <xs:annotation>
+                <xs:documentation>
+                    The fully qualified class names of the providers to load.
+
+                    If this attribute is not specified then service loader based discovery will be used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="path" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    The path to the configuration to use to initialise the provider.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="relative-to" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    A reference to a previously defined path that the path of the configuration is
+                    relative to.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="argument" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Argument to pass into the constructor as the Provider is instantiated.
+
+                    Can only be used where the class names to load are specified.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!-- TODO: add objects for key store, trust manager, key stores-->
+    <xs:complexType name="tlsType">
+        <xs:annotation>
+            <xs:documentation>
+                Complex type to contain the definitions of the various components needed
+                for SSL, the end result being that these components can be combined together to
+                create a fully defined SSLContext.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:all>
+            <xs:element name="client-ssl-contexts" type="clientSSLContextsType" minOccurs="0" />
+            <xs:element name="server-ssl-contexts" type="serverSSLContextsType" minOccurs="0" />
+            <xs:element name="certificate-authorities" type="certificateAuthoritiesType" minOccurs="0" />
+            <xs:element name="certificate-authority-accounts" type="certificateAuthorityAccountsType" minOccurs="0" />
+            <xs:element name="key-managers" type="keyManagersType" minOccurs="0" />
+            <xs:element name="trust-managers" type="trustManagersType" minOccurs="0" />
+            <xs:element name="key-stores" type="keyStoresType" minOccurs="0" />
+        </xs:all>
+    </xs:complexType>
+
+    <!---
+        SSL Contexts
+    -->
+
+    <xs:complexType name="clientSSLContextsType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for client SSLContext definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="client-ssl-context" type="clientSSLContextType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="clientSSLContextType">
+        <xs:annotation>
+            <xs:documentation>
+                Definitions of a single client side SSLContext.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this client side SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="cipher-suite-filter" type="xs:string" use="optional" default="DEFAULT">
+            <xs:annotation>
+                <xs:documentation>
+                    The filter to be applied to the cipher suites made available by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="cipher-suite-names" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The filter to be applied to the TLSv1.3 cipher suites made available by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="protocols" type="stringListType" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    List of protocols supported by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="key-manager" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the KeyManager to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="key-manager-object" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    KeyManager object to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="trust-manager" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the TrustManager to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="trust-manager-object" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    TrustManager object to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="provider-name" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the provider to use.
+                    If not specified, all providers from providers will be passed to the SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers to obtain the Provider[] to use to load the SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="serverSSLContextsType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for Server SSLContext definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="server-ssl-context" type="serverSSLContextType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="serverSSLContextType">
+        <xs:annotation>
+            <xs:documentation>
+                Definitions of a single server side SSLContext.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this Server side SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="cipher-suite-filter" type="xs:string" use="optional" default="DEFAULT">
+            <xs:annotation>
+                <xs:documentation>
+                    The filter to be applied to the cipher suites made available by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="cipher-suite-names" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The filter to be applied to the TLSv1.3 cipher suites made available by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="protocols" type="stringListType" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    List of protocols supported by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="want-client-auth" type="xs:boolean" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    To request (but not to require) a client certificate on SSL handshake.
+                    Ignored when need-client-auth is set.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="need-client-auth" type="xs:boolean" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    To require a client certificate on SSL handshake.
+                    Connection without trusted client certificate (see trust-manager) will be rejected.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="authentication-optional" type="xs:boolean" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    Rejecting of the client certificate by the security domain will not prevent the connection.
+                    Allows a fall through to use other authentication mechanisms (like form login) when the client certificate is rejected by security domain.
+                    Has an effect only when the security domain is set.
+                    This does not bypass the underlying trust manager check - see need-client-auth to allow connection without client certificate.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="use-cipher-suites-order" type="xs:boolean" default="true">
+            <xs:annotation>
+                <xs:documentation>
+                    Configure the SSLContext to honor local cipher suites preference.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="maximum-session-cache-size" type="xs:int" default="-1">
+            <xs:annotation>
+                <xs:documentation>
+                    The maximum number of SSL sessions in the cache. The default value -1 means use the JVM default value. Value zero means there is no limit.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="session-timeout" type="xs:int" default="-1">
+            <xs:annotation>
+                <xs:documentation>
+                    The timeout for SSL sessions, in seconds. The default value -1 means use the JVM default value. Value zero means there is no limit.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="wrap" type="xs:boolean" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    Should the resulting SSLEngine, SSLSocketFactory, and SSLSocket instances returned by this SSLContext
+                    be wrapped to prevent further configuration changes.
+
+                    Note:  The WildFly HTTP2 support requires raw access to these objects so if HTTP2 is being used this
+                    should be set to false.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="key-manager" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the KeyManager to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="key-manager-object" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    KeyManager object to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="trust-manager" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the TrustManager to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="trust-manager-object" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    TrustManager object to be used by this SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="provider-name" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the provider to use.
+                    If not specified, all providers from providers will be passed to the SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers to obtain the Provider[] to use to load the SSLContext.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!-- 
+        Certificate Authorities
+    -->
+
+    <xs:complexType name="certificateAuthorityAccountsType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for certificate authority account definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="certificate-authority-account" type="certificateAuthorityAccountType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="certificateAuthorityAccountType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a single certificate authority account.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:all>
+            <xs:element name="account-key" type="accountKeyType" minOccurs="1"/>
+        </xs:all>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this certificate authority account.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="certificate-authority" type="xs:string" default="LetsEncrypt">
+            <xs:annotation>
+                <xs:documentation>
+                    The reference to certificate authority to use.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="contact-urls" type="stringListType" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    A list of URLs that the certificate authority can contact about any issues related to this account.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="certificateAuthoritiesType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for certificate authority definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="certificate-authority" type="certificateAuthorityType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="certificateAuthorityType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a single certificate authority.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this certificate authority.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="url" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    URL of the certificate authority.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="staging-url" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    URL of the certificate authority to use in pre-production.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="accountKeyType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a certificate authority account key.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:all>
+            <xs:element name="credential-reference" type="credential-reference:credentialReferenceType">
+                <xs:annotation>
+                    <xs:documentation>
+                        Credential to be used when accessing the certificate authority account key.
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
+        </xs:all>
+        <xs:attribute name="key-store" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the KeyStore that contains the certificate authority account key.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="key-store-object" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    KeyStore object to use with the KeyManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="alias" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The alias of the certificate authority account key in the KeyStore.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!--
+        Managers
+    -->
+
+    <xs:complexType name="keyManagersType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for KeyManager definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="key-manager" type="keyManagerType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="keyManagerType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a single KeyManager.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:all>
+            <xs:element name="credential-reference" type="credential-reference:credentialReferenceType">
+                <xs:annotation>
+                    <xs:documentation>
+                        Credential to be used by the underlying KeyManager when accessing the entries in the underlying KeyStore.
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
+        </xs:all>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this KeyManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="algorithm" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The algorithm name to use to initialise the KeyManagerFactory.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="key-store" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the KeyStore to use with the KeyManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="key-store-object" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    KeyStore object to use with the KeyManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="alias-filter" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    A filter to apply to the aliases provided by KeyStore to choose key to use from keys in KeyStore.
+
+                    Can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="provider-name" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the provider to use to
+                    instantiate the KeyManagerFactory, if the provider is not
+                    specified then the first provider found that can
+                    create an instance of the specified 'type' will be
+                    used.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers defined within the subsystem to obtain the Providers
+                    to search for the one that can create the required KeyManagerFactory type.
+
+                    If this is not specified then the global list of Providers is used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="generate-self-signed-certificate-host" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    If this attribute is set and if the file that backs the KeyStore does not exist, then
+                    a self-signed certificate will be generated on first use and it will be persisted to
+                    the file that backs the KeyStore. The value of this attribute will be used for the
+                    Common Name value in the self-signed certificate.
+    
+                    The use of this attribute is intended for testing purposes only. This attribute is not
+                    intended for production use.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="trustManagersType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for TrustManager definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="trust-manager" type="trustManagerType" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="trustManagerType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a single TrustManager.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:all>
+            <xs:element name="certificate-revocation-list" type="certificateRevocationListType" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="certificate-revocation-lists" type="certificateRevocationListsType" minOccurs="0" maxOccurs="1" />
+            <xs:element name="ocsp" type="ocspType" minOccurs="0" maxOccurs="1"/>
+        </xs:all>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this TrustManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="algorithm" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The algorithm name to use to initialise the TrustManagerFactory.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="key-store" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the KeyStore to use with the TrustManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <!-- <xs:attribute name="key-store-object" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    KeyStore object to use with the TrustManager.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute> -->
+        <xs:attribute name="alias-filter" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    A filter to apply to the aliases provided by KeyStore.
+
+                    Can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="provider-name" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the provider to use to
+                    instantiate the TrustManagerFactory, if the provider is not
+                    specified then the first provider found that can
+                    create an instance of the specified 'type' will be
+                    used.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers defined within the subsystem to obtain the Providers
+                    to search for the one that can create the required TrustManagerFactory type.
+
+                    If this is not specified then the global list of Providers is used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="maximum-cert-path" type="xs:int" use="optional" default="5">
+            <xs:annotation>
+                <xs:documentation>
+                    The maximum number of non-self-issued intermediate certificates that may exist in a certification path for OCSP and CRL checks. If neither OCSP and CRL is configured, this attribute has no effect.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="only-leaf-cert" type="xs:boolean" use="optional" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    Check revocation status only of leaf certificates.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="soft-fail" type="xs:boolean" use="optional" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    Accept certificate if revocation status is unknown.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!--
+        Start of revocation definitions
+    -->
+
+    <xs:complexType name="certificateRevocationListType">
+        <xs:annotation>
+            <xs:documentation>
+                Enables certificate revocation list checks to a trust manager.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="path" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The path to the configuration to use to initialise the provider.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="relative-to" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The base path of the certificate revocation list file.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="maximum-cert-path" type="xs:int" use="optional" default="5">
+            <xs:annotation>
+                <xs:documentation>
+                    The maximum number of non-self-issued intermediate certificates that may exist in a certification path.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="certificateRevocationListNoMaxCertPathType">
+        <xs:annotation>
+            <xs:documentation>
+                The presence of this element enables checking the peer's certificate against a certificate revocation list.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="path" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Path to the certificate revocation list.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="relative-to" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The base path of the certificate revocation list file.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="certificateRevocationListsType">
+        <xs:annotation>
+            <xs:documentation>
+                The presence of this element enables checking the peer's certificate against multiple certificate revocation lists.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="certificate-revocation-list" type="certificateRevocationListNoMaxCertPathType" minOccurs="0" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="ocspType">
+        <xs:annotation>
+            <xs:documentation>
+                Enables online certificate status protocol checks to a trust manager.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="responder" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    OCSP responder URI to override those extracted from certificate.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="prefer-crls" type="xs:boolean" use="optional" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    Prefer certificate revocation list revocation over OCSP if certificate-revocation-list is defined.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="responder-certificate" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The alias for OCSP Responder certificate. Keep undefined to use the issuer of certificate being validated.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="responder-keystore" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the keystore for responder-certificate. Keep undefined to use trust-manager keystore. Requires responder-certificate to be defined.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="responder-keystore-object" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The keystore object for responder-certificate. Keep undefined to use trust-manager keystore. Requires responder-certificate to be defined.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!--
+        End of revocation definitions
+    -->
+
+    <!--
+        Key Store
+    -->
+
+    <xs:complexType name="keyStoresType">
+        <xs:annotation>
+            <xs:documentation>
+                Container for the KeyStore definitions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence maxOccurs="unbounded">
+            <xs:choice>
+                <xs:element name="key-store" type="keyStoreType" />
+<!--                <xs:element name="ldap-key-store" type="ldapKeyStoreType" />-->
+<!--                <xs:element name="filtering-key-store" type="filteringKeyStoreType" />-->
+            </xs:choice>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="keyStoreType">
+        <xs:annotation>
+            <xs:documentation>
+                An individual names KeyStore definition.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="credential-reference" type="credential-reference:credentialReferenceType" minOccurs="0" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>
+                        The credential reference to credential store or clear text (password)
+                        to use to initialize or load the KeyStore.
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
+            <xs:element name="implementation" type="keyStoreImplementationType" minOccurs="1" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>
+                        Implementation details
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
+            <xs:element name="file" type="fileType" minOccurs="0" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>
+                        The location of the file to use to initialise the KeyStore instance.
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this KeyStore.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="alias-filter" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    A filter to apply to the aliases made available by this KeyStore.
+
+                    Can either be a comma separated list of aliases to return or one of the following formats ALL:-alias1:-alias2, NONE:+alias1:+alias2
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="keyStoreImplementationType">
+        <xs:annotation>
+            <xs:documentation>
+                keystore implementation details
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="type" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The KeyStore type, e.g. jks, pkcs#12.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="provider-name" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the provider to use to
+                    instantiate the KeyStore, if the provider is not
+                    specified then the first provider found that can
+                    create an instance of the specified 'type' will be
+                    used.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers defined within the subsystem to obtain the Providers
+                    to search for the one that can create the required KeyStore type.
+
+                    If this is not specified then the global list of Providers is used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <!--
+        Credential Store Components
+     -->
+
+    <xs:complexType name="credentialStoresType">
+        <xs:annotation>
+            <xs:documentation>
+                Complex type to contain the definitions of the credential stores.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="credential-store" type="credentialStoreType" minOccurs="0" maxOccurs="unbounded"/>
+            <xs:element name="secret-key-credential-store" type="secretKeyCredentialStoreType" minOccurs="0" maxOccurs="unbounded"/>
+        </xs:sequence>
+    </xs:complexType>
+
+    <xs:complexType name="credentialStoreType">
+        <xs:annotation>
+            <xs:documentation>
+                An individual credential store definition.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="implementation-properties" minOccurs="0" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>
+                        Map of credentials store implementation specific properties.
+                    </xs:documentation>
+                </xs:annotation>
+                <xs:complexType>
+                    <xs:sequence>
+                        <xs:element name="property" type="propertyType" maxOccurs="unbounded"/>
+                    </xs:sequence>
+                </xs:complexType>
+            </xs:element>
+            <xs:element name="credential-reference" type="credential-reference:credentialReferenceType">
+                <xs:annotation>
+                    <xs:documentation>
+                        Credential to be used by as protection parameter for the Credential Store.
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
+        </xs:sequence>
+        <xs:attribute name="name" type="xs:string" use="required" />
+        <xs:attribute name="type" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The credential store type, e.g. KeyStoreCredentialStore.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="provider-name" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the provider to use to instantiate the CredentialStoreSpi.
+                    If the provider is not specified then the first provider found that can
+                    create an instance of the specified 'type' will be used.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers defined within the subsystem to obtain the Providers
+                    to search for the one that can create the required CredentialStore type.
+                    If this is not specified then the global list of Providers is used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="other-providers" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    The name of the providers defined within the subsystem to obtain the Providers
+                    to search for the one that can create the required JCA objects within credential store.
+                    This is valid only for key-store based  CredentialStore.
+                    If this is not specified then the global list of Providers is used instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="relative-to" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    A reference to a previously defined path that the file name is
+                    relative to.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="location" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    File name of credential store storage.
+
+                    Deprecated: Use "path" attribute instead.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="path" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    File name of credential store storage.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="modifiable" type="xs:boolean" use="optional" default="true">
+            <xs:annotation>
+                <xs:documentation>
+                    Specifies whether credential store is modifiable.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="create" type="xs:boolean" use="optional" default="false">
+            <xs:annotation>
+                <xs:documentation>
+                    Specifies whether credential store should create storage when it doesn't exist.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="secretKeyCredentialStoreType">
+        <xs:annotation>
+            <xs:documentation>
+                A simple credential store which stores SecretKeyCredential instances in a properties file.
+
+                This credential store does not encrypt the stored keys, the purpose of this credential store is
+                to provide initial access to keys used to protect other configuration values.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this credential store definition.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="relative-to" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    A reference to a previously defined path that the file name is
+                    relative to.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="path" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The path to the credential store file.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="create" type="xs:boolean" default="true">
+            <xs:annotation>
+                <xs:documentation>
+                    Specifies whether credential store should create storage when it doesn't exist.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="populate" type="xs:boolean" default="true">
+            <xs:annotation>
+                <xs:documentation>
+                    If an entry with the default-alias does not exist should one be dynamically added using the
+                    configured key-size?
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="key-size" type="keySizeType" default="256">
+            <xs:annotation>
+                <xs:documentation>
+                    The default key size when generating secret keys.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="default-alias" type="xs:string" default="key">
+            <xs:annotation>
+                <xs:documentation>
+                    The default alias to use if dynamically adding an entry.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+
+    <!--
+       Expression Resolver Types
+    -->
+
+    <xs:complexType name="expressionResolverType">
+        <xs:annotation>
+            <xs:documentation>
+                An expression resolver backed by a list of sub-expression resolvers which can be used to decrypt encrypted expressions.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:sequence>
+            <xs:element name="resolver" type="resolverType" minOccurs="1" maxOccurs="unbounded" />
+        </xs:sequence>
+        <xs:attribute name="default-resolver" type="xs:string">
+            <xs:annotation>
+                <xs:documentation>
+                    The default resolver to use for expressions which do not specify the name of the resolver.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="prefix" type="xs:string" default="ENC">
+            <xs:annotation>
+                <xs:documentation>
+                    The prefix for expressions that should be resolved using this expression resolver.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:complexType name="resolverType">
+        <xs:annotation>
+            <xs:documentation>
+                Definition of a single expression resolver.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="name" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The unique name of this expression resolver.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="credential-store" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    Reference to the credential store which contains the secret key to be used by this resolver.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="secret-key" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The alias of the secret key contained within the credential store.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+
+    <!--
+        Misc
+    -->
+
+    <xs:complexType name="fileType">
+        <xs:annotation>
+            <xs:documentation>
+                A reference to a file.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:complexContent>
+            <xs:extension base="basicFileType">
+                <xs:attribute name="required" type="xs:boolean"
+                              use="optional" default="false">
+                    <xs:annotation>
+                        <xs:documentation>
+                            It is possible that a KeyStore definition can be created to a
+                            non-existent file and the file be automatically created when the store is saved, however
+                            no error will be reported where the file does not exist to begin with.
+
+                            If the intent is that the store will always exist in advance set
+                            this to 'true' so that an error will be reported if the file is missing.
+                        </xs:documentation>
+                    </xs:annotation>
+                </xs:attribute>
+            </xs:extension>
+        </xs:complexContent>
+    </xs:complexType>
+
+    <xs:complexType name="basicFileType">
+        <xs:annotation>
+            <xs:documentation>
+                Minimal attributes required to specify the location to a file.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="relative-to" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    A reference to a previously defined path that the file name is
+                    relative to.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="path" type="xs:string" use="required">
+            <xs:annotation>
+                <xs:documentation>
+                    The remaining path to the file referenced.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+    <xs:simpleType name="stringListType">
+        <xs:annotation>
+            <xs:documentation>A list of String.</xs:documentation>
+        </xs:annotation>
+        <xs:list itemType="xs:string"/>
+    </xs:simpleType>
+
+    <xs:simpleType name="keySizeType">
+        <xs:annotation>
+            <xs:documentation>
+                Allowed key sizes.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:restriction base="xs:int">
+            <xs:enumeration value="128" />
+            <xs:enumeration value="192" />
+            <xs:enumeration value="256" />
+        </xs:restriction>
+    </xs:simpleType>
+
+</xs:schema>
\ No newline at end of file
diff --git a/subsystem/src/main/resources/schema/wildfly-credential-reference_1_1.xsd b/subsystem/src/main/resources/schema/wildfly-credential-reference_1_1.xsd
new file mode 100644
index 0000000..f8c50c4
--- /dev/null
+++ b/subsystem/src/main/resources/schema/wildfly-credential-reference_1_1.xsd
@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  ~ JBoss, Home of Professional Open Source
+  ~ Copyright 2019, Red Hat, Inc., and individual contributors as indicated
+  ~ by the @authors tag.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+           targetNamespace="urn:wildfly:credential-reference:1.1"
+           xmlns="urn:wildfly:credential-reference:1.1"
+           elementFormDefault="qualified"
+           attributeFormDefault="unqualified"
+           version="1.0">
+
+    <!-- Shared Credential Reference Types
+         See README.md for a description of what needs to be done if you are adding a new version of this schema. -->
+    <xs:attributeGroup name="credentialReferenceStoreBased">
+        <xs:annotation>
+            <xs:documentation>
+                Group of attributes used when referencing credential through credential store.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attribute name="store" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Credential store name used to fetch credential with given 'alias' from.
+                    Credential store name has to be defined elsewhere.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="alias" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Alias of credential in the credential store.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+        <xs:attribute name="type" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Type of credential to be fetched from credential store.
+                    It is usually fully qualified class name.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:attributeGroup>
+
+    <xs:complexType name="credentialReferenceType">
+        <xs:annotation>
+            <xs:documentation>
+                Credential to be used by the configuration.
+            </xs:documentation>
+        </xs:annotation>
+        <xs:attributeGroup ref="credentialReferenceStoreBased"/>
+        <xs:attribute name="clear-text" type="xs:string" use="optional">
+            <xs:annotation>
+                <xs:documentation>
+                    Credential/password in clear text. If used on its own, this should only be used for testing purposes.
+
+                    This attribute can also be specified together with the 'store' attribute. If the 'alias' attribute
+                    is also specified, one of the following will then occur:
+
+                    If the credential store does not contain an entry for the given 'alias', a new entry will be added
+                    to the credential store to hold the clear text password that was specified.
+
+                    If the credential store does contain an entry for the given 'alias', the existing credential will
+                    be replaced with the clear text password that was specified.
+
+                    If the 'clear-text' attribute is specified together with the 'store' attribute but the 'alias' is
+                    not specified, an alias will be generated and a new entry will be added to the credential store to
+                    hold the clear text password that was specified.
+
+                    In all three cases, the 'clear-text' attribute will be removed from the model after adding / updating
+                    an entry in the credential store.
+                </xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
+    </xs:complexType>
+
+</xs:schema>
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/AcmeMockServerBuilder.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/AcmeMockServerBuilder.java
new file mode 100644
index 0000000..3f3423e
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/AcmeMockServerBuilder.java
@@ -0,0 +1,257 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.model.HttpResponse.response;
+
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+import org.apache.commons.io.IOUtils;
+import org.mockserver.integration.ClientAndServer;
+import org.mockserver.matchers.Times;
+import org.mockserver.model.HttpRequest;
+import org.mockserver.model.HttpResponse;
+
+/**
+ * Class used to build up a mock Let's Encrypt server instance.
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+
+class AcmeMockServerBuilder {
+
+    private ClientAndServer server; // used to simulate a Let's Encrypt server instance
+
+    AcmeMockServerBuilder(ClientAndServer server) {
+        server.reset();
+        this.server = server;
+    }
+
+    public AcmeMockServerBuilder addDirectoryResponseBody(String directoryResponseBody) {
+        server.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/directory")
+                        .withBody(""),
+                Times.once())
+                .respond(
+                        response()
+                                .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                                .withHeader("Content-Type", "application/json")
+                                .withBody(directoryResponseBody));
+        return this;
+    }
+
+    public AcmeMockServerBuilder addNewNonceResponse(String newNonce) {
+        server.when(
+                request()
+                        .withMethod("HEAD")
+                        .withPath("/acme/new-nonce")
+                        .withBody(""),
+                Times.once())
+                .respond(
+                        response()
+                                .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                                .withHeader("Replay-Nonce", newNonce)
+                                .withStatusCode(204));
+        return this;
+    }
+
+    public AcmeMockServerBuilder addNewAccountRequestAndResponse(String expectedNewAccountRequestBody, String newAccountResponseBody,
+                                                                 String newAccountReplayNonce, String newAccountLocation, int newAccountStatusCode) {
+        return addNewAccountRequestAndResponse(expectedNewAccountRequestBody, newAccountResponseBody, newAccountReplayNonce, newAccountLocation,
+                newAccountStatusCode, false);
+    }
+
+    public AcmeMockServerBuilder addNewAccountRequestAndResponse(String expectedNewAccountRequestBody, String newAccountResponseBody, String newAccountReplayNonce,
+                                                                 String newAccountLocation, int newAccountStatusCode, boolean useProblemContentType) {
+        String link = "<https://boulder:4431/terms/v7>;rel=\"terms-of-service\"";
+        return addPostRequestAndResponse(expectedNewAccountRequestBody, "/acme/new-acct", newAccountResponseBody, newAccountReplayNonce,
+                link, newAccountLocation, newAccountStatusCode, useProblemContentType);
+    }
+
+    public AcmeMockServerBuilder updateAccountRequestAndResponse(String expectedUpdateAccountRequestBody, String updateAccountResponseBody, String updateAccountReplayNonce,
+                                                                 String accountUrl, int updateAccountStatusCode) {
+        String link = "<https://boulder:4431/terms/v7>;rel=\"terms-of-service\"";
+        return addPostRequestAndResponse(expectedUpdateAccountRequestBody, accountUrl, updateAccountResponseBody, updateAccountReplayNonce,
+                link, "", updateAccountStatusCode, false);
+    }
+
+    public AcmeMockServerBuilder orderCertificateRequestAndResponse(String expectedOrderCertificateRequestBody, String orderCertificateResponseBody, String orderCertificateReplayNonce,
+                                                                    String orderLocation, int orderCertificateStatusCode, boolean useProblemContentType) {
+        return addPostRequestAndResponse(expectedOrderCertificateRequestBody, "/acme/new-order", orderCertificateResponseBody, orderCertificateReplayNonce,
+                "", orderLocation, orderCertificateStatusCode, useProblemContentType);
+    }
+
+    public AcmeMockServerBuilder addAuthorizationResponseBody(String expectedAuthorizationUrl, String expectedAuthorizationRequestBody, String authorizationResponseBody, String authorizationReplayNonce) {
+        server.when(
+                request()
+                        .withMethod("POST")
+                        .withPath(expectedAuthorizationUrl)
+                        .withBody(expectedAuthorizationRequestBody == null ? "" : expectedAuthorizationRequestBody),
+                Times.exactly(10))
+                .respond(
+                        response()
+                                .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                                .withHeader("Content-Type", "application/json")
+                                .withHeader("Replay-Nonce", authorizationReplayNonce)
+                                .withBody(authorizationResponseBody));
+        return this;
+    }
+
+    public AcmeMockServerBuilder addChallengeRequestAndResponse(String expectedChallengeRequestBody, String expectedChallengeUrl, String challengeResponseBody,
+                                                                String challengeReplayNonce, String challengeLocation, String challengeLink,
+                                                                int challengeStatusCode, boolean useProblemContentType, String verifyChallengePath,
+                                                                String challengeFileContents, String expectedAuthorizationUrl, String authorizationResponseBody,
+                                                                String authorizationReplayNonce) {
+        server.when(
+                request()
+                        .withMethod("POST")
+                        .withPath(expectedChallengeUrl)
+                        .withHeader("Content-Type", "application/jose+json")
+                        .withBody(expectedChallengeRequestBody),
+                Times.once())
+                .respond(request -> {
+                    HttpResponse response = response()
+                            .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                            .withHeader("Content-Type", useProblemContentType ? "application/problem+json" : "application/json")
+                            .withHeader("Replay-Nonce", challengeReplayNonce)
+                            .withBody(challengeResponseBody)
+                            .withStatusCode(challengeStatusCode);
+                    if (! challengeLocation.isEmpty()) {
+                        response = response.withHeader("Location", challengeLocation);
+                    }
+                    if (! challengeLink.isEmpty()) {
+                        response = response.withHeader("Link", challengeLink);
+                    }
+
+                    byte[] challengeResponseBytes = null;
+                    try {
+                        // Simply validate that the file was created and has the correct contents (attempting to retrieve
+                        // the file via the challenge url would require the Undertow subsystem)
+                        try (InputStream inputStream = new BufferedInputStream(new FileInputStream(new File(System.getProperty("jboss.home.dir") + verifyChallengePath)))) {
+                            challengeResponseBytes = IOUtils.toByteArray(inputStream);
+                        }
+                    } catch (Exception e) {
+                        //
+                    }
+                    if (challengeFileContents.equals(new String(challengeResponseBytes, StandardCharsets.UTF_8))) {
+                        addAuthorizationResponseBody(expectedAuthorizationUrl, null, authorizationResponseBody, authorizationReplayNonce);
+                    }
+                    return response;
+                });
+        return this;
+    }
+
+    public AcmeMockServerBuilder addFinalizeRequestAndResponse(String finalResponseBody, String finalizeReplayNonce,
+                                                               String finalizeUrl, String finalizeOrderLocation, int finalizeStatusCode) {
+        return addFinalizeRequestAndResponse(finalResponseBody, finalizeReplayNonce, finalizeUrl, finalizeOrderLocation, finalizeStatusCode, false);
+    }
+
+    public AcmeMockServerBuilder addFinalizeRequestAndResponse(String finalResponseBody, String finalizeReplayNonce,
+                                                               String finalizeUrl, String orderLocation, int finalizeStatusCode, boolean useProblemContentType) {
+        return addPostRequestAndResponse("", finalizeUrl, finalResponseBody, finalizeReplayNonce, "",
+                orderLocation, finalizeStatusCode, useProblemContentType);
+    }
+
+    public AcmeMockServerBuilder addCertificateRequestAndResponse(String certificateUrl, String expectedCertificateRequestBody, String certificateResponseBody, String certificateReplayNonce, int certificateStatusCode) {
+        HttpResponse response = response()
+                .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                .withHeader("Content-Type", "application/pem-certificate-chain")
+                .withHeader("Replay-Nonce", certificateReplayNonce)
+                .withBody(certificateResponseBody)
+                .withStatusCode(certificateStatusCode);
+        server.when(
+                request()
+                        .withMethod("POST")
+                        .withPath(certificateUrl)
+                        .withBody(expectedCertificateRequestBody),
+                Times.once())
+                .respond(response);
+
+        return this;
+    }
+
+    public AcmeMockServerBuilder addCheckOrderRequestAndResponse(String orderUrl, String expectedCheckCertificateRequestBody, String checkCertificateResponseBody, String checkOrderReplayNonce, int checkCertificateStatusCode) {
+        HttpResponse response = response()
+                .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                .withHeader("Content-Type", "application/json")
+                .withHeader("Replay-Nonce", checkOrderReplayNonce)
+                .withBody(checkCertificateResponseBody)
+                .withStatusCode(checkCertificateStatusCode);
+        server.when(
+                request()
+                        .withMethod("POST")
+                        .withPath(orderUrl)
+                        .withBody(expectedCheckCertificateRequestBody),
+                Times.once())
+                .respond(response);
+
+        return this;
+    }
+
+    public AcmeMockServerBuilder addRevokeCertificateRequestAndResponse(String expectedRevokeCertificateRequestBody, String revokeCertificateReplayNonce, int revokeCertificateStatusCode) {
+        return addPostRequestAndResponse(expectedRevokeCertificateRequestBody, "/acme/revoke-cert", "", revokeCertificateReplayNonce,
+                "", "", revokeCertificateStatusCode, false);
+    }
+
+    public AcmeMockServerBuilder addChangeKeyRequestAndResponse(String expectedChangeKeyRequestBody, String changeKeyResponseBody, String changeKeyReplaceNonce, int changeKeyResponseCode) {
+        return addPostRequestAndResponse(expectedChangeKeyRequestBody, "/acme/key-change", changeKeyResponseBody, changeKeyReplaceNonce,
+                "", "", changeKeyResponseCode, false);
+    }
+
+    public AcmeMockServerBuilder addPostRequestAndResponse(String expectedPostRequestBody, String postPath, String responseBody, String replayNonce, String link, String location, int responseCode, boolean useProblemContentType) {
+        HttpResponse response = response()
+                .withHeader("Cache-Control", "public, max-age=0, no-cache")
+                .withHeader("Replay-Nonce", replayNonce)
+                .withStatusCode(responseCode);
+        if (! responseBody.isEmpty()) {
+            response = response
+                    .withHeader("Content-Type", useProblemContentType ? "application/problem+json" : "application/json")
+                    .withBody(responseBody);
+
+        }
+        if (! link.isEmpty()) {
+            response = response.withHeader("Link", link);
+        }
+        if (! location.isEmpty()) {
+            response = response.withHeader("Location", location);
+        }
+        HttpRequest request = request()
+                .withMethod("POST")
+                .withPath(postPath) ;
+        if (! expectedPostRequestBody.isEmpty()) {
+            request = request.withBody(expectedPostRequestBody);
+        }
+        server.when(
+                request,
+                Times.once())
+                .respond(response);
+
+        return this;
+    }
+
+    public ClientAndServer build() {
+        return server;
+    }
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CertificateAuthoritiesTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CertificateAuthoritiesTestCase.java
new file mode 100644
index 0000000..ec45c00
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CertificateAuthoritiesTestCase.java
@@ -0,0 +1,1002 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILED;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILURE_DESCRIPTION;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.AccessController;
+import java.security.KeyStore;
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.Security;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.subsystem.test.AbstractSubsystemTest;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.jboss.dmr.ModelType;
+import org.jboss.msc.service.ServiceName;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.mockserver.integration.ClientAndServer;
+import org.wildfly.security.WildFlyElytronProvider;
+import org.wildfly.security.x500.cert.acme.AcmeAccount;
+
+import org.wildfly.security.x500.cert.acme.CertificateAuthority;
+
+
+/**
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+public class CertificateAuthoritiesTestCase extends AbstractSubsystemTest {
+
+    private static final Provider wildFlyElytronProvider = new WildFlyElytronProvider();
+    private static CredentialStoreUtility csUtil = null;
+    private static final String CS_PASSWORD = "super_secret";
+    private static final String CERTIFICATE_AUTHORITY_ACCOUNT_NAME = "CertAuthorityAccount";
+    private static final String CERTIFICATE_AUTHORITY_NAME = "CertAuthority";
+    private static final String SIMULATED_LETS_ENCRYPT_ENDPOINT = "http://localhost:4001/directory"; // simulated Let's Encrypt server instance
+    private static final String CERTIFICATE_AUTHORITY_TEST_URL = "http://www.test.com";
+    private static final String ACCOUNTS_KEYSTORE_NAME = "AccountsKeyStore";
+    private static final String KEYSTORE_PASSWORD = "elytron";
+    private static ClientAndServer server; // used to simulate a Let's Encrypt server instance
+
+
+    public CertificateAuthoritiesTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    private KernelServices services = null;
+
+    private ModelNode assertSuccess(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(SUCCESS)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private ModelNode assertFailed(ModelNode response) {
+        if (! response.get(OUTCOME).asString().equals(FAILED)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    @BeforeClass
+    public static void initTests() {
+        server = new ClientAndServer(4001);
+        AccessController.doPrivileged((PrivilegedAction<Integer>) () -> Security.insertProviderAt(wildFlyElytronProvider, 1));
+        csUtil = new CredentialStoreUtility("target/tlstest.keystore", CS_PASSWORD);
+        csUtil.addEntry("the-key-alias", "Elytron");
+        csUtil.addEntry("master-password-alias", "Elytron");
+    }
+
+    @AfterClass
+    public static void cleanUpTests() {
+        if (server != null) {
+            server.stop();
+        }
+        csUtil.cleanUp();
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+            Security.removeProvider(wildFlyElytronProvider.getName());
+            return null;
+        });
+    }
+
+    @Before
+    public void init() throws Exception {
+        String subsystemXml;
+        if (JdkUtils.isIbmJdk()) {
+            subsystemXml = "tls-ibm.xml";
+        } else {
+            subsystemXml = JdkUtils.getJavaSpecVersion() <= 12 ? "tls-sun.xml" : "tls-oracle13plus.xml";
+        }
+        services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXmlResource(subsystemXml).build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+    }
+
+    @Test
+    public void testCreateAccount() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account1v2");
+        server = setupTestCreateAccount();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        final String NEW_ACCT_LOCATION = "http://localhost:4001/acme/acct/384";
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CREATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(NEW_ACCT_LOCATION, acmeAccount.getAccountUrl());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testCreateAccountWithCustomCAWithoutStaging() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account1v2");
+        server = setupTestCreateAccount();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        final String NEW_ACCT_LOCATION = "http://localhost:4001/acme/acct/384";
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CREATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(NEW_ACCT_LOCATION, acmeAccount.getAccountUrl());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testCreateAccountWithCustomCAWithStaging() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account1v2");
+        server = setupTestCreateAccount();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        final String NEW_ACCT_LOCATION = "http://localhost:4001/acme/acct/384";
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CREATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            operation.get(Constants.STAGING).set(true);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(NEW_ACCT_LOCATION, acmeAccount.getAccountUrl());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testCreateAccountWithEmptyStagingUrlAndStagingValueTrue() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account1v2");
+        server = setupTestCreateAccount();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CREATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            operation.get(Constants.STAGING).set(true);
+            ModelNode result = services.executeOperation(operation);
+            assertFailed(result);
+            String failureDescription = result.get(FAILURE_DESCRIPTION).asString();
+            assertTrue(failureDescription.contains("ELYTLS00317") && failureDescription.contains("ELY10057"));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testCreateAccountNonExistingAlias() throws Exception {
+        String alias = "nonExisting";
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        KeyStore accountsKeyStore = getKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        assertFalse(accountsKeyStore.containsAlias(alias));
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA(alias);
+        final String NEW_ACCT_LOCATION = "http://localhost:4001/acme/acct/25";
+        server = setupTestCreateAccountNonExistingAlias();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CREATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(NEW_ACCT_LOCATION, acmeAccount.getAccountUrl());
+            assertTrue(accountsKeyStore.containsAlias(alias));
+            assertTrue(accountsKeyStore.getEntry(alias, new KeyStore.PasswordProtection(KEYSTORE_PASSWORD.toCharArray())) instanceof KeyStore.PrivateKeyEntry);
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testCreateAccountWithoutAgreeingToTermsOfService() throws Exception {
+        String alias = "invalid";
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA(alias);
+        server = setupTestCreateAccountWithoutAgreeingToTermsOfService();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CREATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(false);
+            ModelNode result = services.executeOperation(operation);
+            assertFailed(result);
+            String failureDescription = result.get(FAILURE_DESCRIPTION).asString();
+            assertTrue(failureDescription.contains("ELYTLS00317") && failureDescription.contains("must agree to terms of service"));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testUpdateAccount() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account1v2", new String[] { "mailto:certificates@anexample.com", "mailto:admin@anexample.com" });
+        server = setupTestUpdateAccount();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.UPDATE_ACCOUNT);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(false);
+            assertSuccess(services.executeOperation(operation));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testChangeAccountKey() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account6v2");
+        server = setupTestChangeAccountKey();
+        // old account
+        AcmeAccount acmeAccount = getAcmeAccount();
+        X509Certificate oldCertificate = acmeAccount.getCertificate();
+        X500Principal oldDn = acmeAccount.getDn();
+        try {
+            assertNull(acmeAccount.getAccountUrl());
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CHANGE_ACCOUNT_KEY);
+            assertSuccess(services.executeOperation(operation));
+            assertFalse(oldCertificate.equals(acmeAccount.getCertificate()));
+            assertEquals(oldDn, acmeAccount.getDn());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testDeactivateAccount() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account10v2");
+        final String ACCT_LOCATION = "http://localhost:4001/acme/acct/27";
+        server = setupTestDeactivateAccount();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        acmeAccount.setAccountUrl(ACCT_LOCATION);
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.DEACTIVATE_ACCOUNT);
+            assertSuccess(services.executeOperation(operation));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testGetMetadataAllValuesSet() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account8v2");
+        server = setupTestGetMetadataAllValuesSet();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GET_METADATA);
+            ModelNode result = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+            assertEquals("https://boulder:4431/terms/v7", result.get(Constants.TERMS_OF_SERVICE).asString());
+            assertEquals("https://github.com/letsencrypt/boulder", result.get(Constants.WEBSITE).asString());
+            List<ModelNode> caaIdentities = result.get(Constants.CAA_IDENTITIES).asList();
+            assertEquals("happy-hacker-ca.invalid", caaIdentities.get(0).asString());
+            assertEquals("happy-hacker2-ca.invalid", caaIdentities.get(1).asString());
+            assertTrue(result.get(Constants.EXTERNAL_ACCOUNT_REQUIRED).asBoolean());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testGetMetadataSomeValuesSet() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account8v2");
+        server = setupTestGetMetadataSomeValuesSet();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GET_METADATA);
+            ModelNode result = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+            assertEquals("https://boulder:4431/terms/v7", result.get(Constants.TERMS_OF_SERVICE).asString());
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.WEBSITE).getType());
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.CAA_IDENTITIES).getType());
+            assertFalse(result.get(Constants.EXTERNAL_ACCOUNT_REQUIRED).asBoolean());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testGetMetadataNoValuesSet() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account8v2");
+        server = setupTestGetMetadataNoValuesSet();
+        AcmeAccount acmeAccount = getAcmeAccount();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GET_METADATA);
+            ModelNode result = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.TERMS_OF_SERVICE).getType());
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.WEBSITE).getType());
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.CAA_IDENTITIES).getType());
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.EXTERNAL_ACCOUNT_REQUIRED).getType());
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testAddCertificateAuthorityWithBothUrlsEmpty() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        assertFailed(services.executeOperation(operation));
+    }
+
+    @Test
+    public void testAddCertificateAuthorityWithLetsEncryptName() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CertificateAuthority.LETS_ENCRYPT.getName());
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.URL).set(CERTIFICATE_AUTHORITY_TEST_URL);
+        assertFailed(services.executeOperation(operation));
+    }
+
+    @Test
+    public void testAddCertificateAuthorityWithStagingUrl() {
+        addCertificateAuthorityWithStagingUrl();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+            operation.get(ClientConstants.OP).set(ClientConstants.READ_RESOURCE_OPERATION);
+            ModelNode result = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+            assertEquals(SIMULATED_LETS_ENCRYPT_ENDPOINT, result.get(Constants.URL).asString());
+            assertEquals(SIMULATED_LETS_ENCRYPT_ENDPOINT, result.get(Constants.STAGING_URL).asString());
+        } finally {
+            removeCertificateAuthority();
+        }
+    }
+
+    @Test
+    public void testAddCertificateAuthorityWithEmptyStagingUrl() {
+        addCertificateAuthorityWithoutStagingUrl();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+            operation.get(ClientConstants.OP).set(ClientConstants.READ_RESOURCE_OPERATION);
+            ModelNode result = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+            assertEquals(SIMULATED_LETS_ENCRYPT_ENDPOINT, result.get(Constants.URL).asString());
+            assertEquals(ModelType.UNDEFINED, result.get(Constants.STAGING_URL).getType());
+        } finally {
+            removeCertificateAuthority();
+        }
+    }
+
+    @Test
+    public void testRemoveCertificateAuthority() {
+        addCertificateAuthorityWithStagingUrl();
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.READ_RESOURCE_OPERATION);
+        assertFailed(services.executeOperation(operation));
+    }
+
+    @Test
+    public void testRemoveCertificateAuthorityUsedByCertificateAuthorityAccount() throws Exception {
+        addCertificateAuthorityWithoutStagingUrl();
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityAccountWithCustomCA("account");
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+            operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+            assertFailed(services.executeOperation(operation));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testChangeCertificateAuthorityInCertificateAuthorityAccount() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        addCertificateAuthorityAccount("alias");
+        checkCertificateAuthorityIs(CertificateAuthority.LETS_ENCRYPT.getName());
+        addCertificateAuthorityWithoutStagingUrl();
+        try {
+            changeCertificateAuthorityInCertificateAuthorityAccount();
+            checkCertificateAuthorityIs(CERTIFICATE_AUTHORITY_NAME);
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+        }
+    }
+
+    private void changeCertificateAuthorityInCertificateAuthorityAccount() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.WRITE_ATTRIBUTE_OPERATION);
+        operation.get(ClientConstants.NAME).set(Constants.CERTIFICATE_AUTHORITY);
+        operation.get(ClientConstants.VALUE).set(CERTIFICATE_AUTHORITY_NAME);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void addCertificateAuthorityWithoutStagingUrl() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.URL).set(SIMULATED_LETS_ENCRYPT_ENDPOINT);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void addCertificateAuthorityWithStagingUrl() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.URL).set(SIMULATED_LETS_ENCRYPT_ENDPOINT);
+        operation.get(Constants.STAGING_URL).set(SIMULATED_LETS_ENCRYPT_ENDPOINT);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void removeCertificateAuthority() {
+        ModelNode operation;
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void checkCertificateAuthorityIs(String certificateAuthorityName) {
+        ModelNode operation;
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.READ_RESOURCE_OPERATION);
+        ModelNode result = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+        assertEquals(certificateAuthorityName, result.get(Constants.CERTIFICATE_AUTHORITY).asString());
+    }
+
+    private AcmeAccount getAcmeAccount() {
+        ServiceName serviceName = Capabilities.CERTIFICATE_AUTHORITY_ACCOUNT_RUNTIME_CAPABILITY.getCapabilityServiceName(CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        return (AcmeAccount) services.getContainer().getService(serviceName).getValue();
+    }
+
+    private KeyStore getKeyStore(String keyStoreName) {
+        ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(keyStoreName);
+        return (KeyStore) services.getContainer().getService(serviceName).getValue();
+    }
+
+    private void addCertificateAuthorityAccount(String alias) throws Exception {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.CONTACT_URLS).add("mailto:admin@anexample.com");
+        operation.get(Constants.CERTIFICATE_AUTHORITY).set(CertificateAuthority.LETS_ENCRYPT.getName());
+        operation.get(Constants.KEY_STORE).set(ACCOUNTS_KEYSTORE_NAME);
+        operation.get(Constants.ALIAS).set(alias);
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEYSTORE_PASSWORD);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void addCertificateAuthorityAccountWithCustomCA(String alias) throws Exception {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.CONTACT_URLS).add("mailto:admin@anexample.com");
+        operation.get(Constants.CERTIFICATE_AUTHORITY).set(CERTIFICATE_AUTHORITY_NAME);
+        operation.get(Constants.KEY_STORE).set(ACCOUNTS_KEYSTORE_NAME);
+        operation.get(Constants.ALIAS).set(alias);
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEYSTORE_PASSWORD);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void addCertificateAuthorityAccountWithCustomCA(String alias, String[] contactUrlsList) throws Exception {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        ModelNode contactUrls = new ModelNode();
+        for (String contactUrl : contactUrlsList) {
+            contactUrls = contactUrls.add(contactUrl);
+        }
+        operation.get(Constants.CONTACT_URLS).set(contactUrls);
+        operation.get(Constants.CERTIFICATE_AUTHORITY).set(CERTIFICATE_AUTHORITY_NAME);
+        operation.get(Constants.KEY_STORE).set(ACCOUNTS_KEYSTORE_NAME);
+        operation.get(Constants.ALIAS).set(alias);
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEYSTORE_PASSWORD);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void removeCertificateAuthorityAccount() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void addKeyStore(String keyStoreName) throws Exception {
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        Files.copy(resources.resolve("account.keystore"), resources.resolve("test-copy.keystore"), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/test-copy.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEYSTORE_PASSWORD);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void removeKeyStore(String keyStoreName) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    /* -- Helper methods used to set up the messages that should be sent from the mock Let's Encrypt server to our ACME client. -- */
+
+    private ClientAndServer setupTestCreateAccount() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"wnR-SBn2GN4\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator()  +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator()  +
+                "  \"meta\": {" + System.lineSeparator()  +
+                "    \"caaIdentities\": [" + System.lineSeparator()  +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator()  +
+                "    ]," + System.lineSeparator()  +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator()  +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator()  +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator()  +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator()  +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator()  +
+                "}";
+
+        final String NEW_NONCE_RESPONSE = "zincwl_lThkXLp0V7HAAcQEbIrx1R-gTI_ZQ8INAsrR5aQU";
+
+        final String NEW_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJoOE9lZTViZURSZ3hOUGVfZU1FOUg2Vm83NEZ1ZzhIZ3Jpa2ZiZkNhVTNsS0Y2NDhRRzFYMWtHRFpUaEF5OGRhcUo4YnY2YzNQSmRueDJIcjhqT3psNTA5Ym5NNmNDV2Z5d1RwY0lab1V6UVFaTFlfSzhHTURBeWdsc1FySXRnQ2lRYWxJcWJ1SkVrb2MzV1FBSXhKMjN4djliSzV4blZRa1RXNHJWQkFjWU5Rd29CakdZT1dTaXpUR2ZqZ21RcVRYbG9hYW1GWkpuOTdIbmIxcWp5NVZZbTA2YnV5cXdBYUdIczFDTHUzY0xaZ1FwVkhRNGtGc3prOFlPNVVBRWppb2R1Z1dwWlVSdTlUdFJLek4wYmtFZGVRUFlWcGF1cFVxMWNxNDdScDJqcVZVWGRpUUxla3l4clFidDhBMnVHNEx6RFF1LWI0Y1pwcG16YzNobGhTR3cifSwibm9uY2UiOiJ6aW5jd2xfbFRoa1hMcDBWN0hBQWNRRWJJcngxUi1nVElfWlE4SU5Bc3JSNWFRVSIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6dHJ1ZSwiY29udGFjdCI6WyJtYWlsdG86YWRtaW5AYW5leGFtcGxlLmNvbSJdfQ\",\"signature\":\"RPIM6OGU33uPXurdKJuKwXNkJbgEXcUr9QxEBjynhzROWGreB_p6esSlTxTkkNmP8EIBmcc2g5FjkBHjwIhqcvVC5AHhJ0XMq-WhRqlMdwQFn55nuG5O4nOrfr-5u31jw8DGnHs0Lv3_X4rVfLomT8y1eZ_IzPdZzw_QaEJWWIlrn-H_AkcmbZUxvozJ1yvadQ6cUUl9Hw6Kj8sSSdcUQ9tGtfAOiiXDtH-42-G0pMUivnJKyF5m8HdMXqKeFvRk4gvei-NdCzK44uehvoRTULQFbeu-h8YzWBZJwP1LXX8LSyLacxrXH8vukN8qjbBXXrB-QcimuPba4jmF124IDg\"}";
+
+        final String NEW_ACCT_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"key\": {" + System.lineSeparator()  +
+                "    \"kty\": \"RSA\"," + System.lineSeparator()  +
+                "    \"n\": \"h8Oee5beDRgxNPe_eME9H6Vo74Fug8HgrikfbfCaU3lKF648QG1X1kGDZThAy8daqJ8bv6c3PJdnx2Hr8jOzl509bnM6cCWfywTpcIZoUzQQZLY_K8GMDAyglsQrItgCiQalIqbuJEkoc3WQAIxJ23xv9bK5xnVQkTW4rVBAcYNQwoBjGYOWSizTGfjgmQqTXloaamFZJn97Hnb1qjy5VYm06buyqwAaGHs1CLu3cLZgQpVHQ4kFszk8YO5UAEjiodugWpZURu9TtRKzN0bkEdeQPYVpaupUq1cq47Rp2jqVUXdiQLekyxrQbt8A2uG4LzDQu-b4cZppmzc3hlhSGw\"," + System.lineSeparator()  +
+                "    \"e\": \"AQAB\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"contact\": [" + System.lineSeparator()  +
+                "    \"mailto:admin@anexample.com\"" + System.lineSeparator()  +
+                "  ]," + System.lineSeparator()  +
+                "  \"initialIp\": \"10.77.77.1\"," + System.lineSeparator()  +
+                "  \"createdAt\": \"2019-07-12T16:52:19.171896513Z\"," + System.lineSeparator()  +
+                "  \"status\": \"valid\"" + System.lineSeparator()  +
+                "}";
+
+        final String NEW_ACCT_REPLAY_NONCE = "taroOQPjumKybWIQEmqmB2DZ8ouIQ5uBoaDQZosCDyUzbJs";
+        final String NEW_ACCT_LOCATION = "http://localhost:4001/acme/acct/384";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(NEW_ACCT_REQUEST_BODY, NEW_ACCT_RESPONSE_BODY, NEW_ACCT_REPLAY_NONCE, NEW_ACCT_LOCATION, 201)
+                .build();
+    }
+
+    private ClientAndServer setupTestCreateAccountNonExistingAlias() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"09glGRT1wYc\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator()  +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator()  +
+                "  \"meta\": {" + System.lineSeparator()  +
+                "    \"caaIdentities\": [" + System.lineSeparator()  +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator()  +
+                "    ]," + System.lineSeparator()  +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator()  +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator()  +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator()  +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator()  +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator()  +
+                "}";
+
+        final String NEW_NONCE_RESPONSE = "taro09OqE4A5hQ1S9HcwyYZ8RJg3GnWciidIzG3CQxUr6Co";
+
+        final String NEW_ACCT_REQUEST_BODY = "";
+
+        final String NEW_ACCT_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"key\": {" + System.lineSeparator()  +
+                "    \"kty\": \"RSA\"," + System.lineSeparator()  +
+                "    \"n\": \"ybX5MhMnxJ2p0DaRsY5nO5xNpr5AQSydmsXpxeXyG3hYJsWyDUv2bvmfi2luQYkbOh_v6g9V5MsmsXjm8xkL7Fh_5gPCzx_ECTmPAeCgVO30j7KWPYtOmkVEAC5rSRKFhtBaQjlCbX5p20J7PTvTD2lxksSk2gILOs2r-D3Pa_kHmWkWqV9oB4wIiH3qBDINPffvyjSg1TA6T6MjzAZTwwx0PH5ZUZ27ht5D9GEjFycy1qmpucOSBzyd92fj5q25EIND59t4__3x3bOIDZ_IjBgQkFy5ef5nVUcxzDhQX7fb-_NCBvbZQjne6U1gd4QIb2eGKijTJDK59Mkbc3DkHQ\"," + System.lineSeparator()  +
+                "    \"e\": \"AQAB\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"contact\": [" + System.lineSeparator()  +
+                "    \"mailto:admin@anexample.com\"" + System.lineSeparator()  +
+                "  ]," + System.lineSeparator()  +
+                "  \"initialIp\": \"10.77.77.1\"," + System.lineSeparator()  +
+                "  \"createdAt\": \"2019-07-17T20:04:57.993736012Z\"," + System.lineSeparator()  +
+                "  \"status\": \"valid\"" + System.lineSeparator()  +
+                "}";
+
+        final String NEW_ACCT_REPLAY_NONCE = "zincrxWHWICvs8INUWbrSrx1o7nxJVrgFCxUE5uZcyr6BTs";
+        final String NEW_ACCT_LOCATION = "http://localhost:4001/acme/acct/25";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(NEW_ACCT_REQUEST_BODY, NEW_ACCT_RESPONSE_BODY, NEW_ACCT_REPLAY_NONCE, NEW_ACCT_LOCATION, 201)
+                .build();
+    }
+
+    private ClientAndServer setupTestCreateAccountWithoutAgreeingToTermsOfService() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"oyv-_7dfkxs\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator()  +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator()  +
+                "  \"meta\": {" + System.lineSeparator()  +
+                "    \"caaIdentities\": [" + System.lineSeparator()  +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator()  +
+                "    ]," + System.lineSeparator()  +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator()  +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator()  +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator()  +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator()  +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator()  +
+                "}";
+
+        final String NEW_NONCE_RESPONSE = "zinctnSRWv_CmPz5dhMgom1tppGmuXIqB8X8pZO_0YTF1Nc";
+
+        final String NEW_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJsblhXQ1JDUUpLOW93RXMzMVZrVFNLLWZ2aDcxMDVYOVhYNUFRaVYtbXgxRkJtdU95OVBBS3JTTUlNcXR2ZXk2REhRY0gwVzc5OGp4X3MwRFFmekhCb1E1aU56YUFtVDFhMG5xN3hBemhsRGM5YXZ6WndiTDl0WW1nV3pDM0VQZm1PcXVlNTFoQkZ0VzN3X29IaHpaeTU5YUV2bmZra0hfalJLYUdZRFlPb3F4VXNfNmNXMTVGV3JmWERhOVFIUEVkUEdHTEt6ZTF1aW92bGxON2dNdWZkUFdzZElKRGhwOU1JSGhhVTZjOUZSSDhRS0I1WXlSd0dYR0ZpVmNZU1cyUWtsQkxJN0EzWkdWd2Y5YXNOR0VoUzZfRUxIc2FZVnR3LWFwd1NSSnM1ZnlwVTZidFRDS2J0dUN3X0M0T1FtQXExNDRmdkstOEJSUk1WaE56Qkh6SXcifSwibm9uY2UiOiJ6aW5jdG5TUld2X0NtUHo1ZGhNZ29tMXRwcEdtdVhJcUI4WDhwWk9fMFlURjFOYyIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6ZmFsc2UsImNvbnRhY3QiOlsibWFpbHRvOmFkbWluQGFuZXhhbXBsZS5jb20iXX0\",\"signature\":\"OhI4lDd6BsTlKvqMsiBY8bCnfozYsclQPpB7apFVuP0BTfO9iUbybiZ1gHDRGsyUF84gMoBaozZX6iMIApBW9j21uQuWBCGyn-wyM_Fu6n5ruenNQPYyiQteiVYP36oXuSKT76AnsoqXbX5NHfvjOlPiREmD95sfKRuvlsDlgaRD1hGU5qFNt9gTr90vVADPrMN20O0QKSCx5d4cKjm2BvD4oM4xA-Qll2HCREeb40F7eeIGUdCxHflHQOPObm2JBHm2lhOieankj0HPunP43L607iCZ8W2DAaX6EKDfMYunnnbpj9vXkkRUm7yEi4LNRs6OS4Hc-LHqKsgWoWc3kQ\"}";
+
+        final String NEW_ACCT_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"type\": \"urn:ietf:params:acme:error:malformed\"," + System.lineSeparator() +
+                "  \"detail\": \"must agree to terms of service\"," + System.lineSeparator() +
+                "  \"status\": 400" + System.lineSeparator() +
+                "}";
+
+        final String NEW_ACCT_REPLAY_NONCE = "tarobHhNBawhfG-BpSmsBEpiESawT4Aw_k-sX2rqwjl-Mac";
+        final String NEW_ACCT_LOCATION = "";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(NEW_ACCT_REQUEST_BODY, NEW_ACCT_RESPONSE_BODY, NEW_ACCT_REPLAY_NONCE, NEW_ACCT_LOCATION, 400, true)
+                .build();
+    }
+
+    private ClientAndServer setupTestUpdateAccount() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"glYy9rwsgUk\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator()  +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator()  +
+                "  \"meta\": {" + System.lineSeparator()  +
+                "    \"caaIdentities\": [" + System.lineSeparator()  +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator()  +
+                "    ]," + System.lineSeparator()  +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator()  +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator()  +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator()  +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator()  +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator()  +
+                "}" + System.lineSeparator() ;
+
+        final String NEW_NONCE_RESPONSE = "zinckwe2yTRoZS7IVKa7d5SqTgkDkk7br3Ee1pYknH8yMjU";
+
+        final String QUERY_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJoOE9lZTViZURSZ3hOUGVfZU1FOUg2Vm83NEZ1ZzhIZ3Jpa2ZiZkNhVTNsS0Y2NDhRRzFYMWtHRFpUaEF5OGRhcUo4YnY2YzNQSmRueDJIcjhqT3psNTA5Ym5NNmNDV2Z5d1RwY0lab1V6UVFaTFlfSzhHTURBeWdsc1FySXRnQ2lRYWxJcWJ1SkVrb2MzV1FBSXhKMjN4djliSzV4blZRa1RXNHJWQkFjWU5Rd29CakdZT1dTaXpUR2ZqZ21RcVRYbG9hYW1GWkpuOTdIbmIxcWp5NVZZbTA2YnV5cXdBYUdIczFDTHUzY0xaZ1FwVkhRNGtGc3prOFlPNVVBRWppb2R1Z1dwWlVSdTlUdFJLek4wYmtFZGVRUFlWcGF1cFVxMWNxNDdScDJqcVZVWGRpUUxla3l4clFidDhBMnVHNEx6RFF1LWI0Y1pwcG16YzNobGhTR3cifSwibm9uY2UiOiJ6aW5ja3dlMnlUUm9aUzdJVkthN2Q1U3FUZ2tEa2s3YnIzRWUxcFlrbkg4eU1qVSIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJvbmx5UmV0dXJuRXhpc3RpbmciOnRydWV9\",\"signature\":\"AD35pVNdrGh_Ee6hPsEy57bgWi6P2u9Pnz_3_NYsMSEosbEZkOsnbuqvr6WDy2F1WCgGdL37zcpzxmYpO-7Jkh5Z_cAFQwOrbo6DZs3s7IyXocNebvE_pVsXx1sYiE4hTuPrRJCFDkXeYVCaIusr8Wjp4Zv2EZPqmMxxpV1cX3eIEwOgO4bkK1ni0Njw1MFPBHxtzJiBMLwvnFCvjbHDe6rqMYF_cWYclGhRuwdOsA97HggjX70FczicaNL2nwaIxEnqr1hvJs5IRYH8z0F-PImFApvEI21xJug372HfwolKgMr0nfBvgSCCOMLiGlchjIYMWMpQQ-rXtiECdaNIPQ\"}";
+
+        final String QUERY_ACCT_RESPONSE_BODY = "";
+
+        final String QUERY_ACCT_REPLAY_NONCE = "taro4jDwwpaHvLRPOKMPVNOy83ulFHS1I7ANXO-bBCxe1xs";
+
+        final String ACCT_PATH = "/acme/acct/5";
+        final String ACCT_LOCATION = "http://localhost:4001" + ACCT_PATH;
+
+        final String UPDATE_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvNSIsIm5vbmNlIjoidGFybzRqRHd3cGFIdkxSUE9LTVBWTk95ODN1bEZIUzFJN0FOWE8tYkJDeGUxeHMiLCJ1cmwiOiJodHRwOi8vbG9jYWxob3N0OjQwMDEvYWNtZS9hY2N0LzUifQ\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6ZmFsc2UsImNvbnRhY3QiOlsibWFpbHRvOmNlcnRpZmljYXRlc0BhbmV4YW1wbGUuY29tIiwibWFpbHRvOmFkbWluQGFuZXhhbXBsZS5jb20iXX0\",\"signature\":\"ACtHDATUrrv3HqnK2A8AuIvRZMBaIMOlJiXcMnPgCr2UlSrtsmwRDvEYevpuEk1AHGomyDZdeo92JxB2ijH9v3qMMBWcPWck0kuovAUvlr8qNv7M3WLtfNhLg26qcOOTkvUTAHHT-gO31Q45x7RUIyO2gl4Qz4lFBJX2kGseT2ay-jaS6KViud05G_uhhN7DC3D0KDPNdjzWlp7q78ZEdguBnSeVKb7W0Vxl8UrVdvBoVV3VRHqyiV-PZ1Of33a_R5Q5ZWKfMPfE7ol_LVhDMsSsn7ZKQ_fzFxzxk7clacDaIezKhcDr4JAokxFJHPBDJ1DaMGI_9Z1GAukYKLrogA\"}";
+
+        final String UPDATE_ACCT_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"key\": {" + System.lineSeparator()  +
+                "    \"kty\": \"RSA\"," + System.lineSeparator()  +
+                "    \"n\": \"h8Oee5beDRgxNPe_eME9H6Vo74Fug8HgrikfbfCaU3lKF648QG1X1kGDZThAy8daqJ8bv6c3PJdnx2Hr8jOzl509bnM6cCWfywTpcIZoUzQQZLY_K8GMDAyglsQrItgCiQalIqbuJEkoc3WQAIxJ23xv9bK5xnVQkTW4rVBAcYNQwoBjGYOWSizTGfjgmQqTXloaamFZJn97Hnb1qjy5VYm06buyqwAaGHs1CLu3cLZgQpVHQ4kFszk8YO5UAEjiodugWpZURu9TtRKzN0bkEdeQPYVpaupUq1cq47Rp2jqVUXdiQLekyxrQbt8A2uG4LzDQu-b4cZppmzc3hlhSGw\"," + System.lineSeparator()  +
+                "    \"e\": \"AQAB\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"contact\": [" + System.lineSeparator()  +
+                "    \"mailto:admin@anexample.com\"," + System.lineSeparator()  +
+                "    \"mailto:certificates@anexample.com\"" + System.lineSeparator()  +
+                "  ]," + System.lineSeparator()  +
+                "  \"initialIp\": \"127.0.0.1\"," + System.lineSeparator()  +
+                "  \"createdAt\": \"2019-07-12T16:52:19Z\"," + System.lineSeparator()  +
+                "  \"status\": \"valid\"" + System.lineSeparator()  +
+                "}";
+
+        final String UPDATE_ACCT_REPLAY_NONCE = "zincExjmJtQPd5Uj0U5a9-tCXBmis2U623JoApXOoIN6Oec";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY, QUERY_ACCT_RESPONSE_BODY, QUERY_ACCT_REPLAY_NONCE, ACCT_LOCATION, 200)
+                .updateAccountRequestAndResponse(UPDATE_ACCT_REQUEST_BODY, UPDATE_ACCT_RESPONSE_BODY, UPDATE_ACCT_REPLAY_NONCE, ACCT_PATH, 200)
+                .build();
+    }
+
+    private ClientAndServer setupTestChangeAccountKey() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"uBZzMh54N6Q\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "taroUPFo0aLcaedcnx3SpPDbSr2j84m3qw8rW2tZJnZm2FE";
+
+        final String QUERY_ACCT_REQUEST_BODY_1 = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJpcVZkd3laNGl0VlNoOFVWX2Z3NlpnVjh3Mk56SEtGdzZWeWl5cGRLMmlyUkk0T3BMdWhJNEhqQ3pSTHR0WkJPX3ZLRjFZaTB1dVdMaFFzMnVpWlJ5eXFCa0R6SXU3UnIwZWp2T2UtLVc2aWhLanE2WnNCQ2Q3eDhMUl9yYXp1X242V1BkQWJZeWZxdnBuS0V0bGZxdW4yMWJnWk1yT1R4YW0tS0FNS2kyNlJlVi1oVDlYU05kbWpoWnhtSzZzQ0NlTl9JOTVEUXZ1VG55VFctUUJFd2J2MVVOTEEtOXRIR3QyUzQ0a2JvT0JtemV6RGdPSVlfNFpNd3MtWXZucFd5VElsU0k3TmlNMVhKb1NXMHlSLWdjaFlRT1FuSEU2QUhtdk5KbV9zSTlZN0ZhQmJVeVJpS0RnTi1vZlR3cXNzdzZ2ejVucUxUanU3Y2dzWld4S1dESHcifSwibm9uY2UiOiJ0YXJvVVBGbzBhTGNhZWRjbngzU3BQRGJTcjJqODRtM3F3OHJXMnRaSm5abTJGRSIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJvbmx5UmV0dXJuRXhpc3RpbmciOnRydWV9\",\"signature\":\"XzrLN-kD_C0TAN7NhxdUJqIeAbUw2WWp5pwnK5tPkF177gUStWbyuCKpK68lMgmQa_EpImAUNQ8wT-oXP4ARZCYcuJZ-Hii1qXYGkXC9DCGuEPffk4c4M6F7JhA4FdlV_0nAV5i5Q6nILtn7nARqSc239jPJasM-ZjGdhfc7UCObpufoZqCChQn5N8MfLnZA8-SZK9M5pm9SM72JjUc3L9FRvFCG8p7iU_A0Lt7g9yD9LyddtONuVrzhmIm43e3pU3CaarhxA7vHlS-Vahnl-8fFCwEnsaC3b_EMfZYxBvvI28n4tn7QgwcOy6kLaNp1TXs0vxP23v_3y5dO79GSig\"}";
+
+        final String QUERY_ACCT_RESPONSE_BODY_1 = "";
+
+        final String QUERY_ACCT_REPLAY_NONCE_1 = "zinchourU8rrtvhVwzICl7mpth8YWPTP-7Z4aU2UNEXVONs";
+
+        final String ACCT_PATH = "/acme/acct/10";
+        final String ACCT_LOCATION = "http://localhost:4001" + ACCT_PATH;
+
+        final String CHANGE_KEY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"key\": {" + System.lineSeparator() +
+                "    \"kty\": \"RSA\"," + System.lineSeparator() +
+                "    \"n\": \"iqVdwyZ4itVSh8UV_fw6ZgV8w2NzHKFw6VyiypdK2irRI4OpLuhI4HjCzRLttZBO_vKF1Yi0uuWLhQs2uiZRyyqBkDzIu7Rr0ejvOe--W6ihKjq6ZsBCd7x8LR_razu_n6WPdAbYyfqvpnKEtlfqun21bgZMrOTxam-KAMKi26ReV-hT9XSNdmjhZxmK6sCCeN_I95DQvuTnyTW-QBEwbv1UNLA-9tHGt2S44kboOBmzezDgOIY_4ZMws-YvnpWyTIlSI7NiM1XJoSW0yR-gchYQOQnHE6AHmvNJm_sI9Y7FaBbUyRiKDgN-ofTwqssw6vz5nqLTju7cgsZWxKWDHw\"," + System.lineSeparator() +
+                "    \"e\": \"AQAB\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"contact\": [" + System.lineSeparator() +
+                "    \"mailto:admin@anexample.com\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"initialIp\": \"10.77.77.1\"," + System.lineSeparator() +
+                "  \"createdAt\": \"2019-07-15T19:53:57Z\"," + System.lineSeparator() +
+                "  \"status\": \"valid\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+        final String CHANGE_KEY_REPLAY_NONCE = "zinchourU8rrtvhVwzICl7mpth8YWPTP-7Z4aU2UNEXVONs";
+
+        final String QUERY_ACCT_RESPONSE_BODY_2 = "{" + System.lineSeparator() +
+                "  \"key\": {" + System.lineSeparator() +
+                "    \"kty\": \"RSA\"," + System.lineSeparator() +
+                "    \"n\": \"rDYXH58ys0MT97z_7gLkNFmQSXR_eb49c_55Wk3eSQpT3sUyq1YuKGWRc92-nBz6twdXa3VixAoXkxWhCxu0A_rbo_eTXe8WlVpCBKr5rM6wAlKENDrSQZD6MdzLLGaA207a_WFG7UPDUKH2_qH98CN5eleDn0TUYa6RYFF6j5D_T1Jg5nhC9I3P4zQ-WDNYvYEkEqPUgzK4cPOBXiMB_XFb2wf8mpm2pN8Fr5XOpQYeY1YXH-HGuYG5StUq__BDForbbQ_R7HSemdMglwujM46LteCvAr-Z5XBa2ue7mRK2RAkk_3-3Tmuj8ewyNGFw_AANvl8nyhZ-BU4VZvw-HQ\"," + System.lineSeparator() +
+                "    \"e\": \"AQAB\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"contact\": [" + System.lineSeparator() +
+                "    \"mailto:admin@anexample.com\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"initialIp\": \"10.77.77.1\"," + System.lineSeparator() +
+                "  \"createdAt\": \"2019-07-15T19:53:57Z\"," + System.lineSeparator() +
+                "  \"status\": \"valid\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String QUERY_ACCT_REPLAY_NONCE_2 = "taroG712eL8LB6nca1rdSadsNXQftZ5wOLN8unyyuakUuLE";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY_1, QUERY_ACCT_RESPONSE_BODY_1, QUERY_ACCT_REPLAY_NONCE_1, ACCT_LOCATION, 200)
+                .addChangeKeyRequestAndResponse("", CHANGE_KEY_RESPONSE_BODY, CHANGE_KEY_REPLAY_NONCE, 200)
+                .updateAccountRequestAndResponse("", QUERY_ACCT_RESPONSE_BODY_2, QUERY_ACCT_REPLAY_NONCE_2, ACCT_PATH, 200)
+                .build();
+    }
+
+    private ClientAndServer setupTestDeactivateAccount() {
+        final String ACCT_PATH = "/acme/acct/27";
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"3eIUmKQ9AnQ\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "zincZiszqbk6nHHJlWsqX1-GJ1PSxqQGAtTIU0SRPrqF06E";
+        final String UPDATE_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMjciLCJub25jZSI6InppbmNaaXN6cWJrNm5ISEpsV3NxWDEtR0oxUFN4cVFHQXRUSVUwU1JQcnFGMDZFIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvYWNjdC8yNyJ9\",\"payload\":\"eyJzdGF0dXMiOiJkZWFjdGl2YXRlZCJ9\",\"signature\":\"K_6fwCbn5ZGsTgGeibADLSiGXi-x5RU8SlOChF_tL6HAhmypXmdU94emuAMtPjfMOoyjcKd_g0Fl2TpgFW8eLdb7JaiFLpisnYWxAJ99eK2TlNifpbKQQ1N-s1Y13jO2KcPZfrRI_bWFl5J66tKUvfuqewJA2QtFmqn1H7s2N6Yn7hOQ4FZAs7FdYu9Q6PNcwKb5lVrysPoHKXEeRdjYMTW7J6W9ajxxqm3C2mQ-s-kwZgDs_4PH4-D9RTMonSMqcK-dPoimT-wlEicllDYIxfTfeAQpL4MXD5eAuSje2c5DRMWL4WQdxBnRu5ytAD1vQ-cvKqwqCI2bRR9SCJn1VQ\"}";
+
+        final String UPDATE_ACCT_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"key\": {" + System.lineSeparator() +
+                "    \"kty\": \"RSA\"," + System.lineSeparator() +
+                "    \"n\": \"xnddRMbKWbaEmR-SlgpG3C2SdsUtcqsC8Xp4bHWtW9PLTWz18IGupxtP_EtRjuvBZZIHObY3-NvVRxWztLpFqYi-ns07rKWGQ49Y3Q2KC5lEAezahFB1_PGBf5bAO0qZZmX17vRxXfdB3LipT_I4W-CkRq_zsJnM4cgOvRGqpt_fBHDajN9VWKXWl93i-1ddANMe2enTgHm60k5eFXZaxC_tCnM7ryHRLyp36RRs3-R9AgMtBgOruFWSIJjISwknvGi2Fu6xVwc6hRj7lB4xuJPzHHNjXztSiHaLWrADS7mmA6nbUF84kUGe6-AgsNPSgh-gq_fiGYCxvJ9Bn1qbPw\"," + System.lineSeparator() +
+                "    \"e\": \"AQAB\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"contact\": [" + System.lineSeparator() +
+                "    \"mailto:admin@anexample.com\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"initialIp\": \"10.77.77.1\"," + System.lineSeparator() +
+                "  \"createdAt\": \"2019-07-17T20:34:28Z\"," + System.lineSeparator() +
+                "  \"status\": \"deactivated\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String UPDATE_ACCT_REPLAY_NONCE = "taro1luvl7fpnbTOOb2dTFMLlDW--VyPhD_rG5GCpvbqyOE";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .updateAccountRequestAndResponse(UPDATE_ACCT_REQUEST_BODY, UPDATE_ACCT_RESPONSE_BODY, UPDATE_ACCT_REPLAY_NONCE, ACCT_PATH, 200)
+                .build();
+    }
+
+    private ClientAndServer setupTestGetMetadataAllValuesSet() {
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"JDkpnLkaC1Q\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator()  +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator()  +
+                "  \"meta\": {" + System.lineSeparator()  +
+                "    \"caaIdentities\": [" + System.lineSeparator()  +
+                "      \"happy-hacker-ca.invalid\"," + System.lineSeparator()  +
+                "      \"happy-hacker2-ca.invalid\"" + System.lineSeparator()  +
+                "    ]," + System.lineSeparator()  +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator()  +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"," + System.lineSeparator()  +
+                "    \"externalAccountRequired\": true" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator()  +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator()  +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator()  +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator()  +
+                "}";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .build();
+    }
+
+    private ClientAndServer setupTestGetMetadataSomeValuesSet() {
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"LRkPnZpS4yE\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .build();
+    }
+
+    private ClientAndServer setupTestGetMetadataNoValuesSet() {
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"N6HzXUZ-eWI\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .build();
+    }
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreTestCase.java
new file mode 100644
index 0000000..15c1c48
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreTestCase.java
@@ -0,0 +1,527 @@
+/*
+ * Copyright 2019 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILED;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.wildfly.security.encryption.SecretKeyUtil.importSecretKey;
+
+import java.security.AccessController;
+import java.security.GeneralSecurityException;
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.Security;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import javax.crypto.SecretKey;
+
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.subsystem.test.AbstractSubsystemTest;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.wildfly.security.WildFlyElytronProvider;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.encryption.CipherUtil;
+
+/**
+ * Test case testing operations against a credential store using the management operations.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+public class CredentialStoreTestCase extends AbstractSubsystemTest {
+
+    private static final Provider PROVIDER = new WildFlyElytronProvider();
+
+    private static final String CLEAR_TEXT = "Lorem ipsum dolor sit amet";
+    private static final String CONFIGURATION = "credential-store.xml";
+
+    private KernelServices services = null;
+
+    public CredentialStoreTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    @Before
+    public void init() throws Exception {
+        services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXmlResource(CONFIGURATION).build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+
+    }
+
+    @BeforeClass
+    public static void initTests() throws Exception {
+        AccessController.doPrivileged(new PrivilegedAction<Integer>() {
+            public Integer run() {
+                return Security.insertProviderAt(PROVIDER, 1);
+            }
+        });
+    }
+
+    @AfterClass
+    public static void cleanUpTests() {
+        AccessController.doPrivileged(new PrivilegedAction<Void>() {
+            public Void run() {
+                Security.removeProvider(PROVIDER.getName());
+
+                return null;
+            }
+        });
+    }
+
+    // Test Contents of dynamically initialised credential stores
+
+    @Test
+    public void testDefaultContentTest() throws GeneralSecurityException {
+        testDefaultContent("credential-store", "test", null, -1);
+    }
+
+    @Test
+    public void testDefaultContentTestEmpty() throws GeneralSecurityException {
+        testDefaultContent("secret-key-credential-store", "testEmpty", null, -1);
+    }
+
+    @Test
+    public void testDefaultContentTest128() throws GeneralSecurityException {
+        testDefaultContent("secret-key-credential-store", "test128", "key", 128);
+    }
+
+    @Test
+    public void testDefaultContentTest192() throws GeneralSecurityException {
+        testDefaultContent("secret-key-credential-store", "test192", "192", 192);
+    }
+
+    @Test
+    public void testDefaultContentTest256() throws GeneralSecurityException {
+        testDefaultContent("secret-key-credential-store", "test256", "key", 256);
+    }
+
+    private void testDefaultContent(final String storeType, final String storeName, String expectedAlias, int expectedKeySize) throws GeneralSecurityException {
+        // First Check The Default Aliases
+        ModelNode readAliases = new ModelNode();
+        readAliases.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        readAliases.get(ClientConstants.OP).set("read-aliases");
+
+        ModelNode aliases = assertSuccess(services.executeOperation(readAliases)).get("result");
+        System.out.println(aliases.toString());
+        List<ModelNode> aliasValues = aliases.asList();
+        assertEquals("Expected alias count", expectedAlias != null ? 1 : 0, aliasValues.size());
+        if (expectedAlias != null) {
+            assertEquals("Expected alias name", expectedAlias, aliasValues.get(0).asString());
+
+            // Export the generated SecretKey
+            ModelNode export = new ModelNode();
+            export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+            export.get(ClientConstants.OP).set("export-secret-key");
+            export.get(Constants.ALIAS).set(expectedAlias);
+            ModelNode exportResult = assertSuccess(services.executeOperation(export));
+
+            final String key = exportResult.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+            SecretKey secretKey = importSecretKey(key);
+            // Key Sizes are in bits.
+            assertEquals("Expected Key Size", expectedKeySize, secretKey.getEncoded().length * 8);
+        }
+    }
+
+    // Add SecretKey Flow for secret-key-credential-store but take into account the resource also has a default key size.
+
+    @Test
+    public void testSecretKeyFlowDefault() throws GeneralSecurityException {
+        testSecretKeyGenerateExportImport("credential-store", "test", 256, true, true);
+        testSecretKeyGenerateExportImport("secret-key-credential-store", "test128", 128, true, false);
+        testSecretKeyGenerateExportImport("secret-key-credential-store", "test192", 192, true, false);
+        testSecretKeyGenerateExportImport("secret-key-credential-store", "test256", 256, true, false);
+    }
+
+    @Test
+    public void testSecretKeyFlow128() throws GeneralSecurityException {
+        testSecretKeyGenerateExportImport("credential-store", "test", 128, false, true);
+        // Use a store which does not default to 128 bits.
+        testSecretKeyGenerateExportImport("secret-key-credential-store", "test256", 128, false, false);
+    }
+
+    @Test
+    public void testSecretKeyFlow192() throws GeneralSecurityException {
+        testSecretKeyGenerateExportImport("credential-store", "test", 192, false, true);
+        // Use a store which does not default to 192 bits.
+        testSecretKeyGenerateExportImport("secret-key-credential-store", "test256", 192, false, false);
+    }
+
+    @Test
+    public void testSecretKeyFlow256() throws GeneralSecurityException {
+        testSecretKeyGenerateExportImport("credential-store", "test", 256, false, true);
+        // Use a store which does not default to 256 bits.
+        testSecretKeyGenerateExportImport("secret-key-credential-store", "test128", 256, false, false);
+    }
+
+    private void testSecretKeyGenerateExportImport(final String storeType, final String storeName, final int keySize,
+            boolean omitKeySize, boolean entryTypeRequired) throws GeneralSecurityException {
+        final String alias = "test";
+
+        // Generate and store a new SecretKey using the specified keySize.
+        ModelNode generate = new ModelNode();
+        generate.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        generate.get(ClientConstants.OP).set("generate-secret-key");
+        generate.get(Constants.ALIAS).set(alias);
+        if (!omitKeySize) {
+            if (keySize > 0) {
+                generate.get(Constants.KEY_SIZE).set(keySize);
+            }
+        }
+        assertSuccess(services.executeOperation(generate));
+
+        // Export the generated SecretKey
+        ModelNode export = new ModelNode();
+        export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        export.get(ClientConstants.OP).set("export-secret-key");
+        export.get(Constants.ALIAS).set(alias);
+        ModelNode exportResult = assertSuccess(services.executeOperation(export));
+
+        final String key = exportResult.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+
+        SecretKey secretKey = importSecretKey(key);
+        // Key Sizes are in bits.
+        assertEquals("Expected Key Size", keySize, secretKey.getEncoded().length * 8);
+
+
+        String importAlias = alias + "Import";
+        // Import the previously exported SecretKey
+        ModelNode importKey = new ModelNode();
+        importKey.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        importKey.get(ClientConstants.OP).set("import-secret-key");
+        importKey.get(Constants.ALIAS).set(importAlias);
+        importKey.get(Constants.KEY).set(key);
+        assertSuccess(services.executeOperation(importKey));
+
+        // Re-export so keys can be compared
+        ModelNode export2 = new ModelNode();
+        export2.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        export2.get(ClientConstants.OP).set("export-secret-key");
+        export2.get(Constants.ALIAS).set(importAlias);
+        ModelNode exportResult2 = assertSuccess(services.executeOperation(export2));
+
+        final String key2 = exportResult2.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+        assertNotNull("Exported SecretKey", key);
+        assertEquals("Matching keys", key, key2);
+
+        // Remove aliases
+        ModelNode remove = new ModelNode();
+        remove.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        remove.get(ClientConstants.OP).set("remove-alias");
+        if (entryTypeRequired) {
+            remove.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        }
+        remove.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(remove));
+
+        ModelNode remove2 = new ModelNode();
+        remove2.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        remove2.get(ClientConstants.OP).set("remove-alias");
+        if (entryTypeRequired) {
+            remove2.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        }
+        remove2.get(Constants.ALIAS).set(importAlias);
+        assertSuccess(services.executeOperation(remove2));
+    }
+
+    @Test
+    public void testCreateExpression() throws Exception {
+        // First obtain the generated SecretKey as we will want this to test any expressions can be decrypted.
+        ModelNode export = new ModelNode();
+        export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("secret-key-credential-store", "test256");
+        export.get(ClientConstants.OP).set("export-secret-key");
+        export.get(Constants.ALIAS).set("key");
+        ModelNode exportResult = assertSuccess(services.executeOperation(export));
+
+        final String key = exportResult.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+
+        SecretKey secretKey = importSecretKey(key);
+
+        ModelNode createExpression = new ModelNode();
+        createExpression.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("expression", "encryption");
+        createExpression.get(ClientConstants.OP).set("create-expression");
+        createExpression.get(Constants.RESOLVER).set("A");
+        createExpression.get(Constants.CLEAR_TEXT).set(CLEAR_TEXT);
+        ModelNode createExpressionResult = assertSuccess(services.executeOperation(createExpression));
+
+        String expression = createExpressionResult.get(ClientConstants.RESULT).get(Constants.EXPRESSION).asString();
+        assertEquals("Expected Expression Prefix", "${CIPHER::A:", expression.substring(0, 12));
+        String cipherTextToken = expression.substring(12, expression.length() - 1);
+        assertEquals("Decrypted value", CLEAR_TEXT, CipherUtil.decrypt(cipherTextToken, secretKey));
+
+        createExpression = new ModelNode();
+        createExpression.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("expression", "encryption");
+        createExpression.get(ClientConstants.OP).set("create-expression");
+        createExpression.get(Constants.CLEAR_TEXT).set(CLEAR_TEXT);
+        createExpressionResult = assertSuccess(services.executeOperation(createExpression));
+
+        expression = createExpressionResult.get(ClientConstants.RESULT).get(Constants.EXPRESSION).asString();
+        assertEquals("Expected Expression Prefix", "${CIPHER::", expression.substring(0, 10));
+        cipherTextToken = expression.substring(10, expression.length() - 1);
+        assertEquals("Decrypted value", CLEAR_TEXT, CipherUtil.decrypt(cipherTextToken, secretKey));
+    }
+
+    @Test
+    public void testErrorsOfDoubleOperationsInFlow() throws GeneralSecurityException {
+        testErrorsOfDoubleOperationsInFlow("credential-store", "test", true);
+        testErrorsOfDoubleOperationsInFlow("secret-key-credential-store", "test128", false);
+    }
+
+    private void testErrorsOfDoubleOperationsInFlow(final String storeType, final String storeName,
+            boolean entryTypeRequired) throws GeneralSecurityException {
+
+        final String alias = "test";
+
+        // Generate and store a new SecretKey.
+        ModelNode generate = new ModelNode();
+        generate.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        generate.get(ClientConstants.OP).set("generate-secret-key");
+        generate.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(generate));
+
+        ModelNode doubleGenerateResult = assertFailed(services.executeOperation(generate));
+        assertThat(doubleGenerateResult.get(ClientConstants.FAILURE_DESCRIPTION).asString(), containsString("ELYTLS00203:"));
+
+        // Export the generated SecretKey
+        ModelNode export = new ModelNode();
+        export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        export.get(ClientConstants.OP).set("export-secret-key");
+        export.get(Constants.ALIAS).set(alias);
+        ModelNode exportResult = assertSuccess(services.executeOperation(export));
+
+        final String key = exportResult.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+
+        String importAlias = alias + "Import";
+        // Import the previously exported SecretKey
+        ModelNode importKey = new ModelNode();
+        importKey.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        importKey.get(ClientConstants.OP).set("import-secret-key");
+        importKey.get(Constants.ALIAS).set(importAlias);
+        importKey.get(Constants.KEY).set(key);
+        assertSuccess(services.executeOperation(importKey));
+
+        ModelNode doubleImportResult = assertFailed(services.executeOperation(importKey));
+        assertThat(doubleImportResult.get(ClientConstants.FAILURE_DESCRIPTION).asString(), containsString("ELYTLS00203:"));
+
+        // Remove aliases
+        ModelNode remove = new ModelNode();
+        remove.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        remove.get(ClientConstants.OP).set("remove-alias");
+        if (entryTypeRequired) {
+            remove.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        }
+        remove.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(remove));
+
+        ModelNode remove2 = new ModelNode();
+        remove2.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        remove2.get(ClientConstants.OP).set("remove-alias");
+        if (entryTypeRequired) {
+            remove2.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        }
+        remove2.get(Constants.ALIAS).set(importAlias);
+        assertSuccess(services.executeOperation(remove2));
+
+        ModelNode doubleRemoveResult = assertFailed(services.executeOperation(remove2));
+        assertThat(doubleRemoveResult.get(ClientConstants.FAILURE_DESCRIPTION).asString(), containsString("ELYTLS00205:"));
+    }
+
+    @Test
+    public void testExportNonExistingAlias() throws GeneralSecurityException {
+        testExportNonExistingAlias("credential-store", "test");
+        testExportNonExistingAlias("secret-key-credential-store", "test192");
+    }
+
+    private void testExportNonExistingAlias(final String storeType, final String storeName) throws GeneralSecurityException {
+        final String alias = "test";
+
+        // Export the generated SecretKey
+        ModelNode export = new ModelNode();
+        export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        export.get(ClientConstants.OP).set("export-secret-key");
+        export.get(Constants.ALIAS).set(alias);
+        ModelNode exportResult = assertFailed(services.executeOperation(export));
+        assertThat(exportResult.get(ClientConstants.FAILURE_DESCRIPTION).asString(), containsString("ELYTLS00205:"));
+    }
+
+    @Test
+    public void testImportInvalidSecretKey() throws GeneralSecurityException {
+        testImportInvalidSecretKey("credential-store", "test");
+        testImportInvalidSecretKey("secret-key-credential-store", "test256");
+    }
+
+    private void testImportInvalidSecretKey(final String storeType, final String storeName) throws GeneralSecurityException {
+        final String alias = "test";
+
+        // Generate and store a new SecretKey.
+        ModelNode generate = new ModelNode();
+        generate.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        generate.get(ClientConstants.OP).set("generate-secret-key");
+        generate.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(generate));
+
+        // Export the generated SecretKey
+        ModelNode export = new ModelNode();
+        export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        export.get(ClientConstants.OP).set("export-secret-key");
+        export.get(Constants.ALIAS).set(alias);
+        ModelNode exportResult = assertSuccess(services.executeOperation(export));
+
+        final String key = exportResult.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+        final String truncatedKey = key.substring(0, key.length() - 2);
+
+        String importAlias = alias + "Import";
+        // Import the previously exported and truncated SecretKey
+        ModelNode importKey = new ModelNode();
+        importKey.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        importKey.get(ClientConstants.OP).set("import-secret-key");
+        importKey.get(Constants.ALIAS).set(importAlias);
+        importKey.get(Constants.KEY).set(truncatedKey);
+        ModelNode importResult = assertFailed(services.executeOperation(importKey));
+        assertThat(importResult.get(ClientConstants.FAILURE_DESCRIPTION).asString(), containsString("ELY19004:"));
+
+        // Remove aliases
+        ModelNode remove = new ModelNode();
+        remove.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(storeType, storeName);
+        remove.get(ClientConstants.OP).set("remove-alias");
+        remove.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        remove.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(remove));
+    }
+
+    @Test
+    public void testRemoveAliasOfEntryType() throws GeneralSecurityException {
+        final String alias = "test";
+
+        testExpectedAliases("credential-store", "test");
+
+        // Generate and store a new SecretKey.
+        ModelNode generateSecretKey = new ModelNode();
+        generateSecretKey.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("credential-store", "test");
+        generateSecretKey.get(ClientConstants.OP).set("generate-secret-key");
+        generateSecretKey.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(generateSecretKey));
+
+        testExpectedAliases("credential-store", "test", alias);
+
+        // Store a new Password.
+        ModelNode addPassword = new ModelNode();
+        addPassword.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("credential-store", "test");
+        addPassword.get(ClientConstants.OP).set("add-alias");
+        addPassword.get(Constants.ALIAS).set(alias);
+        addPassword.get(Constants.SECRET_VALUE).set("password");
+        assertSuccess(services.executeOperation(addPassword));
+
+        testExpectedAliases("credential-store", "test", alias);
+
+        // Remove SecretKeyCredential alias
+        ModelNode removeSecretKey = new ModelNode();
+        removeSecretKey.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("credential-store", "test");
+        removeSecretKey.get(ClientConstants.OP).set("remove-alias");
+        removeSecretKey.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        removeSecretKey.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(removeSecretKey));
+
+        testExpectedAliases("credential-store", "test", alias);
+
+        // Generate and store a new SecretKey again.
+        ModelNode generateSecretKeyAgain = new ModelNode();
+        generateSecretKeyAgain.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("credential-store", "test");
+        generateSecretKeyAgain.get(ClientConstants.OP).set("generate-secret-key");
+        generateSecretKeyAgain.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(generateSecretKeyAgain));
+
+        testExpectedAliases("credential-store", "test", alias);
+
+        // Remove PasswordCredential alias (default type)
+        ModelNode removePassword = new ModelNode();
+        removePassword.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("credential-store", "test");
+        removePassword.get(ClientConstants.OP).set("remove-alias");
+        removePassword.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(removePassword));
+
+        testExpectedAliases("credential-store", "test", alias);
+
+        // Remove SecretKeyCredential alias again
+        ModelNode removeSecretKeyAgain = new ModelNode();
+        removeSecretKeyAgain.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("credential-store", "test");
+        removeSecretKeyAgain.get(ClientConstants.OP).set("remove-alias");
+        removeSecretKeyAgain.get(Constants.ENTRY_TYPE).set(SecretKeyCredential.class.getSimpleName());
+        removeSecretKeyAgain.get(Constants.ALIAS).set(alias);
+        assertSuccess(services.executeOperation(removeSecretKeyAgain));
+
+        testExpectedAliases("credential-store", "test");
+    }
+
+    private void testExpectedAliases(String resourceType, String resourceName,
+            String... expectedAliases) throws GeneralSecurityException {
+
+        ModelNode readAliases = new ModelNode();
+        readAliases.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(resourceType, resourceName);
+        readAliases.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+
+        ModelNode readAliasesResult = assertSuccess(services.executeOperation(readAliases));
+
+        ModelNode result = readAliasesResult.get(ClientConstants.RESULT);
+        if (expectedAliases.length > 0) {
+            Set<String> expectedSet = new HashSet<>(Arrays.asList(expectedAliases));
+
+            List<ModelNode> aliasList = result.asList();
+            for (ModelNode aliasNode : aliasList) {
+                String alias = aliasNode.asString();
+                if (!expectedSet.remove(alias)) {
+                    fail("Alias '" + alias + "' not expected.");
+                }
+            }
+
+            assertEquals("All expected aliases found", 0, expectedSet.size());
+        } else {
+            assertTrue("No aliases expected", result.asList().isEmpty());
+        }
+    }
+
+    private static ModelNode assertSuccess(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(SUCCESS)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private static ModelNode assertFailed(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(FAILED)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreUpdatesTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreUpdatesTestCase.java
new file mode 100644
index 0000000..f382ea4
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreUpdatesTestCase.java
@@ -0,0 +1,781 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2019 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILED;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILURE_DESCRIPTION;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.NAME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RESULT;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.jboss.as.controller.security.CredentialReference.ALIAS;
+import static org.jboss.as.controller.security.CredentialReference.CLEAR_TEXT;
+import static org.jboss.as.controller.security.CredentialReference.CREDENTIAL_REFERENCE;
+import static org.jboss.as.controller.security.CredentialReference.NEW_ALIAS;
+import static org.jboss.as.controller.security.CredentialReference.STORE;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.Security;
+import java.util.Objects;
+
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.subsystem.test.AbstractSubsystemTest;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceName;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.wildfly.security.WildFlyElytronProvider;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.credential.store.CredentialStoreException;
+import org.wildfly.security.password.interfaces.ClearPassword;
+
+/**
+ * Tests for automatic updates of credential stores.
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ */
+public class CredentialStoreUpdatesTestCase extends AbstractSubsystemTest {
+
+    private static final String EMPTY_CS_PASSWORD = "super_secret1";
+    private static final String NON_EMPTY_CS_PASSWORD = "super_secret2";
+    private static final String EMPTY_CS_NAME = "store1";
+    private static final String EMPTY_CS_PATH = "target/test.credential.store1";
+    private static final String NON_EMPTY_CS_NAME = "store2";
+    private static final String NON_EMPTY_CS_PATH = "target/test.credential.store2";
+    private static final String KS_NAME = "test-keystore";
+    private static final String CLEAR_TEXT_ATTRIBUTE_NAME = CredentialReference.CREDENTIAL_REFERENCE + "." + CLEAR_TEXT;
+    private static final String ALIAS_ATTRIBUTE_NAME = CredentialReference.CREDENTIAL_REFERENCE + "." + ALIAS;
+    private static final String STORE_ATTRIBUTE_NAME = CredentialReference.CREDENTIAL_REFERENCE + "." + STORE;
+    private static final String EXISTING_ALIAS = "existingAlias";
+    private static final String EXISTING_PASSWORD = "existingPassword";
+    private static final Provider wildFlyElytronProvider = new WildFlyElytronProvider();
+    private static CredentialStoreUtility emptyCSUtil = null;
+    private static CredentialStoreUtility nonEmptyCSUtil = null;
+    private KernelServices services = null;
+
+    public CredentialStoreUpdatesTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    @BeforeClass
+    public static void initTests() {
+        AccessController.doPrivileged(new PrivilegedAction<Integer>() {
+            public Integer run() {
+                return Security.insertProviderAt(wildFlyElytronProvider, 1);
+            }
+        });
+    }
+
+    @Before
+    public void init() throws Exception {
+        services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXmlResource("credential-store-updates.xml").build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+        emptyCSUtil = new CredentialStoreUtility(EMPTY_CS_PATH, EMPTY_CS_PASSWORD);
+        nonEmptyCSUtil = new CredentialStoreUtility(NON_EMPTY_CS_PATH, NON_EMPTY_CS_PASSWORD);
+    }
+
+    @After
+    public void cleanUpCredentialStores() {
+        emptyCSUtil.cleanUp();
+        nonEmptyCSUtil.cleanUp();
+    }
+
+    @AfterClass
+    public static void cleanUpTests() {
+        AccessController.doPrivileged(new PrivilegedAction<Void>() {
+            public Void run() {
+                Security.removeProvider(wildFlyElytronProvider.getName());
+                return null;
+            }
+        });
+    }
+
+    @Test
+    public void testCredentialReferenceAddNewEntryToEmptyCredentialStore() throws Exception {
+        String alias = "newAlias";
+        String password = "newPassword";
+        try {
+            CredentialStore credentialStore = getCredentialStore(EMPTY_CS_NAME);
+            assertEquals(0, credentialStore.getAliases().size());
+
+            addKeyStoreWithCredentialReference(KS_NAME, EMPTY_CS_NAME, alias, password, false);
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(alias, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(alias, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(alias, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceAddNewEntryWithGeneratedAliasToEmptyCredentialStore() throws Exception {
+        String password = "newPassword";
+        try {
+            CredentialStore credentialStore = getCredentialStore(EMPTY_CS_NAME);
+            assertEquals(0, credentialStore.getAliases().size());
+
+            String generatedAlias = addKeyStoreWithCredentialReference(KS_NAME, EMPTY_CS_NAME,null, password, false);
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(generatedAlias, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(generatedAlias, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(generatedAlias, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceAddNewEntry() throws Exception {
+        String alias = "newAlias";
+        String password = "newPassword";
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+            assertFalse(credentialStore.exists(alias, PasswordCredential.class));
+            assertEquals(1, credentialStore.getAliases().size());
+
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, alias, password, false);
+            assertEquals(2, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(alias, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(alias, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(alias, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceAddNewEntryWithGeneratedAlias() throws Exception {
+        String password = "newPassword";
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+            assertEquals(1, credentialStore.getAliases().size());
+
+            String generatedAlias = addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME,  null, password, false);
+            assertEquals(2, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(generatedAlias, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(generatedAlias, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(generatedAlias, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceUpdateExistingEntry() throws Exception {
+        String newPassword = "newPassword";
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+            assertEquals(1, credentialStore.getAliases().size());
+
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, newPassword, true);
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(newPassword.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceAddNewEntryFromOperation() throws Exception {
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true, false);
+
+            String alias = "newAlias";
+            String password = "newPassword";
+            assertFalse(credentialStore.exists(alias, PasswordCredential.class));
+            assertEquals(1, credentialStore.getAliases().size());
+
+            // specify a credential-reference when executing a key-store operation
+            generateKeyPairWithCredentialStoreUpdate(KS_NAME, NON_EMPTY_CS_NAME, alias, password, false);
+            assertEquals(2, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(alias, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(alias, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceAddNewEntryWithGeneratedAliasFromOperation() throws Exception {
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true, false);
+
+            String password = "newPassword";
+            assertEquals(1, credentialStore.getAliases().size());
+
+            // specify a credential-reference when executing a key-store operation
+            String generatedAlias = generateKeyPairWithCredentialStoreUpdate(KS_NAME, NON_EMPTY_CS_NAME, null, password, false);
+            assertEquals(2, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(generatedAlias, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(generatedAlias, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceUpdateExistingEntryFromOperation() throws Exception {
+        try {
+            addKeyStoreWithCredentialReference(KS_NAME, EMPTY_CS_NAME, "alias1", "secret", false, false);
+
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+
+            // specify a credential-reference when executing a key-store operation
+            String password = "newPassword";
+            generateKeyPairWithCredentialStoreUpdate(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, password, true);
+
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals("alias1", readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceUpdateExistingEntryFromWriteAttributeOperation() throws Exception {
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+            assertEquals(1, credentialStore.getAliases().size());
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true);
+
+            String password = "newPassword";
+            writeClearTextAttribute("key-store", KS_NAME, password);
+
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(password.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceNoUpdate() throws Exception {
+        try {
+            CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            PasswordCredential passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+            assertEquals(1, credentialStore.getAliases().size());
+
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true);
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceRollbackOfNewlyAddedCredentialDuringAddOperation() throws Exception {
+        String alias = "newAlias";
+        String password = "newPassword";
+
+        CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+        assertFalse(credentialStore.exists(alias, PasswordCredential.class));
+        assertEquals(1, credentialStore.getAliases().size());
+
+
+        // Add an invalid key-store, specify a credential-reference attribute that will result in a new entry being added
+        // to the credential store. The new entry will be rolled back when the key-store add operation fails
+        addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, alias, password, "InvalidType", false, true, true);
+        assertEquals(1, credentialStore.getAliases().size());
+        assertFalse(credentialStore.exists(alias, PasswordCredential.class));
+
+    }
+
+    @Test
+    public void testCredentialReferenceRollbackOfUpdatedExistingCredentialDuringAddOperation() throws Exception {
+        String password = "newPassword";
+
+        CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+        assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+        PasswordCredential passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+        ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+        assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+        assertEquals(1, credentialStore.getAliases().size());
+
+        // Add an invalid key-store, specify a credential-reference attribute that will result in an existing entry being updated
+        // in the credential store. The updated entry will be rolled back to its previous value when the key-store add operation fails
+        addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, password, "InvalidType", false, true, true);
+        assertEquals(1, credentialStore.getAliases().size());
+        assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+        passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+        clearPassword = passwordCredential.getPassword(ClearPassword.class);
+        assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword()); // password should remain unchanged
+    }
+
+    @Test
+    public void testFailedAddOperationWithClearTextAttributeOnly() throws Exception {
+        String password = "secret";
+        addKeyStoreWithCredentialReference(KS_NAME, null, null, password, "InvalidType", false, false, true);
+    }
+
+    @Test
+    public void testCredentialReferenceRollbackOfNewlyAddedCredentialDuringRuntimeOperation() throws Exception {
+        String alias = "newAlias";
+        String password = "newPassword";
+        addKeyStore();
+        CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+        assertFalse(credentialStore.exists(alias, PasswordCredential.class));
+        assertEquals(1, credentialStore.getAliases().size());
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KS_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GENERATE_KEY_PAIR);
+            operation.get(Constants.ALIAS).set("bsmith");
+            operation.get(Constants.ALGORITHM).set("Invalid");
+            operation.get(Constants.DISTINGUISHED_NAME).set("CN=bob smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(STORE).set(NON_EMPTY_CS_NAME);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(ALIAS).set(alias);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CLEAR_TEXT).set(password);
+            ModelNode response = assertFailed(services.executeOperation(operation)).get(RESULT);
+            validateFailedResponse(response);
+
+            assertEquals(1, credentialStore.getAliases().size());
+            assertFalse(credentialStore.exists(alias, PasswordCredential.class));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testCredentialReferenceRollbackOfUpdatedExistingCredentialDuringRuntimeOperation() throws Exception {
+        String password = "newPassword";
+        addKeyStore();
+
+        CredentialStore credentialStore = getNonEmptyCredentialStore();
+
+        assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+        PasswordCredential passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+        ClearPassword clearPassword = passwordCredential.getPassword(ClearPassword.class);
+        assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword());
+        assertEquals(1, credentialStore.getAliases().size());
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KS_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GENERATE_KEY_PAIR);
+            operation.get(Constants.ALIAS).set("bsmith");
+            operation.get(Constants.ALGORITHM).set("Invalid");
+            operation.get(Constants.DISTINGUISHED_NAME).set("CN=bob smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(STORE).set(NON_EMPTY_CS_NAME);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(ALIAS).set(EXISTING_ALIAS);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CLEAR_TEXT).set(password);
+            ModelNode response = assertFailed(services.executeOperation(operation)).get(RESULT);
+            validateFailedResponse(response);
+
+            assertEquals(1, credentialStore.getAliases().size());
+            assertTrue(credentialStore.exists(EXISTING_ALIAS, PasswordCredential.class));
+            passwordCredential = credentialStore.retrieve(EXISTING_ALIAS, PasswordCredential.class);
+            clearPassword = passwordCredential.getPassword(ClearPassword.class);
+            assertArrayEquals(EXISTING_PASSWORD.toCharArray(), clearPassword.getPassword()); // password should remain unchanged
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testFailedRuntimeOperationWithClearTextAttributeOnly() throws Exception {
+        addKeyStore();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KS_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GENERATE_KEY_PAIR);
+            operation.get(Constants.ALIAS).set("bsmith");
+            operation.get(Constants.ALGORITHM).set("Invalid");
+            operation.get(Constants.DISTINGUISHED_NAME).set("CN=bob smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CLEAR_TEXT).set("secret");
+            assertFailed(services.executeOperation(operation)).get(RESULT);
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testAddOperationWithCredentialReferenceWithStoreOnly() throws Exception {
+        testAddKeyStoreWithInvalidCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, null, null);
+    }
+
+    @Test
+    public void testAddOperationWithCredentialReferenceWithAliasOnly() throws Exception {
+        testAddKeyStoreWithInvalidCredentialReference(KS_NAME, null, EXISTING_ALIAS, null);
+    }
+
+    @Test
+    public void testAddOperationWithCredentialReferenceWithClearTextOnly() throws Exception {
+        try {
+            String password = "secret";
+            addKeyStoreWithCredentialReference(KS_NAME, null, null, password, false, false);
+            assertEquals(password, readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertNull(readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testWriteAttributeWithCredentialReferenceWithStoreOnly() throws Exception {
+        try {
+            getNonEmptyCredentialStore();
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true);
+            testWriteCredentialReferenceAttribute("key-store", KS_NAME, NON_EMPTY_CS_NAME, null, null, true);
+
+            // no changes to credential-reference attribute
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+            assertEquals(NON_EMPTY_CS_NAME, readAttribute(KS_NAME, STORE_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testWriteAttributeWithCredentialReferenceWithAliasOnly() throws Exception {
+        try {
+            getNonEmptyCredentialStore();
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true);
+            testWriteCredentialReferenceAttribute("key-store", KS_NAME, null, NEW_ALIAS, null, true);
+
+            // no changes to credential-reference attribute
+            assertNull(readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertEquals(EXISTING_ALIAS, readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+            assertEquals(NON_EMPTY_CS_NAME, readAttribute(KS_NAME, STORE_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    @Test
+    public void testWriteAttributeWithCredentialReferenceWithClearTextOnly() throws Exception {
+        try {
+            String newPassword = "newPassword";
+            getNonEmptyCredentialStore();
+            addKeyStoreWithCredentialReference(KS_NAME, NON_EMPTY_CS_NAME, EXISTING_ALIAS, null, true);
+            testWriteCredentialReferenceAttribute("key-store", KS_NAME, null, null, newPassword, false);
+
+            // changes to credential-reference attribute
+            assertEquals(newPassword, readAttribute(KS_NAME, CLEAR_TEXT_ATTRIBUTE_NAME));
+            assertNull(readAttribute(KS_NAME, ALIAS_ATTRIBUTE_NAME));
+            assertNull(readAttribute(KS_NAME, STORE_ATTRIBUTE_NAME));
+        } finally {
+            removeKeyStore(KS_NAME);
+        }
+    }
+
+    private String addKeyStoreWithCredentialReference(String keyStoreName, String store, String alias, String secret, boolean exists) throws Exception {
+        return addKeyStoreWithCredentialReference(keyStoreName, store, alias, secret, "JKS", exists, true, false);
+    }
+
+    private String addKeyStoreWithCredentialReference(String keyStoreName, String store, String alias, String secret, boolean exists, boolean validateResponse) throws Exception {
+        return addKeyStoreWithCredentialReference(keyStoreName, store, alias, secret, "JKS", exists, validateResponse, false);
+    }
+
+    private String addKeyStoreWithCredentialReference(String keyStoreName, String store, String alias, String secret, String type, boolean exists, boolean validateResponse) throws Exception {
+        return addKeyStoreWithCredentialReference(keyStoreName, store, alias, secret, type, exists, validateResponse, false);
+    }
+
+    private String addKeyStoreWithCredentialReference(String keyStoreName, String store, String alias, String secret, String type, boolean exists, boolean validateResponse, boolean assertFailed) throws Exception {
+        Path resources = Paths.get(Objects.requireNonNull(KeyStoresTestCase.class.getResource(".")).toURI());
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/test.keystore");
+        operation.get(Constants.TYPE).set(type);
+        if (store != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(STORE).set(store);
+        }
+        boolean autoGeneratedAlias = false;
+        if (alias != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(ALIAS).set(alias);
+        } else {
+            autoGeneratedAlias = true;
+        }
+        if (secret != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CLEAR_TEXT).set(secret);
+        }
+        if (assertFailed) {
+            ModelNode response = assertFailed(services.executeOperation(operation)).get(RESULT);
+            if (validateResponse) {
+                return validateFailedResponse(response);
+            } else {
+                return null;
+            }
+        } else {
+            ModelNode response = assertSuccess(services.executeOperation(operation)).get(RESULT);
+            if (validateResponse) {
+                return validateResponse(response, secret, autoGeneratedAlias, exists);
+            } else {
+                return null;
+            }
+        }
+    }
+
+    private void testAddKeyStoreWithInvalidCredentialReference(String keyStoreName, String store, String alias, String secret) throws Exception {
+        Path resources = Paths.get(Objects.requireNonNull(KeyStoresTestCase.class.getResource(".")).toURI());
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/test.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        if (store != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(STORE).set(store);
+        }
+        if (alias != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(ALIAS).set(alias);
+        }
+        if (secret != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CLEAR_TEXT).set(secret);
+        }
+
+        ModelNode response = services.executeOperation(operation);
+        assertEquals(FAILED, response.get(OUTCOME).asString());
+        assertTrue(response.get(FAILURE_DESCRIPTION).asString().contains(CREDENTIAL_REFERENCE));
+    }
+
+    private void testWriteCredentialReferenceAttribute(String resource, String resourceName, String store, String alias, String secret, boolean assertFailed) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(resource, resourceName);
+        operation.get(ClientConstants.OP).set(ClientConstants.WRITE_ATTRIBUTE_OPERATION);
+        operation.get(ClientConstants.NAME).set(CREDENTIAL_REFERENCE);
+        ModelNode credentialReference = new ModelNode();
+        if (store != null) {
+            credentialReference.get(STORE).set(store);
+        }
+        if (alias != null) {
+            credentialReference.get(ALIAS).set(alias);
+        }
+        if (secret != null) {
+            credentialReference.get(CLEAR_TEXT).set(secret);
+        }
+        operation.get(ClientConstants.VALUE).set(credentialReference);
+        ModelNode response = services.executeOperation(operation);
+        if (assertFailed) {
+            assertEquals(FAILED, response.get(OUTCOME).asString());
+            assertTrue(response.get(FAILURE_DESCRIPTION).asString().contains(CREDENTIAL_REFERENCE));
+        } else {
+            assertSuccess(response);
+        }
+    }
+
+    private void writeClearTextAttribute(String resource, String resourceName, String secret) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(resource, resourceName);
+        operation.get(ClientConstants.OP).set(ClientConstants.WRITE_ATTRIBUTE_OPERATION);
+        operation.get(ClientConstants.NAME).set(CLEAR_TEXT_ATTRIBUTE_NAME);
+        operation.get(ClientConstants.VALUE).set(secret);
+        ModelNode response = assertSuccess(services.executeOperation(operation)).get(RESULT);
+        validateResponse(response, secret, false, true);
+    }
+
+    private String generateKeyPairWithCredentialStoreUpdate(String keyStoreName, String store, String alias, String secret, boolean exists) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(Constants.GENERATE_KEY_PAIR);
+        operation.get(Constants.ALIAS).set("bsmith");
+        operation.get(Constants.DISTINGUISHED_NAME).set("CN=bob smith");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(STORE).set(store);
+        boolean autoGeneratedAlias = false;
+        if (alias != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.ALIAS).set(alias);
+        } else {
+            autoGeneratedAlias = true;
+        }
+        if (secret != null) {
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(secret);
+        }
+        ModelNode response = assertSuccess(services.executeOperation(operation)).get(RESULT);
+        return validateResponse(response, secret, autoGeneratedAlias, exists);
+    }
+
+    private String validateResponse(ModelNode response, String secret, boolean autoGeneratedAlias, boolean exists) {
+        if (secret == null) {
+            assertFalse(response.isDefined());
+            return null;
+        }
+        ModelNode credentialStoreUpdate = response.get(CredentialReference.CREDENTIAL_STORE_UPDATE);
+        if (! exists) {
+            assertEquals(CredentialReference.NEW_ENTRY_ADDED, credentialStoreUpdate.get(CredentialReference.STATUS).asString());
+        } else {
+            assertEquals(CredentialReference.EXISTING_ENTRY_UPDATED, credentialStoreUpdate.get(CredentialReference.STATUS).asString());
+        }
+        if (autoGeneratedAlias) {
+            String generatedAlias = credentialStoreUpdate.get(CredentialReference.NEW_ALIAS).asString();
+            assertTrue(generatedAlias != null && ! generatedAlias.isEmpty());
+            return generatedAlias;
+        }
+        return null;
+    }
+
+    private String validateFailedResponse(ModelNode response) {
+        ModelNode credentialStoreUpdate = response.get(CredentialReference.CREDENTIAL_STORE_UPDATE);
+        assertEquals(CredentialReference.UPDATE_ROLLED_BACK, credentialStoreUpdate.get(CredentialReference.STATUS).asString());
+        return null;
+    }
+
+    private String readAttribute(String keyStoreName, String attributeName) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.READ_ATTRIBUTE_OPERATION);
+        operation.get(NAME).set(attributeName);
+        return assertSuccess(services.executeOperation(operation)).get(RESULT).asStringOrNull();
+    }
+
+    private void removeKeyStore(String keyStoreName) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private CredentialStore getNonEmptyCredentialStore() throws CredentialStoreException {
+        CredentialStore credentialStore = getCredentialStore(NON_EMPTY_CS_NAME);
+        credentialStore.store(EXISTING_ALIAS, new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR, EXISTING_PASSWORD.toCharArray())));
+        credentialStore.flush();
+        return credentialStore;
+    }
+
+    private CredentialStore getCredentialStore(String store) {
+        ServiceName serviceName = Capabilities.CREDENTIAL_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(store);
+        return (CredentialStore) services.getContainer().getService(serviceName).getValue();
+    }
+
+    private ModelNode assertSuccess(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(SUCCESS)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private ModelNode assertFailed(ModelNode response) {
+        if (! response.get(OUTCOME).asString().equals(FAILED)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private void addKeyStore() throws Exception {
+        addKeyStore("test.keystore", KS_NAME, "Elytron");
+    }
+
+    private void addKeyStore(String keyStoreFile, String keyStoreName, String keyStorePassword) throws Exception {
+        Path resources = Paths.get(Objects.requireNonNull(KeyStoresTestCase.class.getResource(".")).toURI());
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/test.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(keyStorePassword);
+        assertSuccess(services.executeOperation(operation));
+    }
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreUtility.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreUtility.java
new file mode 100644
index 0000000..547f811
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/CredentialStoreUtility.java
@@ -0,0 +1,188 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2016 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.crypto.SecretKey;
+
+import org.jboss.logging.Logger;
+import org.wildfly.common.Assert;
+import org.wildfly.security.auth.server.IdentityCredentials;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.credential.store.impl.KeyStoreCredentialStore;
+import org.wildfly.security.credential.store.impl.PropertiesCredentialStore;
+import org.wildfly.security.password.interfaces.ClearPassword;
+
+/**
+ * CredentialStoreUtility is a utility class that can handle dynamic CredentialStore creation, manipulation and deletion/removal of keystore file.
+ *
+ * @author <a href="mailto:pskopek@redhat.com">Peter Skopek</a>
+ *
+ */
+public class CredentialStoreUtility {
+
+    private static Logger LOGGER = Logger.getLogger(CredentialStoreUtility.class);
+
+    private final String credentialStoreFileName;
+    private final CredentialStore credentialStore;
+    static final String DEFAULT_PASSWORD = "super_secret";
+
+    /**
+     * Create Credential Store.
+     *
+     * @param credentialStoreFileName name of file to hold credentials
+     * @param storePassword master password (clear text) to open the credential store
+     * @param adminKeyPassword a password (clear text) for protecting admin key
+     * @param createStorageFirst flag whether to create storage first and then initialize Credential Store
+     */
+    public CredentialStoreUtility(String credentialStoreFileName, String storePassword, String adminKeyPassword, boolean createStorageFirst, boolean propertiesStore) {
+        this.credentialStoreFileName = Assert.checkNotNullParam("credentialStoreFileName", credentialStoreFileName);
+        if (!propertiesStore) {
+            Assert.checkNotNullParam("storePassword", storePassword);
+            Assert.checkNotNullParam("adminKeyPassword", adminKeyPassword);
+        }
+
+        try {
+            Map<String, String> attributes = new HashMap<>();
+            if (propertiesStore) {
+                credentialStore = CredentialStore.getInstance(PropertiesCredentialStore.NAME);
+                attributes.put("location", credentialStoreFileName);
+                attributes.put("create", "true");
+                credentialStore.initialize(attributes);
+            } else {
+                if (createStorageFirst) {
+                    createKeyStore("JCEKS", storePassword.toCharArray());
+                }
+                credentialStore = CredentialStore.getInstance(KeyStoreCredentialStore.KEY_STORE_CREDENTIAL_STORE);
+                attributes.put("location", credentialStoreFileName);
+                attributes.put("keyStoreType", "JCEKS");
+                attributes.put("modifiable", "true");
+                if (!createStorageFirst) {
+                    File storage = new File(credentialStoreFileName);
+                    if (storage.exists()) {
+                        storage.delete();
+                    }
+                }
+
+                credentialStore.initialize(attributes, new CredentialStore.CredentialSourceProtectionParameter(
+                        IdentityCredentials.NONE.withCredential(convertToPasswordCredential(storePassword.toCharArray()))));
+            }
+        } catch (Throwable t) {
+            LOGGER.error(t);
+            throw new RuntimeException(t);
+        }
+        LOGGER.debugf("Credential Store created [%s] with master password \"%s\"", credentialStoreFileName, storePassword);
+    }
+
+    /**
+     * Create Credential Store.
+     * Automatically crate underlying KeyStore.
+     *
+     * @param credentialStoreFileName name of file to hold credentials
+     * @param storePassword master password (clear text) to open the credential store
+     */
+    public CredentialStoreUtility(String credentialStoreFileName, String storePassword) {
+        this(credentialStoreFileName, storePassword, storePassword, true, false);
+    }
+
+    /**
+     * Create Credential Store with default password.
+     * Automatically create underlying KeyStore.
+     *
+     * @param credentialStoreFileName name of file to hold credentials
+     */
+    public CredentialStoreUtility(String credentialStoreFileName) {
+        this(credentialStoreFileName, DEFAULT_PASSWORD);
+    }
+
+    /**
+     * Create Credential Store with default password.
+     * Automatically create underlying KeyStore.
+     *
+     * @param credentialStoreFileName name of file to hold credentials
+     */
+    public CredentialStoreUtility(String credentialStoreFileName, boolean propertiesCredentialStore) {
+        this(credentialStoreFileName, DEFAULT_PASSWORD, DEFAULT_PASSWORD, true, propertiesCredentialStore);
+    }
+
+    /**
+     * Add new entry to credential store and perform all conversions.
+     * @param alias of the entry
+     * @param clearTextPassword password
+     */
+    public void addEntry(String alias, String clearTextPassword) {
+        try {
+            credentialStore.store(alias, new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR, clearTextPassword.toCharArray())));
+            credentialStore.flush();
+        } catch (Exception e) {
+            LOGGER.error(e);
+            throw new RuntimeException(e);
+        }
+    }
+
+    /**
+     * Add new entry to credential store and perform all conversions.
+     * @param alias of the entry
+     * @param secretKey password
+     */
+    public void addEntry(String alias, SecretKey secretKey) {
+        try {
+            credentialStore.store(alias, new SecretKeyCredential(secretKey));
+            credentialStore.flush();
+        } catch (Exception e) {
+            LOGGER.error(e);
+            throw new RuntimeException(e);
+        }
+    }
+
+    private void createKeyStore(String keyStoreType, char[] keyStorePwd) throws Exception {
+        KeyStore ks = KeyStore.getInstance(keyStoreType);
+        ks.load((InputStream)null, null);
+        ks.store(new FileOutputStream(new File(credentialStoreFileName)), keyStorePwd);
+    }
+
+    /**
+     * Delete associated files.
+     */
+    public void cleanUp() {
+        deleteIfExists(new File(credentialStoreFileName));
+    }
+
+    private static void deleteIfExists(File f) {
+        assert !f.exists() || f.delete();
+    }
+
+    /**
+     * Convert {@code char[]} password to {@code PasswordCredential}
+     * @param password to convert
+     * @return new {@code PasswordCredential}
+     */
+    public static PasswordCredential convertToPasswordCredential(char[] password) {
+        return new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR, password));
+    }
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystem1_0TestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystem1_0TestCase.java
new file mode 100644
index 0000000..a604525
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ElytronTlsSubsystem1_0TestCase.java
@@ -0,0 +1,49 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.io.IOException;
+
+import org.jboss.as.controller.RunningMode;
+import org.jboss.as.subsystem.test.AbstractSubsystemBaseTest;
+import org.jboss.as.subsystem.test.AdditionalInitialization;
+
+/**
+ *
+ * @author <a href="mailto:fjuma@redhat.com">Farah Juma</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class ElytronTlsSubsystem1_0TestCase extends AbstractSubsystemBaseTest {
+
+    public ElytronTlsSubsystem1_0TestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    @Override
+    protected String getSubsystemXml() throws IOException {
+        return readResource("elytron-tls-subsystem-1.0.xml");
+    }
+
+    @Override
+    protected AdditionalInitialization createAdditionalInitialization() {
+        // Our use of the expression=encryption resource requires kernel capability setup that TestEnvironment provides
+        return new TestEnvironment(RunningMode.ADMIN_ONLY);
+    }
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ExpressionResolutionTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ExpressionResolutionTestCase.java
new file mode 100644
index 0000000..79da400
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ExpressionResolutionTestCase.java
@@ -0,0 +1,390 @@
+/*
+ * Copyright 2021 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.wildfly.security.encryption.SecretKeyUtil.importSecretKey;
+
+import java.io.File;
+import java.io.IOException;
+import java.security.AccessController;
+import java.security.GeneralSecurityException;
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.Security;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import javax.crypto.SecretKey;
+
+import org.jboss.as.controller.RunningMode;
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.client.helpers.Operations;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.subsystem.test.AbstractSubsystemBaseTest;
+import org.jboss.as.subsystem.test.AdditionalInitialization;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.wildfly.security.credential.store.WildFlyElytronCredentialStoreProvider;
+import org.wildfly.security.encryption.CipherUtil;
+import org.wildfly.security.encryption.SecretKeyUtil;
+
+/**
+ * A test case to test expression resolution using the expression=encryption resource.
+ *
+ * @author <a href="mailto:darran.lofthouse@jboss.com">Darran Lofthouse</a>
+ */
+public class ExpressionResolutionTestCase extends AbstractSubsystemBaseTest {
+
+    private static final Provider PROVIDER = new WildFlyElytronCredentialStoreProvider();
+
+    private static final String CSONE_SECURE_KEY = "RUxZAUsXHVcDh99zAdxGEzTBK1h2qjW+sZg2+37w7ijhDEiJEw==";
+    private static final String CSTHREE_TEST_KEY = "RUxZAUv5+IwidHJCNNG/cEe2GmWvieV3Ecg7M4xZaJiSULKlBQ==";
+
+    private static final String CLEAR_TEXT = "Lorem ipsum dolor sit amet";
+
+
+    @BeforeClass
+    public static void initTests() throws Exception {
+        AccessController.doPrivileged(new PrivilegedAction<Integer>() {
+            public Integer run() {
+                return Security.insertProviderAt(PROVIDER, 1);
+            }
+        });
+    }
+
+    @AfterClass
+    public static void cleanUpTests() {
+        AccessController.doPrivileged(new PrivilegedAction<Void>() {
+            public Void run() {
+                Security.removeProvider(PROVIDER.getName());
+
+                return null;
+            }
+        });
+    }
+
+    public ExpressionResolutionTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    @Override
+    protected String getSubsystemXml() throws IOException {
+        return readResource("expression-encryption.xml");
+    }
+
+    @Test
+    public void testPreConfiguredHierarchy() throws Exception {
+        CredentialStoreUtility csOne = null;
+        CredentialStoreUtility csTwo = null;
+        CredentialStoreUtility csThree = null;
+        try {
+            csOne = createCredentialStoreOne();
+            csTwo = createCredentialStoreTwo();
+            csThree = createCredentialStoreThree();
+
+            KernelServices services = super.createKernelServicesBuilder(new TestEnvironment())
+                    .setSubsystemXmlResource("expression-encryption.xml").build();
+            if (!services.isSuccessfulBoot()) {
+                Assert.fail(services.getBootError().toString());
+            }
+
+            testExpectedAliases(services, "secret-key-credential-store", "CredentialStoreThree", "testkey", "key");
+            testExpectedAliases(services, "credential-store", "CredentialStoreTwo", "csone");
+            testExpectedAliases(services, "credential-store", "CredentialStoreOne", "ksone", "securekey");
+            // No aliases in the key stores but we want them to be up to be queried.
+            testExpectedAliases(services, "key-store", "KeyStoreOne");
+            testExpectedAliases(services, "key-store", "KeyStoreTwo");
+        } finally {
+            cleanUp(csOne);
+            cleanUp(csTwo);
+            cleanUp(csThree);
+        }
+    }
+
+    protected AdditionalInitialization createAdditionalInitialization() {
+        // Our use of the expression=encryption resource requires kernel capability setup that TestEnvironment provides
+        return new TestEnvironment(RunningMode.ADMIN_ONLY);
+    }
+
+    private static void cleanUp(CredentialStoreUtility csUtil) {
+        if (csUtil != null) {
+            csUtil.cleanUp();
+        }
+    }
+
+    private static CredentialStoreUtility createCredentialStoreOne() throws GeneralSecurityException {
+        CredentialStoreUtility csOne = new CredentialStoreUtility("target/credential-store-one.cs", "CSOnePassword");
+        csOne.addEntry("ksone", "KSOnePassword");
+        csOne.addEntry("securekey", SecretKeyUtil.importSecretKey(CSONE_SECURE_KEY));
+        return csOne;
+    }
+
+    private static CredentialStoreUtility createCredentialStoreTwo() throws GeneralSecurityException {
+        CredentialStoreUtility csTwo = new CredentialStoreUtility("target/credential-store-two.cs", "CSTwoPassword");
+        csTwo.addEntry("csone", "CSOnePassword");
+        return csTwo;
+    }
+
+    private static CredentialStoreUtility createCredentialStoreThree() throws GeneralSecurityException {
+        CredentialStoreUtility csTwo = new CredentialStoreUtility("target/credential-store-three.cs", true);
+        csTwo.addEntry("testkey", SecretKeyUtil.importSecretKey(CSTHREE_TEST_KEY));
+        return csTwo;
+    }
+
+    private void testExpectedAliases(KernelServices services, String resourceType, String resourceName,
+            String... expectedAliases) throws Exception {
+
+        ModelNode readAliases = new ModelNode();
+        readAliases.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(resourceType, resourceName);
+        readAliases.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+
+        ModelNode readAliasesResult = assertSuccess(services.executeOperation(readAliases));
+
+        ModelNode result = readAliasesResult.get(ClientConstants.RESULT);
+        if (expectedAliases.length > 0) {
+            Set<String> expectedSet = new HashSet<>(Arrays.asList(expectedAliases));
+
+            List<ModelNode> aliasList = result.asList();
+            for (ModelNode aliasNode : aliasList) {
+                String alias = aliasNode.asString();
+                if (!expectedSet.remove(alias)) {
+                    fail("Alias '" + alias + "' not expected.");
+                }
+            }
+
+            assertEquals("All expected aliases found", 0, expectedSet.size());
+        } else {
+            assertTrue("Undefined result expected.", !result.isDefined());
+        }
+    }
+
+    @Test
+    public void testExpressionEncryptionOperations() throws Exception {
+        KernelServices services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXml(emptySubsystemXml()).build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+
+        String testStorePath = "target/secret-key-store.cs";
+        File testStoreFile = new File(testStorePath);
+        if (testStoreFile.exists()) {
+            testStoreFile.delete();
+        }
+
+        // Start with an empty subsystem and define a secret key credential store with two keys
+        ModelNode add = new ModelNode();
+        add.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.SECRET_KEY_CREDENTIAL_STORE, "my-test-store");
+        add.get(ClientConstants.OP).set(ClientConstants.ADD);
+        add.get(Constants.PATH).set(testStorePath);
+        add.get(Constants.POPULATE).set(false);
+
+        assertSuccess(services.executeOperation(add));
+
+          // Generate one and export it.
+        ModelNode generate = new ModelNode();
+        generate.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.SECRET_KEY_CREDENTIAL_STORE, "my-test-store");
+        generate.get(ClientConstants.OP).set(Constants.GENERATE_SECRET_KEY);
+        generate.get(Constants.ALIAS).set("TestKeyOne");
+
+        assertSuccess(services.executeOperation(generate));
+
+        ModelNode export = new ModelNode();
+        export.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.SECRET_KEY_CREDENTIAL_STORE, "my-test-store");
+        export.get(ClientConstants.OP).set(Constants.EXPORT_SECRET_KEY);
+        export.get(Constants.ALIAS).set("TestKeyOne");
+
+        ModelNode exportResult = assertSuccess(services.executeOperation(export));
+
+        final String key = exportResult.get(ClientConstants.RESULT).get(Constants.KEY).asString();
+
+        SecretKey testKeyOne = importSecretKey(key);
+
+          // Generate one in test and import it.
+        SecretKey testKeyTwo = SecretKeyUtil.generateSecretKey(192);
+
+        ModelNode importOP = new ModelNode();
+        importOP.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.SECRET_KEY_CREDENTIAL_STORE, "my-test-store");
+        importOP.get(ClientConstants.OP).set(Constants.IMPORT_SECRET_KEY);
+        importOP.get(Constants.ALIAS).set("TestKeyTwo");
+        importOP.get(Constants.KEY).set(SecretKeyUtil.exportSecretKey(testKeyTwo));
+
+        assertSuccess(services.executeOperation(importOP));
+
+          // Test read-aliases
+        testExpectedAliases(services, Constants.SECRET_KEY_CREDENTIAL_STORE, "my-test-store", "testkeyone", "testkeytwo");
+
+        // Define an expression=encryption resource with three resolvers (one for each key and one for a missing key)
+        add = new ModelNode();
+        add.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.EXPRESSION, Constants.ENCRYPTION);
+        add.get(ClientConstants.OP).set(ClientConstants.ADD);
+
+        ModelNode resolvers = new ModelNode();
+        resolvers.add(resolver("ResolverOne", "my-test-store", "testkeyone"));
+        resolvers.add(resolver("ResolverTwo", "my-test-store", "testkeytwo"));
+        resolvers.add(resolver("ResolverThree", "my-test-store", "testkeythree"));
+        add.get(Constants.RESOLVERS).set(resolvers);
+
+        add.get(Constants.DEFAULT_RESOLVER).set("ResolverTwo");
+
+        assertSuccess(services.executeOperation(add));
+
+        // Test generation fails for the resolver with the invalid key.
+        // Do this first to check it doesn't break anything.
+        testCreateExpression(services, null, "ResolverThree");
+        // Test generation using both resolvers by specifying name.
+        testCreateExpression(services, testKeyOne, "ResolverOne");
+        testCreateExpression(services, testKeyTwo, "ResolverTwo");
+        // Test generation using the default resolver.
+        testCreateExpression(services, testKeyTwo, null);
+
+        // It would also be a bug if anything that handled this file during the test run had not closed it.
+        testStoreFile.delete();
+    }
+
+    private static void testCreateExpression(KernelServices services, SecretKey secretKey, String resolver) throws Exception {
+        ModelNode createExpression = new ModelNode();
+        createExpression.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.EXPRESSION, Constants.ENCRYPTION);
+        createExpression.get(ClientConstants.OP).set(Constants.CREATE_EXPRESSION);
+        if (resolver != null) {
+            createExpression.get(Constants.RESOLVER).set(resolver);
+        }
+        createExpression.get(Constants.CLEAR_TEXT).set(CLEAR_TEXT);
+
+        ModelNode result = services.executeOperation(createExpression);
+
+        if (secretKey != null) {
+            assertSuccess(result);
+            String expression = result.get(ClientConstants.RESULT).get(Constants.EXPRESSION).asString();
+
+            String expectedPrefix = resolver != null ? "${ENC::" + resolver + ":" : "${ENC::";
+            assertTrue("Expected Prefix", expression.startsWith(expectedPrefix));
+
+            String extracted = expression.substring(expectedPrefix.length(), expression.length() - 1);
+
+            String decrypted = CipherUtil.decrypt(extracted, secretKey);
+            assertEquals("Successful descryption", CLEAR_TEXT, decrypted);
+        } else {
+            assertTrue("Failure expected", result.get(OUTCOME).asString().equals(ClientConstants.FAILED));
+            assertTrue("Expected Error Code", result.get(ClientConstants.FAILURE_DESCRIPTION).asString().contains("ELYTLS00205:"));
+        }
+    }
+
+    private static ModelNode resolver(final String name, final String credentialStore, final String secretKey) {
+        ModelNode resolver = new ModelNode();
+        resolver.get(Constants.NAME).set(name);
+        resolver.get(Constants.CREDENTIAL_STORE).set(credentialStore);
+        resolver.get(Constants.SECRET_KEY).set(secretKey);
+        return resolver;
+    }
+    private static ModelNode assertSuccess(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(SUCCESS)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private static String emptySubsystemXml() {
+        StringBuffer sb = new StringBuffer("<subsystem xmlns=\"");
+        sb.append(ElytronTlsExtension.CURRENT_NAMESPACE);
+        sb.append("\"></subsystem>");
+
+        return sb.toString();
+    }
+
+    @Test
+    public void testExpressionEncryptionCycle() throws Exception {
+        SecretKey keyOne = SecretKeyUtil.generateSecretKey(128);
+        SecretKey keyTwo = SecretKeyUtil.generateSecretKey(192);
+        SecretKey keyThree = SecretKeyUtil.generateSecretKey(256);
+
+        // Uses key from two
+        String passwordForone = "${ENC::ResolverTwo:" + CipherUtil.encrypt(CredentialStoreUtility.DEFAULT_PASSWORD, keyTwo) + "}";
+        // Uses key from three
+        String passwordForTwo = "${ENC::ResolverThree:" + CipherUtil.encrypt(CredentialStoreUtility.DEFAULT_PASSWORD, keyThree) + "}";
+        // Uses key from one
+        String passwordForThree = "${ENC::ResolverOne:" + CipherUtil.encrypt(CredentialStoreUtility.DEFAULT_PASSWORD, keyOne) + "}";
+
+        // Define the credential store resources in a single composite operation, a cycle should be detected which
+        // prevents them from coming up.
+        ModelNode composite = Operations.createCompositeOperation();
+        ModelNode steps = composite.get(ClientConstants.STEPS);
+
+        // Create 3 Credential Stores, each with a secret key. (Offline)
+        CredentialStoreUtility csUtilOne = createCredentialStoreUtility("target/cycle-store-one.cs", steps, "store-one", passwordForone);
+        csUtilOne.addEntry("key", keyOne);
+        CredentialStoreUtility csUtilTwo = createCredentialStoreUtility("target/cycle-store-two.cs", steps, "store-two", passwordForTwo);
+        csUtilTwo.addEntry("key", keyTwo);
+        CredentialStoreUtility csUtilThree = createCredentialStoreUtility("target/cycle-store-three.cs", steps, "store-three", passwordForThree);
+        csUtilThree.addEntry("key", keyThree);
+
+        // Create an expression=encryption with 3 resolvers, one for each key.
+        ModelNode addEE = new ModelNode();
+        addEE.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.EXPRESSION, Constants.ENCRYPTION);
+        addEE.get(ClientConstants.OP).set(ClientConstants.ADD);
+
+        ModelNode resolvers = new ModelNode();
+        resolvers.add(resolver("ResolverOne", "store-one", "key"));
+        resolvers.add(resolver("ResolverTwo", "store-two", "key"));
+        resolvers.add(resolver("ResolverThree", "store-three", "key"));
+        addEE.get(Constants.RESOLVERS).set(resolvers);
+        steps.add(addEE);
+
+        KernelServices services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXml(emptySubsystemXml()).build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+
+        ModelNode result = services.executeOperation(composite);
+        assertTrue("Failure expected", result.get(OUTCOME).asString().equals(ClientConstants.FAILED));
+        assertTrue("Expected Error Code (Cycle Detected)",
+                result.get(ClientConstants.FAILURE_DESCRIPTION).asString().contains("ELYTLS00061:"));
+
+        csUtilOne.cleanUp();
+        csUtilTwo.cleanUp();
+        csUtilThree.cleanUp();
+    }
+
+    private CredentialStoreUtility createCredentialStoreUtility(final String path, final ModelNode steps, final String storeName,
+            final String clearPassword) {
+        File storeFile = new File(path);
+        if (storeFile.exists()) {
+            storeFile.delete();
+        }
+
+        ModelNode add = new ModelNode();
+        add.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.CREDENTIAL_STORE, storeName);
+        add.get(ClientConstants.OP).set(ClientConstants.ADD);
+        add.get(Constants.PATH).set(path);
+        add.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(clearPassword);
+
+        steps.add(add);
+
+        return new CredentialStoreUtility(path);
+    }
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/JdkUtils.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/JdkUtils.java
new file mode 100644
index 0000000..61184f1
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/JdkUtils.java
@@ -0,0 +1,36 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2019 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+/**
+ * @author <a href="mailto:ropalka@redhat.com">Richard Opalka</a>
+ */
+final class JdkUtils {
+
+    private static final String javaSpecVersion = System.getProperty("java.specification.version");
+    private static final String javaVendor = System.getProperty("java.vendor");
+
+    static int getJavaSpecVersion() {
+        return Integer.parseInt(javaSpecVersion);
+    }
+
+    static boolean isIbmJdk() {
+        return javaVendor.startsWith("IBM");
+    }
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/KeyStoresTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/KeyStoresTestCase.java
new file mode 100644
index 0000000..097df75
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/KeyStoresTestCase.java
@@ -0,0 +1,2254 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILED;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILURE_DESCRIPTION;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.security.AccessController;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.PublicKey;
+import java.security.Security;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAKey;
+import java.security.interfaces.RSAPublicKey;
+import java.time.ZoneId;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Date;
+import java.util.Iterator;
+import java.util.List;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.subsystem.test.AbstractSubsystemTest;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceName;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.mockserver.integration.ClientAndServer;
+import org.wildfly.security.WildFlyElytronProvider;
+import org.wildfly.security.x500.GeneralName;
+import org.wildfly.security.x500.X500;
+import org.wildfly.security.x500.cert.BasicConstraintsExtension;
+import org.wildfly.security.x500.cert.KeyUsage;
+import org.wildfly.security.x500.cert.SelfSignedX509CertificateAndSigningKey;
+import org.wildfly.security.x500.cert.X509CertificateBuilder;
+
+/**
+ * @author <a href="mailto:jkalina@redhat.com">Jan Kalina</a>
+ */
+public class KeyStoresTestCase extends AbstractSubsystemTest {
+
+    private static final Provider wildFlyElytronProvider = new WildFlyElytronProvider();
+    private static CredentialStoreUtility csUtil = null;
+    private static final String CS_PASSWORD = "super_secret";
+    private static final String KEYSTORE_NAME = "ModifiedKeystore";
+    private static final String KEY_PASSWORD = "secret";
+    private static final String CERTIFICATE_AUTHORITY_ACCOUNT_NAME = "CertAuthorityAccount";
+    private static final String CERTIFICATE_AUTHORITY_NAME = "CertAuthority";
+    private static final String ACCOUNTS_KEYSTORE = "account.keystore";
+    private static final String ACCOUNTS_KEYSTORE_NAME = "AccountsKeyStore";
+    private static final String ACCOUNTS_KEYSTORE_PASSWORD = "elytron";
+    private static final String SIMULATED_LETS_ENCRYPT_ENDPOINT = "http://localhost:4001/directory"; // simulated Let's Encrypt server instance
+    private static String oldHomeDir;
+    private static ClientAndServer server; // used to simulate a Let's Encrypt server instance
+    private static final String WORKING_DIRECTORY_LOCATION = "./target/test-classes/org/wildfly/extension/elytron/tls";
+    private static final char[] KEYSTORE_PASSWORD = "Elytron".toCharArray();
+    private static final X500Principal ROOT_DN = new X500Principal("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA");
+    private static final X500Principal ANOTHER_ROOT_DN = new X500Principal("O=Another Root Certificate Authority, EMAILADDRESS=anotherca@wildfly.org, C=UK, ST=Elytron, CN=Another Elytron CA");
+    private static final X500Principal SALLY_DN = new X500Principal("CN=sally smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+    private static final X500Principal SSMITH_DN = new X500Principal("CN=ssmith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+    private static final X500Principal FIREFLY_DN = new X500Principal("OU=Elytron, O=Elytron, C=UK, ST=Elytron, CN=Firefly");
+    private static final X500Principal INTERMEDIATE_DN = new X500Principal("O=Intermediate Certificate Authority, EMAILADDRESS=intermediateca@wildfly.org, C=UK, ST=Elytron, CN=Intermediate Elytron CA");
+    private static final File FIREFLY_FILE = new File(WORKING_DIRECTORY_LOCATION, "firefly.keystore");
+    private static final File FIREFLY_COPY_FILE = new File(WORKING_DIRECTORY_LOCATION, "firefly-copy.keystore");
+    private static final File TEST_FILE = new File(WORKING_DIRECTORY_LOCATION, "test.keystore");
+    private static final File TEST_SINGLE_CERT_REPLY_FILE = new File(WORKING_DIRECTORY_LOCATION, "test-single-cert-reply.cert");
+    private static final File TEST_CERT_CHAIN_REPLY_FILE = new File(WORKING_DIRECTORY_LOCATION, "test-cert-chain-reply.cert");
+    private static final File TEST_EXPORTED_FILE = new File(WORKING_DIRECTORY_LOCATION, "test-exported.cert");
+    private static final File TEST_TRUSTED_FILE = new File(WORKING_DIRECTORY_LOCATION, "test-trusted.cert");
+    private static final File TEST_UNTRUSTED_FILE = new File(WORKING_DIRECTORY_LOCATION, "test-untrusted.cert");
+    private static final File TEST_UNTRUSTED_CERT_CHAIN_REPLY_FILE = new File(WORKING_DIRECTORY_LOCATION, "test-untrusted-cert-chain-reply.cert");
+
+    private static void createServerEnvironment() {
+        File home = new File("target/wildfly");
+        home.mkdir();
+        File challengeDir = new File(home, ".well-known/acme-challenge");
+        challengeDir.mkdirs();
+        oldHomeDir = System.setProperty("jboss.home.dir", home.getAbsolutePath());
+    }
+
+    public KeyStoresTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    private KernelServices services = null;
+
+    private ModelNode assertSuccess(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(SUCCESS)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private ModelNode assertFailed(ModelNode response) {
+        if (! response.get(OUTCOME).asString().equals(FAILED)) {
+            Assert.fail(response.toJSONString(false));
+        }
+        return response;
+    }
+
+    private static KeyStore loadKeyStore() throws Exception {
+        KeyStore ks = KeyStore.getInstance("JKS");
+        ks.load(null, null);
+        return ks;
+    }
+
+    private static void createTemporaryKeyStoreFile(KeyStore keyStore, File outputFile) throws Exception {
+        try (FileOutputStream fos = new FileOutputStream(outputFile)){
+            keyStore.store(fos, KEYSTORE_PASSWORD);
+        }
+    }
+
+    private static void createTemporaryCertFile(X509Certificate certificate, File outputFile) throws Exception {
+        try (FileOutputStream fos = new FileOutputStream(outputFile, true)){
+            fos.write(certificate.getEncoded());
+        }
+    }
+
+    private static KeyStore createFireflyKeyStore() throws Exception {
+        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+        KeyPair fireflyKeys = keyPairGenerator.generateKeyPair();
+        PrivateKey fireflySigningKey = fireflyKeys.getPrivate();
+        PublicKey fireflyPublicKey = fireflyKeys.getPublic();
+
+        KeyStore fireflyKeyStore = loadKeyStore();
+
+        SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey = SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(ROOT_DN)
+                .setKeyAlgorithmName("RSA")
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .addExtension(false, "BasicConstraints", "CA:true,pathlen:2147483647")
+                .build();
+        X509Certificate issuerCertificate = issuerSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        fireflyKeyStore.setCertificateEntry("ca", issuerCertificate);
+
+        X509Certificate fireflyCertificate = new X509CertificateBuilder()
+                .setIssuerDn(ROOT_DN)
+                .setSubjectDn(FIREFLY_DN)
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .setSigningKey(issuerSelfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(fireflyPublicKey)
+                .setSerialNumber(new BigInteger("1"))
+                .addExtension(new BasicConstraintsExtension(false, false, -1))
+                .build();
+        fireflyKeyStore.setKeyEntry("firefly", fireflySigningKey, KEY_PASSWORD.toCharArray(), new X509Certificate[]{fireflyCertificate,issuerCertificate});
+
+        return fireflyKeyStore;
+    }
+
+    private static SelfSignedX509CertificateAndSigningKey createCertRoot(X500Principal DN) {
+        return SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(DN)
+                .setKeyAlgorithmName("DSA")
+                .setSignatureAlgorithmName("SHA1withDSA")
+                .setKeySize(1024)
+                .addExtension(false, "BasicConstraints", "CA:true,pathlen:2147483647")
+                .build();
+    }
+
+    private static SelfSignedX509CertificateAndSigningKey createSallyCertificate() {
+        return SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(SALLY_DN)
+                .setKeyAlgorithmName("RSA")
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .setKeySize(1024)
+                .addExtension(false, "ExtendedKeyUsage", "clientAuth")
+                .addExtension(true, "KeyUsage", "digitalSignature")
+                .addExtension(false, "SubjectAlternativeName", "email:sallysmith@example.com,DNS:sallysmith.example.com")
+                .build();
+    }
+
+    private static X509Certificate createSSmithCertificate(SelfSignedX509CertificateAndSigningKey rootSelfSignedX509CertificateAndSigningKey, PublicKey publicKey) throws Exception {
+        return new X509CertificateBuilder()
+                .setIssuerDn(ROOT_DN)
+                .setSubjectDn(SSMITH_DN)
+                .setSignatureAlgorithmName("SHA1withDSA")
+                .setSigningKey(rootSelfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(publicKey)
+                .build();
+    }
+
+    private static KeyStore createTestKeyStore(SelfSignedX509CertificateAndSigningKey rootSelfSignedX509CertificateAndSigningKey, SelfSignedX509CertificateAndSigningKey sallySelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyStore testKeyStore = loadKeyStore();
+
+        X509Certificate sallyCertificate = sallySelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        testKeyStore.setKeyEntry("ssmith", sallySelfSignedX509CertificateAndSigningKey.getSigningKey(), KEY_PASSWORD.toCharArray(), new X509Certificate[]{sallyCertificate});
+
+        X509Certificate rootCertificate = rootSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        testKeyStore.setKeyEntry("ca", rootSelfSignedX509CertificateAndSigningKey.getSigningKey(), KEY_PASSWORD.toCharArray(), new X509Certificate[]{rootCertificate});
+
+        return testKeyStore;
+    }
+
+    private static X509Certificate createTestTrustedCertificate(SelfSignedX509CertificateAndSigningKey rootSelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+        KeyPair keys = keyPairGenerator.generateKeyPair();
+        PublicKey publicKey = keys.getPublic();
+
+        return new X509CertificateBuilder()
+                .setIssuerDn(ROOT_DN)
+                .setSubjectDn(INTERMEDIATE_DN)
+                .setSignatureAlgorithmName("SHA1withDSA")
+                .setSigningKey(rootSelfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(publicKey)
+                .build();
+    }
+
+    private static X509Certificate createTestUntrustedCertChainReplyCertificate(SelfSignedX509CertificateAndSigningKey selfSignedX509CertificateAndSigningKey, PublicKey publicKey) throws Exception {
+        return new X509CertificateBuilder()
+                .setIssuerDn(ANOTHER_ROOT_DN)
+                .setSubjectDn(SSMITH_DN)
+                .setSignatureAlgorithmName("SHA1withDSA")
+                .setSigningKey(selfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(publicKey)
+                .build();
+    }
+
+    private static void setUpFiles() throws Exception {
+        File workingDir = new File(WORKING_DIRECTORY_LOCATION);
+        if (!workingDir.exists()) {
+            workingDir.mkdirs();
+        }
+
+        SelfSignedX509CertificateAndSigningKey rootSelfSignedX509CertificateAndSigningKey = createCertRoot(ROOT_DN);
+        SelfSignedX509CertificateAndSigningKey anotherRootSelfSignedX509CertificateAndSigningKey = createCertRoot(ANOTHER_ROOT_DN);
+        SelfSignedX509CertificateAndSigningKey sallySelfSignedX509CertificateAndSigningKey = createSallyCertificate();
+
+        PublicKey publicKey = sallySelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate().getPublicKey();
+
+        // Key Stores
+        KeyStore fireflyKeyStore = createFireflyKeyStore();
+        KeyStore testKeyStore = createTestKeyStore(rootSelfSignedX509CertificateAndSigningKey, sallySelfSignedX509CertificateAndSigningKey);
+
+        createTemporaryKeyStoreFile(fireflyKeyStore, FIREFLY_FILE);
+        createTemporaryKeyStoreFile(testKeyStore, TEST_FILE);
+
+        // Cert Files
+        X509Certificate sSmithCertificate = createSSmithCertificate(rootSelfSignedX509CertificateAndSigningKey, publicKey);
+
+        X509Certificate testTrustedCert = createTestTrustedCertificate(rootSelfSignedX509CertificateAndSigningKey);
+        X509Certificate testUntrustedCert = anotherRootSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        X509Certificate testUntrustedCertChainReplyCert = createTestUntrustedCertChainReplyCertificate(anotherRootSelfSignedX509CertificateAndSigningKey, publicKey);
+
+        createTemporaryCertFile(sSmithCertificate, TEST_SINGLE_CERT_REPLY_FILE);
+
+        createTemporaryCertFile(rootSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate(), TEST_CERT_CHAIN_REPLY_FILE);
+        createTemporaryCertFile(sSmithCertificate, TEST_CERT_CHAIN_REPLY_FILE);
+
+        createTemporaryCertFile(sallySelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate(), TEST_EXPORTED_FILE);
+        createTemporaryCertFile(testTrustedCert, TEST_TRUSTED_FILE);
+        createTemporaryCertFile(testUntrustedCert, TEST_UNTRUSTED_FILE);
+
+        createTemporaryCertFile(testUntrustedCertChainReplyCert, TEST_UNTRUSTED_CERT_CHAIN_REPLY_FILE);
+        createTemporaryCertFile(anotherRootSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate(), TEST_UNTRUSTED_CERT_CHAIN_REPLY_FILE);
+    }
+
+    private static void removeTestFiles() {
+        File[] testFiles = {
+                FIREFLY_FILE,
+                FIREFLY_COPY_FILE,
+                TEST_FILE,
+                TEST_SINGLE_CERT_REPLY_FILE,
+                TEST_CERT_CHAIN_REPLY_FILE,
+                TEST_EXPORTED_FILE,
+                TEST_TRUSTED_FILE,
+                TEST_UNTRUSTED_FILE,
+                TEST_UNTRUSTED_CERT_CHAIN_REPLY_FILE
+        };
+        for (File file : testFiles) {
+            if (file.exists()) {
+                file.delete();
+            }
+        }
+    }
+
+    @BeforeClass
+    public static void initTests() throws Exception {
+        server = new ClientAndServer(4001);
+        setUpFiles();
+        AccessController.doPrivileged((PrivilegedAction<Integer>) () -> Security.insertProviderAt(wildFlyElytronProvider, 1));
+        csUtil = new CredentialStoreUtility("target/tlstest.keystore", CS_PASSWORD);
+        csUtil.addEntry("the-key-alias", "Elytron");
+        csUtil.addEntry("master-password-alias", "Elytron");
+        createServerEnvironment();
+    }
+
+    @AfterClass
+    public static void cleanUpTests() {
+        if (server != null) {
+            server.stop();
+        }
+        removeTestFiles();
+        csUtil.cleanUp();
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+            Security.removeProvider(wildFlyElytronProvider.getName());
+
+            return null;
+        });
+        if (oldHomeDir == null) {
+            System.clearProperty("jboss.home.dir");
+        } else {
+            System.setProperty("jboss.home.dir", oldHomeDir);
+        }
+    }
+
+    @Before
+    public void init() throws Exception {
+        String subsystemXml;
+        if (JdkUtils.isIbmJdk()) {
+            subsystemXml = "tls-ibm.xml";
+        } else {
+            subsystemXml = JdkUtils.getJavaSpecVersion() <= 12 ? "tls-sun.xml" : "tls-oracle13plus.xml";
+        }
+        services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXmlResource(subsystemXml).build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+    }
+
+    @Test
+    public void testKeystoreService() throws Exception {
+        ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName("FireflyKeystore");
+        KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+        assertNotNull(keyStore);
+
+        assertTrue(keyStore.containsAlias("firefly"));
+        assertTrue(keyStore.isKeyEntry("firefly"));
+        X509Certificate cert = (X509Certificate) keyStore.getCertificate("firefly");
+        assertEquals("OU=Elytron, O=Elytron, C=UK, ST=Elytron, CN=Firefly", cert.getSubjectDN().getName());
+        assertEquals("firefly", keyStore.getCertificateAlias(cert));
+
+        Certificate[] chain = keyStore.getCertificateChain("firefly");
+        assertEquals("OU=Elytron, O=Elytron, C=UK, ST=Elytron, CN=Firefly", ((X509Certificate) chain[0]).getSubjectDN().getName());
+        assertEquals("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA", ((X509Certificate) chain[1]).getSubjectDN().getName());
+
+        assertTrue(keyStore.containsAlias("ca"));
+        assertTrue(keyStore.isCertificateEntry("ca"));
+        X509Certificate certCa = (X509Certificate) keyStore.getCertificate("ca");
+        assertEquals("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA", certCa.getSubjectDN().getName());
+        assertEquals("ca", keyStore.getCertificateAlias(certCa));
+    }
+
+    @Test
+    public void testKeystoreCli() throws Exception {
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        Files.copy(resources.resolve("firefly.keystore"), resources.resolve("firefly-copy.keystore"), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+
+        ModelNode operation = new ModelNode(); // add keystore
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", "ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/firefly-copy.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set("Elytron");
+        assertSuccess(services.executeOperation(operation));
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        List<ModelNode> nodes = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+        assertEquals(2, nodes.size());
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.REMOVE_ALIAS);
+        operation.get(Constants.ALIAS).set("ca");
+        assertSuccess(services.executeOperation(operation));
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        nodes = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+        assertEquals(1, nodes.size());
+
+        operation = new ModelNode(); // remove keystore
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    @Test
+    public void testKeystoreReadVerbose() throws Exception {
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        Files.copy(resources.resolve("firefly.keystore"), resources.resolve("firefly-copy.keystore"), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+
+        ModelNode operation = new ModelNode(); // add keystore
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", "ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/firefly-copy.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set("Elytron");
+        assertSuccess(services.executeOperation(operation));
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        List<ModelNode> nodes = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+        assertEquals(2, nodes.size());
+        //["ca", "firefly"]
+        assertEquals("ca",nodes.get(0).asString());
+        assertEquals("firefly",nodes.get(1).asString());
+
+        validateRecursiveReadAliases(true);
+        validateRecursiveReadAliases(false);
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIAS);
+        operation.get(Constants.ALIAS).set("firefly");
+        operation.get(Constants.VERBOSE).set(false);
+        checkCertificate(services.executeOperation(operation).get(ClientConstants.RESULT), false);
+    }
+
+    private void validateRecursiveReadAliases(final boolean verbose) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        operation.get(Constants.VERBOSE).set(verbose);
+        operation.get(Constants.RECURSIVE).set(true);
+        List<ModelNode> nodes = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+        assertEquals(2, nodes.size());
+        //[("ca" => {}),("firefly" => {})]
+
+        for(ModelNode node : nodes) {
+            node = node.get(0);
+            final String alias = node.get(Constants.ALIAS).asString();
+            final ModelNode certificateChain = node.get(Constants.CERTIFICATE_CHAIN);
+            if(certificateChain.isDefined()) {
+                for(ModelNode certificateFromChain : certificateChain.asList())
+                    checkCertificate(certificateFromChain, verbose);
+            } else {
+                //need to clean after above .get
+                node.remove(Constants.CERTIFICATE_CHAIN);
+                checkCertificate(node.get(Constants.CERTIFICATE), verbose);
+            }
+
+            final ModelNode readOperation = new ModelNode();
+            readOperation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store","ModifiedKeyStore");
+            readOperation.get(ClientConstants.OP).set(Constants.READ_ALIAS);
+            readOperation.get(Constants.VERBOSE).set(verbose);
+            readOperation.get(Constants.ALIAS).set(alias);
+            final ModelNode aliasReadNode = assertSuccess(services.executeOperation(readOperation)).get(ClientConstants.RESULT);
+            assertEquals(aliasReadNode, node);
+        }
+    }
+
+    private void checkCertificate(final ModelNode certificate, final boolean verbose) {
+        final ModelNode publicKey = certificate.get(Constants.PUBLIC_KEY);
+        if(verbose) {
+            assertNotNull(publicKey);
+            assertTrue(publicKey.isDefined());
+        } else {
+            assertNotNull(publicKey);
+            assertTrue(!publicKey.isDefined());
+            //Cleanup
+            certificate.remove(Constants.PUBLIC_KEY);
+        }
+        final ModelNode encoded = certificate.get(Constants.ENCODED);
+        if(verbose) {
+            assertNotNull(encoded);
+            assertTrue(encoded.isDefined());
+        } else {
+            assertNotNull(encoded);
+            assertTrue(!encoded.isDefined());
+            //Cleanup
+            certificate.remove(Constants.ENCODED);
+        }
+    }
+
+    @Ignore("Filtering keystores not implemented yet")
+    @Test
+    public void testFilteringKeystoreService() throws Exception {
+        ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName("FilteringKeyStore");
+        KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+        assertNotNull(keyStore);
+
+        assertTrue(keyStore.containsAlias("firefly"));
+        assertTrue(keyStore.isKeyEntry("firefly"));
+        assertEquals(2, keyStore.getCertificateChain("firefly").length); // has CA in chain
+        Certificate cert = keyStore.getCertificate("firefly");
+        assertNotNull(cert);
+        assertEquals("firefly", keyStore.getCertificateAlias(cert));
+
+        assertFalse(keyStore.containsAlias("ca"));
+        assertFalse(keyStore.isCertificateEntry("ca"));
+    }
+
+    @Ignore("Filtering keystores not implemented yet")
+    @Test
+    public void testFilteringKeystoreCli() throws Exception {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron").add(Constants.FILTERING_KEY_STORE,"FilteringKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        List<ModelNode> nodes = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+        assertEquals(1, nodes.size());
+        assertEquals("firefly", nodes.get(0).asString());
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron").add(Constants.FILTERING_KEY_STORE,"FilteringKeyStore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIAS);
+        operation.get(Constants.ALIAS).set("firefly");
+        ModelNode firefly = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+        assertEquals("firefly", firefly.get(Constants.ALIAS).asString());
+        assertEquals(KeyStore.PrivateKeyEntry.class.getSimpleName(), firefly.get(Constants.ENTRY_TYPE).asString());
+        assertTrue(firefly.get(Constants.CERTIFICATE_CHAIN).isDefined());
+    }
+
+    @Test
+    public void testAutomaticKeystoreService() throws Exception {
+        ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName("AutomaticKeystore");
+        KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+        assertNotNull(keyStore);
+
+        assertTrue(keyStore.containsAlias("firefly"));
+        assertTrue(keyStore.isKeyEntry("firefly"));
+        X509Certificate cert = (X509Certificate) keyStore.getCertificate("firefly");
+        assertEquals("OU=Elytron, O=Elytron, C=UK, ST=Elytron, CN=Firefly", cert.getSubjectDN().getName());
+        assertEquals("firefly", keyStore.getCertificateAlias(cert));
+
+        Certificate[] chain = keyStore.getCertificateChain("firefly");
+        assertEquals("OU=Elytron, O=Elytron, C=UK, ST=Elytron, CN=Firefly", ((X509Certificate) chain[0]).getSubjectDN().getName());
+        assertEquals("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA", ((X509Certificate) chain[1]).getSubjectDN().getName());
+
+        assertTrue(keyStore.containsAlias("ca"));
+        assertTrue(keyStore.isCertificateEntry("ca"));
+        X509Certificate certCa = (X509Certificate) keyStore.getCertificate("ca");
+        assertEquals("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA", certCa.getSubjectDN().getName());
+        assertEquals("ca", keyStore.getCertificateAlias(certCa));
+    }
+
+    @Test
+    public void testAutomaticKeystoreCli() throws Exception {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls");
+        operation.get(ClientConstants.OP).set("read-resource");
+        System.out.println(services.executeOperation(operation).get(ClientConstants.RESULT).asString());
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add(Constants.KEY_STORE,"AutomaticKeystore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        List<ModelNode> nodes = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+        assertEquals(2, nodes.size());
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add(Constants.KEY_STORE,"AutomaticKeystore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIAS);
+        operation.get(Constants.ALIAS).set("firefly");
+        ModelNode firefly = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+        assertEquals("firefly", firefly.get(Constants.ALIAS).asString());
+        assertEquals(KeyStore.PrivateKeyEntry.class.getSimpleName(), firefly.get(Constants.ENTRY_TYPE).asString());
+        assertTrue(firefly.get(Constants.CERTIFICATE_CHAIN).isDefined());
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add(Constants.KEY_STORE,"AutomaticKeystore");
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIAS);
+        operation.get(Constants.ALIAS).set("ca");
+        ModelNode ca = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+        assertEquals("ca", ca.get(Constants.ALIAS).asString());
+        assertEquals(KeyStore.TrustedCertificateEntry.class.getSimpleName(), ca.get(Constants.ENTRY_TYPE).asString());
+    }
+
+    @Test
+    public void testGenerateKeyPair() throws Exception {
+        addKeyStore();
+
+        try {
+            int numAliasesBefore = readAliases().size();
+
+            // This value will be compared with a Date representation with precision of seconds only so
+            // drop any nanoseconds.
+            ZonedDateTime startTime = ZonedDateTime.now().withNano(0);
+
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GENERATE_KEY_PAIR);
+            operation.get(Constants.ALIAS).set("bsmith");
+            operation.get(Constants.ALGORITHM).set("RSA");
+            operation.get(Constants.KEY_SIZE).set(1024);
+            operation.get(Constants.VALIDITY).set(365);
+            operation.get(Constants.SIGNATURE_ALGORITHM).set("SHA256withRSA");
+            operation.get(Constants.DISTINGUISHED_NAME).set("CN=bob smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+            ModelNode extensions = new ModelNode();
+            extensions.add(getExtension(false, "ExtendedKeyUsage", "clientAuth"));
+            extensions.add(getExtension(true, "KeyUsage", "digitalSignature"));
+            extensions.add(getExtension(false, "SubjectAlternativeName", "email:bobsmith@example.com,DNS:bobsmith.example.com"));
+            operation.get(Constants.EXTENSIONS).set(extensions);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEY_PASSWORD);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(numAliasesBefore + 1, readAliases().size());
+
+            // Don't drop the nanoseconds from this value as this is being used to check the expirtation is no longer
+            // than 365 days in the future.
+            ZonedDateTime createdTime = ZonedDateTime.now();
+
+            ModelNode newAlias = readAlias("bsmith");
+            assertEquals(KeyStore.PrivateKeyEntry.class.getSimpleName(), newAlias.get(Constants.ENTRY_TYPE).asString());
+            assertEquals(1, newAlias.get(Constants.CERTIFICATE_CHAIN).asList().size());
+
+            ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(KEYSTORE_NAME);
+            KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+            assertNotNull(keyStore);
+            X509Certificate certificate = (X509Certificate) keyStore.getCertificate("bsmith");
+            assertEquals("RSA", certificate.getPublicKey().getAlgorithm());
+            assertEquals(1024, ((RSAKey) certificate.getPublicKey()).getModulus().bitLength());
+
+            ZonedDateTime notBefore = ZonedDateTime.ofInstant(certificate.getNotBefore().toInstant(), ZoneId.systemDefault());
+            assertTrue("Certificate not valid before test ran.", !notBefore.isBefore(startTime));
+
+            ZonedDateTime calculatedAfter = notBefore.plusDays(365);
+            Date notAfter = certificate.getNotAfter();
+            assertEquals("Expected 'notAfter' value.", calculatedAfter.toInstant(), notAfter.toInstant());
+
+            ZonedDateTime in365Days = createdTime.plusDays(365);
+            assertTrue("Certificate not valid more than 365 days after creation", !notAfter.toInstant().isAfter(in365Days.toInstant()));
+
+            assertEquals("SHA256withRSA", certificate.getSigAlgName());
+            assertEquals(new X500Principal("CN=bob smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us"), certificate.getSubjectX500Principal());
+            assertEquals(new X500Principal("CN=bob smith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us"), certificate.getIssuerX500Principal());
+            try {
+                certificate.verify(certificate.getPublicKey());
+            } catch (Exception e) {
+                fail("Exception not expected");
+            }
+            assertEquals(1, certificate.getCriticalExtensionOIDs().size());
+            assertEquals(3, certificate.getNonCriticalExtensionOIDs().size());
+            assertEquals(Arrays.asList(X500.OID_KP_CLIENT_AUTH), certificate.getExtendedKeyUsage());
+            boolean[] keyUsage = certificate.getKeyUsage();
+            assertTrue(KeyUsage.digitalSignature.in(keyUsage));
+            final Collection<List<?>> names = certificate.getSubjectAlternativeNames();
+            assertEquals(2, names.size());
+            final Iterator<List<?>> iterator = names.iterator();
+            List<?> item = iterator.next();
+            assertEquals(2, item.size());
+            assertEquals(Integer.valueOf(GeneralName.RFC_822_NAME), item.get(0));
+            assertEquals("bobsmith@example.com", item.get(1));
+            item = iterator.next();
+            assertEquals(2, item.size());
+            assertEquals(Integer.valueOf(GeneralName.DNS_NAME), item.get(0));
+            assertEquals("bobsmith.example.com", item.get(1));
+            assertNotNull(certificate.getExtensionValue(X500.OID_CE_SUBJECT_KEY_IDENTIFIER));
+
+            assertNotNull(keyStore.getKey("bsmith", KEY_PASSWORD.toCharArray()));
+        } finally {
+            removeKeyStore();
+        }
+    }
+
+    @Test
+    public void testGenerateCertificateSigningRequest() throws Exception {
+        String csrFileName = "/generated-csr.csr";
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        File csrFile = new File(resources + csrFileName);
+        // Use the original KeyStore since this test depends on the encoding being identical but not the expiration date
+        addOriginalKeyStore();
+
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.GENERATE_CERTIFICATE_SIGNING_REQUEST);
+            operation.get(Constants.ALIAS).set("ssmith");
+            operation.get(Constants.SIGNATURE_ALGORITHM).set("SHA512withRSA");
+            operation.get(Constants.DISTINGUISHED_NAME).set("CN=ssmith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us");
+            ModelNode extensions = new ModelNode();
+            extensions.add(getExtension(false, "ExtendedKeyUsage", "clientAuth"));
+            extensions.add(getExtension(true, "KeyUsage", "digitalSignature"));
+            operation.get(Constants.EXTENSIONS).set(extensions);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEY_PASSWORD);
+            operation.get(Constants.PATH).set(resources + csrFileName);
+            assertSuccess(services.executeOperation(operation));
+
+            assertTrue(csrFile.exists());
+            byte[] bytes = Files.readAllBytes(csrFile.toPath());
+            String expectedCsr = "-----BEGIN CERTIFICATE REQUEST-----" + System.lineSeparator() +
+                    "MIICADCCAWkCAQAwazELMAkGA1UEBhMCdXMxFzAVBgNVBAgTDm5vcnRoIGNhcm9s" + System.lineSeparator() +
+                    "aW5hMRAwDgYDVQQHEwdyYWxlaWdoMRAwDgYDVQQKEwdyZWQgaGF0MQ4wDAYDVQQL" + System.lineSeparator() +
+                    "EwVqYm9zczEPMA0GA1UEAxMGc3NtaXRoMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB" + System.lineSeparator() +
+                    "iQKBgQCLn3sYEbfkVOuFNUAXxNDhNBGecNcWPmqM5J3/eUlfmczSMFqLvSx4X5j8" + System.lineSeparator() +
+                    "CGt5wZMI13KyBONS87STVqLeMC2FrnKtDkifPcfUt/ytoK3LMPyNNK35gBHix7ap" + System.lineSeparator() +
+                    "Zv0z2+WbscfbLvNb32BabZaq6yIuLEJZvl8WzB8dm4GWaoGoqQIDAQABoFUwUwYJ" + System.lineSeparator() +
+                    "KoZIhvcNAQkOMUYwRDATBgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMC" + System.lineSeparator() +
+                    "B4AwHQYDVR0OBBYEFHE6nKD0WLjThMTt8rA9ZpKPugdBMA0GCSqGSIb3DQEBDQUA" + System.lineSeparator() +
+                    "A4GBAAFyEDq9pXLoEy6hcP2OiaTOIAxaBSxewGaVaF2n2mhGosc1BpNnY2EKASVm" + System.lineSeparator() +
+                    "z9hA0m0z/AKy/H2bRNcdHavnHR9nK5xGbzbMm6nrLk+juAT4GIDxkR5S7QfHtKpb" + System.lineSeparator() +
+                    "UDNvda3hKmtKFAcDdf5Cb/i8PL5yqdKfUcd4WOTE3TM3xton" + System.lineSeparator() +
+                    "-----END CERTIFICATE REQUEST-----" + System.lineSeparator();
+            assertEquals(expectedCsr, new String(bytes, StandardCharsets.UTF_8));
+        } finally {
+            removeKeyStore();
+            if (csrFile.exists()) {
+                csrFile.delete();
+            }
+        }
+    }
+
+    @Test
+    public void testImportSingleCertificateReply() throws Exception {
+        String replyFileName = "/test-single-cert-reply.cert";
+        testImportCertificateReply(replyFileName);
+    }
+
+    @Test
+    public void testImportCertificateChainReply() throws Exception {
+        String replyFileName = "/test-cert-chain-reply.cert";
+        testImportCertificateReply(replyFileName);
+    }
+
+    private void testImportCertificateReply(String replyFileName) throws Exception {
+        addKeyStore();
+
+        try {
+            ModelNode alias = readAlias("ssmith");
+            assertEquals(KeyStore.PrivateKeyEntry.class.getSimpleName(), alias.get(Constants.ENTRY_TYPE).asString());
+            assertEquals(1, alias.get(Constants.CERTIFICATE_CHAIN).asList().size());
+
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.IMPORT_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("ssmith");
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEY_PASSWORD);
+            Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+            operation.get(Constants.PATH).set(resources + replyFileName);
+            assertSuccess(services.executeOperation(operation));
+
+            alias = readAlias("ssmith");
+            assertEquals(KeyStore.PrivateKeyEntry.class.getSimpleName(), alias.get(Constants.ENTRY_TYPE).asString());
+            assertEquals(2, alias.get(Constants.CERTIFICATE_CHAIN).asList().size());
+
+            ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(KEYSTORE_NAME);
+            KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+            assertNotNull(keyStore);
+            Certificate[] chain = keyStore.getCertificateChain("ssmith");
+            X509Certificate firstCertificate = (X509Certificate) chain[0];
+            X509Certificate secondCertificate = (X509Certificate) chain[1];
+            String expectedIssuerDn = "O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA";
+            assertEquals(new X500Principal("CN=ssmith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us"), firstCertificate.getSubjectX500Principal());
+            assertEquals(new X500Principal(expectedIssuerDn).getName(), firstCertificate.getIssuerX500Principal().getName());
+            assertEquals(new X500Principal(expectedIssuerDn).getName(), secondCertificate.getSubjectX500Principal().getName());
+            assertEquals(new X500Principal(expectedIssuerDn).getName(), secondCertificate.getIssuerX500Principal().getName());
+        } finally {
+            removeKeyStore();
+        }
+    }
+
+    @Test
+    public void testImportUntrustedCertificateReplyWithValidation() throws Exception {
+        testImportUntrustedCertificateReply(true);
+    }
+
+    @Test
+    public void testImportUntrustedCertificateReplyWithoutValidation() throws Exception {
+        testImportUntrustedCertificateReply(false);
+    }
+
+    private void testImportUntrustedCertificateReply(boolean validate) throws Exception {
+        // top-most certificate in the reply is not present in the keystore or cacerts file
+        String replyFileName = "/test-untrusted-cert-chain-reply.cert";
+
+        addKeyStore();
+
+        try {
+            ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(KEYSTORE_NAME);
+            KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+            assertNotNull(keyStore);
+            KeyStore.PrivateKeyEntry aliasBefore = (KeyStore.PrivateKeyEntry) keyStore.getEntry("ssmith", new KeyStore.PasswordProtection(KEY_PASSWORD.toCharArray()));
+            assertEquals(1, aliasBefore.getCertificateChain().length);
+
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.IMPORT_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("ssmith");
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEY_PASSWORD);
+            Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+            operation.get(Constants.PATH).set(resources + replyFileName);
+            operation.get(Constants.VALIDATE).set(validate);
+            operation.get(Constants.TRUST_CACERTS).set(true);
+
+            if (validate) {
+                assertFailed(services.executeOperation(operation));
+                keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+                assertNotNull(keyStore);
+                KeyStore.PrivateKeyEntry aliasAfter = (KeyStore.PrivateKeyEntry) keyStore.getEntry("ssmith", new KeyStore.PasswordProtection(KEY_PASSWORD.toCharArray()));
+                assertEquals(aliasBefore.getCertificate(), aliasAfter.getCertificate());
+                assertArrayEquals(aliasBefore.getCertificateChain(), aliasAfter.getCertificateChain());
+            } else {
+                assertSuccess(services.executeOperation(operation));
+
+                ModelNode alias = readAlias("ssmith");
+                assertEquals(KeyStore.PrivateKeyEntry.class.getSimpleName(), alias.get(Constants.ENTRY_TYPE).asString());
+                assertEquals(2, alias.get(Constants.CERTIFICATE_CHAIN).asList().size());
+
+                keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+                assertNotNull(keyStore);
+                Certificate[] chain = keyStore.getCertificateChain("ssmith");
+                X509Certificate firstCertificate = (X509Certificate) chain[0];
+                X509Certificate secondCertificate = (X509Certificate) chain[1];
+                String expectedIssuerDn = "O=Another Root Certificate Authority, EMAILADDRESS=anotherca@wildfly.org, C=UK, ST=Elytron, CN=Another Elytron CA";
+                assertEquals(new X500Principal("CN=ssmith, OU=jboss, O=red hat, L=raleigh, ST=north carolina, C=us").getName(), firstCertificate.getSubjectX500Principal().getName());
+                assertEquals(new X500Principal(expectedIssuerDn).getName(), firstCertificate.getIssuerX500Principal().getName());
+                assertEquals(new X500Principal(expectedIssuerDn).getName(), secondCertificate.getSubjectX500Principal().getName());
+                assertEquals(new X500Principal(expectedIssuerDn).getName(), secondCertificate.getIssuerX500Principal().getName());
+            }
+        } finally {
+            removeKeyStore();
+        }
+    }
+
+    @Test
+    public void testImportTrustedCertificate() throws Exception {
+        String replyFileName = "/test-trusted.cert";
+        addKeyStore();
+
+        try {
+            int numAliasesBefore = readAliases().size();
+
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.IMPORT_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("intermediateCA");
+            Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+            operation.get(Constants.PATH).set(resources + replyFileName);
+            operation.get(Constants.TRUST_CACERTS).set(true);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(numAliasesBefore + 1, readAliases().size());
+
+            ModelNode alias = readAlias("intermediateCA");
+            assertEquals(KeyStore.TrustedCertificateEntry.class.getSimpleName(), alias.get(Constants.ENTRY_TYPE).asString());
+            assertTrue(alias.get(Constants.CERTIFICATE).isDefined());
+
+            ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(KEYSTORE_NAME);
+            KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+            assertNotNull(keyStore);
+            X509Certificate certificate = (X509Certificate) keyStore.getCertificate("intermediateCA");
+            assertEquals(new X500Principal("O=Intermediate Certificate Authority, EMAILADDRESS=intermediateca@wildfly.org, C=UK, ST=Elytron, CN=Intermediate Elytron CA").getName(), certificate.getSubjectX500Principal().getName());
+            assertEquals(new X500Principal("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA").getName(), certificate.getIssuerX500Principal().getName());
+        } finally {
+            removeKeyStore();
+        }
+    }
+
+    @Test
+    public void testImportUntrustedCertificateWithValidation() throws Exception {
+        testImportUntrustedCertificate(true);
+    }
+
+    @Test
+    public void testImportUntrustedCertificateWithoutValidation() throws Exception {
+        testImportUntrustedCertificate(false);
+    }
+
+    private void testImportUntrustedCertificate(boolean validate) throws Exception {
+        // issuer certificate is not present in the keystore or cacerts file
+        String replyFileName = "/test-untrusted.cert";
+
+        addKeyStore();
+
+        try {
+            int numAliasesBefore = readAliases().size();
+
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.IMPORT_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("anotherCA");
+            Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+            operation.get(Constants.PATH).set(resources + replyFileName);
+            operation.get(Constants.VALIDATE).set(validate);
+            operation.get(Constants.TRUST_CACERTS).set(true);
+
+            if (validate) {
+                assertFailed(services.executeOperation(operation));
+                assertEquals(numAliasesBefore, readAliases().size());
+            } else {
+                assertSuccess(services.executeOperation(operation));
+                assertEquals(numAliasesBefore + 1, readAliases().size());
+
+                ModelNode alias = readAlias("anotherCA");
+                assertEquals(KeyStore.TrustedCertificateEntry.class.getSimpleName(), alias.get(Constants.ENTRY_TYPE).asString());
+                assertTrue(alias.get(Constants.CERTIFICATE).isDefined());
+
+                ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(KEYSTORE_NAME);
+                KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+                assertNotNull(keyStore);
+                String expectedDn = "O=Another Root Certificate Authority, EMAILADDRESS=anotherca@wildfly.org, C=UK, ST=Elytron, CN=Another Elytron CA";
+                X509Certificate certificate = (X509Certificate) keyStore.getCertificate("anotherCA");
+                assertEquals(new X500Principal(expectedDn).getName(), certificate.getSubjectX500Principal().getName());
+                assertEquals(new X500Principal(expectedDn).getName(), certificate.getIssuerX500Principal().getName());
+            }
+        } finally {
+            removeKeyStore();
+        }
+    }
+
+    @Test
+    public void testExportCertificate() throws Exception {
+        String expectedCertificateFileName = "/test-exported.cert";
+        String certificateFileName = "/exported-cert.cert";
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        File certificateFile = new File(resources + certificateFileName);
+        addKeyStore();
+
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.EXPORT_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("ssmith");
+            operation.get(Constants.PATH).set(resources + certificateFileName);
+            assertSuccess(services.executeOperation(operation));
+
+            assertTrue(certificateFile.exists());
+            File expectedCertificateFile = new File(resources + expectedCertificateFileName);
+            byte[] expectedBytes = Files.readAllBytes(expectedCertificateFile.toPath());
+            byte[] bytes = Files.readAllBytes(certificateFile.toPath());
+            assertArrayEquals(expectedBytes, bytes);
+        } finally {
+            removeKeyStore();
+            if (certificateFile.exists()) {
+                certificateFile.delete();
+            }
+        }
+    }
+
+    @Test
+    public void testExportCertificatePem() throws Exception {
+        String certificateFileName = "/exported-cert.cert";
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        File certificateFile = new File(resources + certificateFileName);
+        // Use the original KeyStore since this test depends on the encoding being identical but not the expiration date
+        addOriginalKeyStore();
+
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.EXPORT_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("ssmith");
+            operation.get(Constants.PATH).set(resources + certificateFileName);
+            operation.get(Constants.PEM).set(true);
+            assertSuccess(services.executeOperation(operation));
+
+            assertTrue(certificateFile.exists());
+            byte[] bytes = Files.readAllBytes(certificateFile.toPath());
+            String expectedCertificate = "-----BEGIN CERTIFICATE-----" + System.lineSeparator() +
+                    "MIIC2zCCAkSgAwIBAgIEEjs64jANBgkqhkiG9w0BAQsFADBwMQswCQYDVQQGEwJ1" + System.lineSeparator() +
+                    "czEXMBUGA1UECBMObm9ydGggY2Fyb2xpbmExEDAOBgNVBAcTB3JhbGVpZ2gxEDAO" + System.lineSeparator() +
+                    "BgNVBAoTB3JlZCBoYXQxDjAMBgNVBAsTBWpib3NzMRQwEgYDVQQDEwtzYWxseSBz" + System.lineSeparator() +
+                    "bWl0aDAeFw0xNzExMTUyMDU1MDlaFw0xODExMTUyMDU1MDlaMHAxCzAJBgNVBAYT" + System.lineSeparator() +
+                    "AnVzMRcwFQYDVQQIEw5ub3J0aCBjYXJvbGluYTEQMA4GA1UEBxMHcmFsZWlnaDEQ" + System.lineSeparator() +
+                    "MA4GA1UEChMHcmVkIGhhdDEOMAwGA1UECxMFamJvc3MxFDASBgNVBAMTC3NhbGx5" + System.lineSeparator() +
+                    "IHNtaXRoMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCLn3sYEbfkVOuFNUAX" + System.lineSeparator() +
+                    "xNDhNBGecNcWPmqM5J3/eUlfmczSMFqLvSx4X5j8CGt5wZMI13KyBONS87STVqLe" + System.lineSeparator() +
+                    "MC2FrnKtDkifPcfUt/ytoK3LMPyNNK35gBHix7apZv0z2+WbscfbLvNb32BabZaq" + System.lineSeparator() +
+                    "6yIuLEJZvl8WzB8dm4GWaoGoqQIDAQABo4GBMH8wEwYDVR0lBAwwCgYIKwYBBQUH" + System.lineSeparator() +
+                    "AwIwDgYDVR0PAQH/BAQDAgeAMDkGA1UdEQQyMDCBFnNhbGx5c21pdGhAZXhhbXBs" + System.lineSeparator() +
+                    "ZS5jb22CFnNhbGx5c21pdGguZXhhbXBsZS5jb20wHQYDVR0OBBYEFHE6nKD0WLjT" + System.lineSeparator() +
+                    "hMTt8rA9ZpKPugdBMA0GCSqGSIb3DQEBCwUAA4GBABdkyo13j11OA9Oqfqaab68N" + System.lineSeparator() +
+                    "xKCx4KSLoA1fOQW4F5BlnIZI3RbI4poNhByhba8Er6Q7qgQTLIHRI6G4HiL57v7B" + System.lineSeparator() +
+                    "1DOLrs4IFGEGCDWGvaXFIrwItlJ02WTxuuu477oGbh9kdbe29gJxls2yJReNqGCq" + System.lineSeparator() +
+                    "PnBUGLBQg9fol/JlZYco" + System.lineSeparator() +
+                    "-----END CERTIFICATE-----" + System.lineSeparator();
+            assertEquals(expectedCertificate, new String(bytes, StandardCharsets.UTF_8));
+        } finally {
+            removeKeyStore();
+            if (certificateFile.exists()) {
+                certificateFile.delete();
+            }
+        }
+    }
+
+    @Test
+    public void testChangeAlias() throws Exception {
+        addKeyStore();
+
+        try {
+            int numAliasesBefore = readAliases().size();
+
+            ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(KEYSTORE_NAME);
+            KeyStore keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+            assertNotNull(keyStore);
+            KeyStore.PrivateKeyEntry aliasBefore = (KeyStore.PrivateKeyEntry) keyStore.getEntry("ssmith", new KeyStore.PasswordProtection(KEY_PASSWORD.toCharArray()));
+
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.CHANGE_ALIAS);
+            operation.get(Constants.ALIAS).set("ssmith");
+            operation.get(Constants.NEW_ALIAS).set("sallysmith");
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEY_PASSWORD);
+            assertSuccess(services.executeOperation(operation));
+            assertEquals(numAliasesBefore, readAliases().size());
+
+            keyStore = (KeyStore) services.getContainer().getService(serviceName).getValue();
+            assertNotNull(keyStore);
+            assertTrue(! keyStore.containsAlias("ssmith"));
+            KeyStore.PrivateKeyEntry aliasAfter = (KeyStore.PrivateKeyEntry) keyStore.getEntry("sallysmith", new KeyStore.PasswordProtection(KEY_PASSWORD.toCharArray()));
+            assertEquals(aliasBefore.getCertificate(), aliasAfter.getCertificate());
+            assertArrayEquals(aliasBefore.getCertificateChain(), aliasAfter.getCertificateChain());
+            assertEquals(aliasBefore.getPrivateKey(), aliasAfter.getPrivateKey());
+        } finally {
+            removeKeyStore();
+        }
+    }
+
+    @Test
+    public void testStoreFileDoesNotExist() throws Exception {
+        String nonExistentFileName = "/does-not-exist.keystore";
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        File file = new File(resources + nonExistentFileName);
+
+        ModelNode operation = getAddKeyStoreUsingNonExistingFileOperation(false, nonExistentFileName);
+        assertSuccess(services.executeOperation(operation));
+        try {
+            operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.STORE);
+            assertSuccess(services.executeOperation(operation));
+            assertTrue(file.exists());
+        } finally {
+            removeKeyStore();
+            if (file.exists()) {
+                file.delete();
+            }
+        }
+    }
+
+    @Test
+    public void testFileDoesNotExistAndIsRequired() throws Exception {
+        String nonExistentFileName = "/does-not-exist.keystore";
+
+        ModelNode operation = getAddKeyStoreUsingNonExistingFileOperation(true, nonExistentFileName);
+        assertFailed(services.executeOperation(operation));
+    }
+
+    @Test
+    public void testObtainCertificateWithoutAgreeingToTermsOfService() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE, ACCOUNTS_KEYSTORE_NAME, ACCOUNTS_KEYSTORE_PASSWORD);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("invalid", "mailto:admin@anexample.com");
+        addKeyStore(); // to store the obtained certificate
+        server = setupTestCreateAccountWithoutAgreeingToTermsOfService();
+        String alias = "server";
+        KeyStore keyStore = getKeyStore(KEYSTORE_NAME);
+        assertFalse(keyStore.containsAlias(alias));
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.OBTAIN_CERTIFICATE);
+            operation.get(Constants.ALIAS).set(alias);
+            operation.get(Constants.DOMAIN_NAMES).add("www.example.com");
+            operation.get(Constants.CERTIFICATE_AUTHORITY_ACCOUNT).set(CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            ModelNode result = services.executeOperation(operation);
+            assertFailed(result);
+            String failureDescription = result.get(FAILURE_DESCRIPTION).asString();
+            assertTrue(failureDescription.contains("must agree to terms of service"));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+            removeKeyStore(KEYSTORE_NAME);
+        }
+    }
+
+    @Test
+    public void testObtainCertificateWithKeySize() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE, ACCOUNTS_KEYSTORE_NAME, ACCOUNTS_KEYSTORE_PASSWORD);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account6v2", "mailto:admin@myexample.com");
+        addKeyStore(); // to store the obtained certificate
+        server = setupTestObtainCertificateWithKeySize();
+        String alias = "server";
+        String keyAlgorithmName = "RSA";
+        int keySize = 4096;
+        KeyStore keyStore = getKeyStore(KEYSTORE_NAME);
+        assertFalse(keyStore.containsAlias(alias));
+        obtainCertificate(keyAlgorithmName, keySize, "inlneseppwkfwewv2.com", alias, keyStore);
+    }
+
+    @Test
+    public void testObtainCertificateWithECPublicKey() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE, ACCOUNTS_KEYSTORE_NAME, ACCOUNTS_KEYSTORE_PASSWORD);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account7v2", "mailto:admin@myexample.com");
+        addKeyStore(); // to store the obtained certificate
+        server = setupTestObtainCertificateWithECPublicKey();
+        String alias = "server";
+        String keyAlgorithmName = "EC";
+        int keySize = 256;
+        KeyStore keyStore = getKeyStore(KEYSTORE_NAME);
+        assertFalse(keyStore.containsAlias(alias));
+        obtainCertificate(keyAlgorithmName, keySize, "mndelkdnbcilohgv2.com", alias, keyStore);
+    }
+
+    @Test
+    public void testObtainCertificateWithUnsupportedPublicKey() throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE, ACCOUNTS_KEYSTORE_NAME, ACCOUNTS_KEYSTORE_PASSWORD);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account7v2", "mailto:admin@myexample.com");
+        addKeyStore(); // to store the obtained certificate
+        server = setupTestObtainCertificateWithUnsupportedPublicKey();
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.OBTAIN_CERTIFICATE);
+            operation.get(Constants.ALIAS).set("server");
+            operation.get(Constants.DOMAIN_NAMES).add("iraclzlcqgaymrc.com");
+            operation.get(Constants.ALGORITHM).set("DSA");
+            operation.get(Constants.KEY_SIZE).set(2048);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            operation.get(Constants.CERTIFICATE_AUTHORITY_ACCOUNT).set(CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            ModelNode result = services.executeOperation(operation);
+            assertFailed(result);
+            String failureDescription = result.get(FAILURE_DESCRIPTION).asString();
+            assertTrue(failureDescription.contains("WFLYCTL0129"));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+            removeKeyStore(KEYSTORE_NAME);
+        }
+    }
+
+    private void obtainCertificate(String keyAlgorithmName, int keySize, String domainName, String alias, KeyStore keyStore) throws Exception {
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.OBTAIN_CERTIFICATE);
+            operation.get(Constants.ALIAS).set(alias);
+            operation.get(Constants.DOMAIN_NAMES).add(domainName);
+            operation.get(Constants.AGREE_TO_TERMS_OF_SERVICE).set(true);
+            operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(KEY_PASSWORD);
+            operation.get(Constants.ALGORITHM).set(keyAlgorithmName);
+            operation.get(Constants.KEY_SIZE).set(keySize);
+            operation.get(Constants.CERTIFICATE_AUTHORITY_ACCOUNT).set(CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            assertSuccess(services.executeOperation(operation));
+            assertTrue(keyStore.containsAlias(alias));
+            PrivateKey privateKey = (PrivateKey) keyStore.getKey(alias, KEY_PASSWORD.toCharArray());
+            X509Certificate signedCert = (X509Certificate) keyStore.getCertificate(alias);
+            assertEquals(keyAlgorithmName, privateKey.getAlgorithm());
+            assertEquals(keyAlgorithmName, signedCert.getPublicKey().getAlgorithm());
+            if (keyAlgorithmName.equals("EC")) {
+                assertEquals(keySize, ((ECPublicKey) signedCert.getPublicKey()).getParams().getCurve().getField().getFieldSize());
+            } else if (keyAlgorithmName.equals("RSA")) {
+                assertEquals(keySize, ((RSAPublicKey) signedCert.getPublicKey()).getModulus().bitLength());
+            }
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+            removeKeyStore(KEYSTORE_NAME);
+        }
+    }
+    @Test
+    public void testRevokeCertificateWithoutReason() throws Exception {
+        revokeCertificate("revokealiasv2", null);
+    }
+
+    @Test
+    public void testRevokeCertificateWithReason() throws Exception {
+        revokeCertificate("revokewithreasonaliasv2", "KeyCompromise");
+    }
+
+    @Test
+    public void testShouldRenewCertificateAlreadyExpired() throws Exception {
+        final ZonedDateTime notValidBeforeDate = ZonedDateTime.of(2018, 03, 24, 23, 59, 59, 0, ZoneOffset.UTC);
+        final ZonedDateTime notValidAfterDate = ZonedDateTime.of(2018, 04, 24, 23, 59, 59, 0, ZoneOffset.UTC);
+        ModelNode result = shouldRenewCertificate(notValidBeforeDate, notValidAfterDate, 30);
+        assertTrue(result.get(Constants.SHOULD_RENEW_CERTIFICATE).asBoolean());
+        assertEquals(0, result.get(Constants.DAYS_TO_EXPIRY).asLong());
+    }
+
+    @Test
+    public void testShouldRenewCertificateExpiresWithinGivenDays() throws Exception {
+        final ZonedDateTime notValidBeforeDate = ZonedDateTime.now().withZoneSameInstant(ZoneId.of("UTC"));
+        final ZonedDateTime notValidAfterDate = notValidBeforeDate.plusDays(60).plusMinutes(1);
+        ModelNode result = shouldRenewCertificate(notValidBeforeDate, notValidAfterDate, 90);
+        assertTrue(result.get(Constants.SHOULD_RENEW_CERTIFICATE).asBoolean());
+        assertEquals(60, result.get(Constants.DAYS_TO_EXPIRY).asLong());
+    }
+
+    @Test
+    public void testShouldRenewCertificateDoesNotExpireWithinGivenDays() throws Exception {
+        final ZonedDateTime notValidBeforeDate = ZonedDateTime.now().withZoneSameInstant(ZoneId.of("UTC"));
+        final ZonedDateTime notValidAfterDate = notValidBeforeDate.plusDays(30).plusMinutes(1);
+        ModelNode result = shouldRenewCertificate(notValidBeforeDate, notValidAfterDate, 15);
+        assertFalse(result.get(Constants.SHOULD_RENEW_CERTIFICATE).asBoolean());
+        assertEquals(30, result.get(Constants.DAYS_TO_EXPIRY).asLong());
+    }
+
+    private ModelNode shouldRenewCertificate(ZonedDateTime notValidBeforeDate, ZonedDateTime notValidAfterDate, int expiration) throws Exception {
+        String expiryKeyStoreFileName = "expiry.keystore";
+        String alias = "expiry";
+        File expiryKeyStoreFile = new File(WORKING_DIRECTORY_LOCATION, expiryKeyStoreFileName);
+        KeyStore expiryKeyStore = KeyStore.getInstance("JKS");
+        expiryKeyStore.load(null, null);
+        addCertificate(expiryKeyStore, alias, notValidBeforeDate, notValidAfterDate);
+        try (FileOutputStream fos = new FileOutputStream(expiryKeyStoreFile)){
+            expiryKeyStore.store(fos, "Elytron".toCharArray());
+        }
+        addKeyStore(expiryKeyStoreFileName, KEYSTORE_NAME, "Elytron");
+
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.SHOULD_RENEW_CERTIFICATE);
+            operation.get(Constants.ALIAS).set(alias);
+            operation.get(Constants.EXPIRATION).set(expiration);
+            return assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+        } finally {
+            removeKeyStore(KEYSTORE_NAME);
+        }
+    }
+
+    private void revokeCertificate(String alias, String reason) throws Exception {
+        addKeyStore(ACCOUNTS_KEYSTORE, ACCOUNTS_KEYSTORE_NAME, ACCOUNTS_KEYSTORE_PASSWORD);
+        addCertificateAuthorityWithoutStagingUrl();
+        addCertificateAuthorityAccountWithCustomCA("account1v2", "mailto:admin@anexample.com");
+        KeyStore keyStore = getKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        if (reason != null) {
+            server = setupTestRevokeCertificateWithReason();
+        } else {
+            server = setupTestRevokeCertificateWithoutReason();
+        }
+        assertTrue(keyStore.containsAlias(alias));
+        try {
+            ModelNode operation = new ModelNode();
+            operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("key-store", ACCOUNTS_KEYSTORE_NAME);
+            operation.get(ClientConstants.OP).set(Constants.REVOKE_CERTIFICATE);
+            operation.get(Constants.ALIAS).set(alias);
+            if (reason != null) {
+                operation.get(Constants.REASON).set(reason);
+            }
+            operation.get(Constants.CERTIFICATE_AUTHORITY_ACCOUNT).set(CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+            assertSuccess(services.executeOperation(operation));
+            assertFalse(keyStore.containsAlias(alias));
+        } finally {
+            removeCertificateAuthorityAccount();
+            removeCertificateAuthority();
+            removeKeyStore(ACCOUNTS_KEYSTORE_NAME);
+        }
+    }
+
+    private void addCertificate(KeyStore keyStore, String alias, ZonedDateTime notValidBefore, ZonedDateTime notValidAfter) throws Exception {
+        SelfSignedX509CertificateAndSigningKey issuerCertificateAndSigningKey = SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(ROOT_DN)
+                .build();
+
+        X509Certificate issuerCertificate = issuerCertificateAndSigningKey.getSelfSignedCertificate();
+
+        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+        KeyPair keyPair = keyPairGenerator.generateKeyPair();
+        PrivateKey privateKey = keyPair.getPrivate();
+        PublicKey publicKey = keyPair.getPublic();
+        X509Certificate signedCertificate = new X509CertificateBuilder()
+                .setIssuerDn(ROOT_DN)
+                .setSubjectDn(FIREFLY_DN)
+                .setPublicKey(publicKey)
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .setSigningKey(privateKey)
+                .setNotValidBefore(notValidBefore)
+                .setNotValidAfter(notValidAfter)
+                .build();
+        keyStore.setKeyEntry(alias, privateKey, KEY_PASSWORD.toCharArray(), new X509Certificate[]{ signedCertificate, issuerCertificate});
+    }
+
+    private void addKeyStore() throws Exception {
+        addKeyStore("test.keystore", KEYSTORE_NAME, "Elytron");
+    }
+
+    private void addKeyStore(String keyStoreFile, String keyStoreName, String keyStorePassword) throws Exception {
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        Files.copy(resources.resolve(keyStoreFile), resources.resolve("test-copy.keystore"), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/test-copy.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(keyStorePassword);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private KeyStore getKeyStore(String keyStoreName) {
+        ServiceName serviceName = Capabilities.KEY_STORE_RUNTIME_CAPABILITY.getCapabilityServiceName(keyStoreName);
+        return (KeyStore) services.getContainer().getService(serviceName).getValue();
+    }
+
+    private void addOriginalKeyStore() throws Exception {
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        Files.copy(resources.resolve("test-original.keystore"), resources.resolve("test-copy.keystore"), java.nio.file.StandardCopyOption.REPLACE_EXISTING);
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", KEYSTORE_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + "/test-copy.keystore");
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set("Elytron");
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private List<ModelNode> readAliases() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", KEYSTORE_NAME);
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIASES);
+        return assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT).asList();
+    }
+
+    private ModelNode readAlias(String aliasName) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", KEYSTORE_NAME);
+        operation.get(ClientConstants.OP).set(Constants.READ_ALIAS);
+        operation.get(Constants.ALIAS).set(aliasName);
+        ModelNode alias = assertSuccess(services.executeOperation(operation)).get(ClientConstants.RESULT);
+        assertEquals(aliasName, alias.get(Constants.ALIAS).asString());
+        return alias;
+    }
+
+    private ModelNode getExtension(boolean critical, String name, String value) {
+        ModelNode extension = new ModelNode();
+        extension.get(Constants.CRITICAL).set(critical);
+        extension.get(Constants.NAME).set(name);
+        extension.get(Constants.VALUE).set(value);
+        return extension;
+    }
+
+    private void removeKeyStore() {
+        removeKeyStore(KEYSTORE_NAME);
+    }
+
+    private void removeKeyStore(String keyStoreName) {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", keyStoreName);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private ModelNode getAddKeyStoreUsingNonExistingFileOperation(boolean required, String nonExistentFileName) throws Exception {
+        Path resources = Paths.get(KeyStoresTestCase.class.getResource(".").toURI());
+        File file = new File(resources + nonExistentFileName);
+        assertTrue (! file.exists());
+
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("key-store", KEYSTORE_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + nonExistentFileName);
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set("Elytron");
+        if (required) {
+            operation.get(Constants.REQUIRED).set(true);
+        }
+        return operation;
+    }
+
+
+    private void addCertificateAuthorityWithoutStagingUrl() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.URL).set(SIMULATED_LETS_ENCRYPT_ENDPOINT);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void addCertificateAuthorityAccountWithCustomCA(String alias, String contactURL) throws Exception {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.CONTACT_URLS).add(contactURL);
+        operation.get(Constants.CERTIFICATE_AUTHORITY).set(CERTIFICATE_AUTHORITY_NAME);
+        operation.get(Constants.KEY_STORE).set(ACCOUNTS_KEYSTORE_NAME);
+        operation.get(Constants.ALIAS).set(alias);
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set(ACCOUNTS_KEYSTORE_PASSWORD);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void removeCertificateAuthority() {
+        ModelNode operation;
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add("certificate-authority", CERTIFICATE_AUTHORITY_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private void removeCertificateAuthorityAccount() {
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OPERATION_HEADERS).get("allow-resource-service-restart").set(Boolean.TRUE);
+        operation.get(ClientConstants.OP_ADDR).add("subsystem","elytron-tls").add("certificate-authority-account", CERTIFICATE_AUTHORITY_ACCOUNT_NAME);
+        operation.get(ClientConstants.OP).set(ClientConstants.REMOVE_OPERATION);
+        assertSuccess(services.executeOperation(operation));
+    }
+
+    private ClientAndServer setupTestCreateAccountWithoutAgreeingToTermsOfService() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator()  +
+                "  \"oyv-_7dfkxs\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator()  +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator()  +
+                "  \"meta\": {" + System.lineSeparator()  +
+                "    \"caaIdentities\": [" + System.lineSeparator()  +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator()  +
+                "    ]," + System.lineSeparator()  +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator()  +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator()  +
+                "  }," + System.lineSeparator()  +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator()  +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator()  +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator()  +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator()  +
+                "}";
+
+        final String NEW_NONCE_RESPONSE = "zinctnSRWv_CmPz5dhMgom1tppGmuXIqB8X8pZO_0YTF1Nc";
+
+        final String NEW_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJsblhXQ1JDUUpLOW93RXMzMVZrVFNLLWZ2aDcxMDVYOVhYNUFRaVYtbXgxRkJtdU95OVBBS3JTTUlNcXR2ZXk2REhRY0gwVzc5OGp4X3MwRFFmekhCb1E1aU56YUFtVDFhMG5xN3hBemhsRGM5YXZ6WndiTDl0WW1nV3pDM0VQZm1PcXVlNTFoQkZ0VzN3X29IaHpaeTU5YUV2bmZra0hfalJLYUdZRFlPb3F4VXNfNmNXMTVGV3JmWERhOVFIUEVkUEdHTEt6ZTF1aW92bGxON2dNdWZkUFdzZElKRGhwOU1JSGhhVTZjOUZSSDhRS0I1WXlSd0dYR0ZpVmNZU1cyUWtsQkxJN0EzWkdWd2Y5YXNOR0VoUzZfRUxIc2FZVnR3LWFwd1NSSnM1ZnlwVTZidFRDS2J0dUN3X0M0T1FtQXExNDRmdkstOEJSUk1WaE56Qkh6SXcifSwibm9uY2UiOiJ6aW5jdG5TUld2X0NtUHo1ZGhNZ29tMXRwcEdtdVhJcUI4WDhwWk9fMFlURjFOYyIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6ZmFsc2UsImNvbnRhY3QiOlsibWFpbHRvOmFkbWluQGFuZXhhbXBsZS5jb20iXX0\",\"signature\":\"OhI4lDd6BsTlKvqMsiBY8bCnfozYsclQPpB7apFVuP0BTfO9iUbybiZ1gHDRGsyUF84gMoBaozZX6iMIApBW9j21uQuWBCGyn-wyM_Fu6n5ruenNQPYyiQteiVYP36oXuSKT76AnsoqXbX5NHfvjOlPiREmD95sfKRuvlsDlgaRD1hGU5qFNt9gTr90vVADPrMN20O0QKSCx5d4cKjm2BvD4oM4xA-Qll2HCREeb40F7eeIGUdCxHflHQOPObm2JBHm2lhOieankj0HPunP43L607iCZ8W2DAaX6EKDfMYunnnbpj9vXkkRUm7yEi4LNRs6OS4Hc-LHqKsgWoWc3kQ\"}";
+
+        final String NEW_ACCT_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"type\": \"urn:ietf:params:acme:error:malformed\"," + System.lineSeparator() +
+                "  \"detail\": \"must agree to terms of service\"," + System.lineSeparator() +
+                "  \"status\": 400" + System.lineSeparator() +
+                "}";
+
+        final String NEW_ACCT_REPLAY_NONCE = "tarobHhNBawhfG-BpSmsBEpiESawT4Aw_k-sX2rqwjl-Mac";
+        final String NEW_ACCT_LOCATION = "";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(NEW_ACCT_REQUEST_BODY, NEW_ACCT_RESPONSE_BODY, NEW_ACCT_REPLAY_NONCE, NEW_ACCT_LOCATION, 400, true)
+                .build();
+    }
+
+    private ClientAndServer setupTestObtainCertificateWithKeySize() {
+
+        // set up a mock Let's Encrypt server
+        final String ACCT_PATH = "/acme/acct/10";
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"g01M7uvywHo\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "zinci6YzZrHxreJbW6Llpxjrnnw1mkm8eKsy5iUESlKMp0k";
+
+        final String QUERY_ACCT_REQUEST_BODY_1 = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJpcVZkd3laNGl0VlNoOFVWX2Z3NlpnVjh3Mk56SEtGdzZWeWl5cGRLMmlyUkk0T3BMdWhJNEhqQ3pSTHR0WkJPX3ZLRjFZaTB1dVdMaFFzMnVpWlJ5eXFCa0R6SXU3UnIwZWp2T2UtLVc2aWhLanE2WnNCQ2Q3eDhMUl9yYXp1X242V1BkQWJZeWZxdnBuS0V0bGZxdW4yMWJnWk1yT1R4YW0tS0FNS2kyNlJlVi1oVDlYU05kbWpoWnhtSzZzQ0NlTl9JOTVEUXZ1VG55VFctUUJFd2J2MVVOTEEtOXRIR3QyUzQ0a2JvT0JtemV6RGdPSVlfNFpNd3MtWXZucFd5VElsU0k3TmlNMVhKb1NXMHlSLWdjaFlRT1FuSEU2QUhtdk5KbV9zSTlZN0ZhQmJVeVJpS0RnTi1vZlR3cXNzdzZ2ejVucUxUanU3Y2dzWld4S1dESHcifSwibm9uY2UiOiJ6aW5jaTZZelpySHhyZUpiVzZMbHB4anJubncxbWttOGVLc3k1aVVFU2xLTXAwayIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6dHJ1ZSwiY29udGFjdCI6WyJtYWlsdG86YWRtaW5AbXlleGFtcGxlLmNvbSJdfQ\",\"signature\":\"dRwzfHcuS_7Lsg_KnqA5tCCYpECu_BnCLAqxUIvczD4mDMPBKwRUnyKnd86jxr7v1PRzMF77S7pcXfodHCDPEuSsfmmvDhZs7fVDuT4U4d15Ls5A7HgN0RKOmbkRxJOGzHZ-07428e_sFGbApeNwj6xB6SWCuxMrGES7g9i0McNjPkbhB4IFo9_TCQ3KQGfFE33YHC0_DEscC3QT7y5SaMU0HE51XnpMIxmnULXjgQU_ugBvooNjQ2xkzlU3eTyXgTNkX3zFS06PkuYmGfHvakfcsB15OvdOyzvMp-qw9TinJT7VUyf4GDeOFsTk5RN4h-2aOkUBhL88Jonmii2CwQ\"}";
+
+
+        final String QUERY_ACCT_RESPONSE_BODY_1= "";
+
+        final String QUERY_ACCT_REPLAY_NONCE_1 = "taroNVru6SF-j0qWY8im0bC0tYef6U-RfcPvtdjJ1JOktV4";
+        final String ACCT_LOCATION = "http://localhost:4001" + ACCT_PATH;
+
+        final String QUERY_ACCT_REQUEST_BODY_2 = "";
+
+        final String QUERY_ACCT_RESPONSE_BODY_2= "{" + System.lineSeparator() +
+                "  \"key\": {" + System.lineSeparator() +
+                "    \"kty\": \"RSA\"," + System.lineSeparator() +
+                "    \"n\": \"iqVdwyZ4itVSh8UV_fw6ZgV8w2NzHKFw6VyiypdK2irRI4OpLuhI4HjCzRLttZBO_vKF1Yi0uuWLhQs2uiZRyyqBkDzIu7Rr0ejvOe--W6ihKjq6ZsBCd7x8LR_razu_n6WPdAbYyfqvpnKEtlfqun21bgZMrOTxam-KAMKi26ReV-hT9XSNdmjhZxmK6sCCeN_I95DQvuTnyTW-QBEwbv1UNLA-9tHGt2S44kboOBmzezDgOIY_4ZMws-YvnpWyTIlSI7NiM1XJoSW0yR-gchYQOQnHE6AHmvNJm_sI9Y7FaBbUyRiKDgN-ofTwqssw6vz5nqLTju7cgsZWxKWDHw\"," + System.lineSeparator() +
+                "    \"e\": \"AQAB\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"contact\": [" + System.lineSeparator() +
+                "    \"mailto:admin@myexample.com\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"initialIp\": \"10.77.77.1\"," + System.lineSeparator() +
+                "  \"createdAt\": \"2019-07-18T15:01:10Z\"," + System.lineSeparator() +
+                "  \"status\": \"valid\"" + System.lineSeparator() +
+                "}";
+
+        final String QUERY_ACCT_REPLAY_NONCE_2 = "taroq4c6_F5_CIj2KA3dyxojYl4TX3k2jHoGBqchbp9D3ks";
+
+        final String ORDER_CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTAiLCJub25jZSI6InRhcm9xNGM2X0Y1X0NJajJLQTNkeXhvallsNFRYM2syakhvR0JxY2hicDlEM2tzIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvbmV3LW9yZGVyIn0\",\"payload\":\"eyJpZGVudGlmaWVycyI6W3sidHlwZSI6ImRucyIsInZhbHVlIjoiaW5sbmVzZXBwd2tmd2V3djIuY29tIn1dfQ\",\"signature\":\"Ec9GvU8kMXffSZ2nsXDzNxkZDRwQKJRZrDk4ijg4C-Xsvpk5ggfb9gN7-5LFJzhpxqBSjgZsA6EBG_bRNPN7th5mJWqhOfIGU4UbxOuIdirvprlBbuv_EHucGIncwlFfju5uAnJsnQQrZzsWj6yvaj2vpgvdSpzanmIsDbO4dRN9NDwntORy95Px54FGt9TxBrI1kGXLGwA6SX5qOSeLu-aMqys2kzf5Tnox-rmnvAKVaym3vWSX2wBHmnVGiynIAupW9Znakeqw2lOWWQdG_0ybXphvyAjnMgPgjSd28b02lz9Rs3N25Pg5zT4BnrRDrJY734-tIC5VoY2cm3wb3g\"}";
+        final String ORDER_CERT_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T20:20:42.047150201Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"inlneseppwkfwewv2.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/47\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/10/69\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String ORDER_CERT_REPLAY_NONCE = "zincTg-qOV-A1AthHGt9XKWZjPyd7459Ab5bFS2Rsb-k2pU";
+        final String ORDER_LOCATION = "http://localhost:4001/acme/order/10/69";
+
+        final String AUTHZ_URL = "/acme/authz/v2/47";
+        final String AUTHZ_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTAiLCJub25jZSI6InppbmNUZy1xT1YtQTFBdGhIR3Q5WEtXWmpQeWQ3NDU5QWI1YkZTMlJzYi1rMnBVIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvYXV0aHovdjIvNDcifQ\",\"payload\":\"\",\"signature\":\"F2rVeV76ynMI6nt_4oncsrx4m7-hnraZPz0rUyVHHkaoRUicAFgI0MlXszbFEzMhJ4vztfq5ovhBWfWKKxK2oUZGLqW834-HHKByyAiOUSgOSw0naLxFs96U09OAPQGBTcd1z9bsVmXG8orVIxxoKVDjQzkxfb0L1QC0FdNx-Vl0R6CKDdgLbUPKR2pbagSVKMJ8HPFWuYYnUeQZqmr3i0vkjNQRHO6pFcLPRXSHwywKO73JaGDbynOSu-MAWmkSQ2TaMfNQxrmaSjgRvB1K0wJXjCz3nyO7xYraC10ldbLwEmTu-DDIVJ0zyMgAEp3NGYYx-77qUHp_2UCrrY5KhA\"}";
+        final String AUTHZ_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"identifier\": {" + System.lineSeparator() +
+                "    \"type\": \"dns\"," + System.lineSeparator() +
+                "    \"value\": \"inlneseppwkfwewv2.com\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T20:20:42Z\"," + System.lineSeparator() +
+                "  \"challenges\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"http-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/47/z7sh0A\"," + System.lineSeparator() +
+                "      \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/47/mlvrMA\"," + System.lineSeparator() +
+                "      \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"tls-alpn-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/47/_wf1QQ\"," + System.lineSeparator() +
+                "      \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String AUTHZ_REPLAY_NONCE = "tarozNXDL3x4apxYH38Mz3y3oDRdMLMp8fujKrf8JtplOww";
+
+        final String CHALLENGE_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTAiLCJub25jZSI6InRhcm96TlhETDN4NGFweFlIMzhNejN5M29EUmRNTE1wOGZ1aktyZjhKdHBsT3d3IiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvY2hhbGxlbmdlL3YyLzQ3L3o3c2gwQSJ9\",\"payload\":\"e30\",\"signature\":\"V-wYzOrZNxeHBxcVEoGvo5ISccYRSBVRiTajcmSla04f9SCm1nvgeE7u0N0Uc07ATlEqBTSvqN0v3iiLGuMxff-xEePQ15DsEUv8aN231ZiUvGalZYtV8UCM_8yz9Ixc4dgFJEBzY3zhyV3yKiPteF1hh6QMyTmk9erOuWJqIuWuluKo3vbF1K5A7z5E0Uq1uSysMQ5h-c5wqY7eDQzrGZ-PadSzUXXzAMKXqpNizpPRF3PfE0D6R3AiutunSgNCkd4qYgEGqZ1Xx8_caJ_s_2dHuNPbyDHShesAL9vp0SIs0etfzCbAYJFut6erA5hfyJDyIRl4VadC9obNSn_zqA\"}";
+        final String CHALLENGE_URL = "/acme/challenge/v2/47/z7sh0A";
+
+        final String CHALLENGE_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"type\": \"http-01\"," + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"url\": \"http://localhost:4001/acme/challenge/v2/47/z7sh0A\"," + System.lineSeparator() +
+                "  \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String CHALLENGE_REPLAY_NONCE = "zincdmVABCB6HjsLMqEUskJi720sehqIUtrhyOeUOZ3IrCU";
+        final String CHALLENGE_LOCATION = "http://localhost:4001/acme/challenge/v2/47/z7sh0A";
+        final String CHALLENGE_LINK = "<http://localhost:4001/acme/authz/v2/47>;rel=\"up\"";
+        final String VERIFY_CHALLENGE_URL = "/.well-known/acme-challenge/215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc";
+        final String CHALLENGE_FILE_CONTENTS = "215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc.N6GU8Z78VIOWz1qOEJObBvhcmfflldy-TQWkizoonrU";
+
+        final String UPDATED_AUTHZ_REPLAY_NONCE = "taroT16QLPZ628OzZtwZU6yA6-hnbfWexEyGOC-H5ji3hJw";
+        final String UPDATED_AUTHZ_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"identifier\": {" + System.lineSeparator() +
+                "    \"type\": \"dns\"," + System.lineSeparator() +
+                "    \"value\": \"inlneseppwkfwewv2.com\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-08-22T20:20:42Z\"," + System.lineSeparator() +
+                "  \"challenges\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"http-01\"," + System.lineSeparator() +
+                "      \"status\": \"valid\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/47/z7sh0A\"," + System.lineSeparator() +
+                "      \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"," + System.lineSeparator() +
+                "      \"validationRecord\": [" + System.lineSeparator() +
+                "        {" + System.lineSeparator() +
+                "          \"url\": \"http://inlneseppwkfwewv2.com/.well-known/acme-challenge/215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"," + System.lineSeparator() +
+                "          \"hostname\": \"inlneseppwkfwewv2.com\"," + System.lineSeparator() +
+                "          \"port\": \"5002\"," + System.lineSeparator() +
+                "          \"addressesResolved\": [" + System.lineSeparator() +
+                "            \"172.17.0.1\"" + System.lineSeparator() +
+                "          ]," + System.lineSeparator() +
+                "          \"addressUsed\": \"172.17.0.1\"" + System.lineSeparator() +
+                "        }" + System.lineSeparator() +
+                "      ]" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/47/mlvrMA\"," + System.lineSeparator() +
+                "      \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"tls-alpn-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/47/_wf1QQ\"," + System.lineSeparator() +
+                "      \"token\": \"215ACi-BkIjZ28ynW7kiDco21cv4wxRyByykbgxl9Pc\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String FINALIZE_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTAiLCJub25jZSI6InRhcm9UMTZRTFBaNjI4T3padHdaVTZ5QTYtaG5iZldleEV5R09DLUg1amkzaEp3IiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvZmluYWxpemUvMTAvNjkifQ\",\"payload\":\"eyJjc3IiOiJNSUlFdHpDQ0FwOENBUUF3SURFZU1Cd0dBMVVFQXd3VmFXNXNibVZ6WlhCd2QydG1kMlYzZGpJdVkyOXRNSUlDSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQWc4QU1JSUNDZ0tDQWdFQXBjMDZSYnJSRDF2Y3pCQ3k1ZnhodXNTSTdPLW96MlYzd293NURIdUFlN2h3LTNaWDd1SG1Pb21PUHlSLUQ3NGtONEdpckNTSWlUcE1GRC1GcUxFR3hCbXhPMjY3dUlvTnY2SjVrZHlJT0VjMkl4RldacnRyTExWd2NHeC1ROWRhcWZVMWk4cW5YMWx2RkMydUM4Vlp6OU14U0MwV29jNjN3RTVCRnJVQjFPSTQxZDlINVpwYVhRSGctY1ZraXBWWEN2TWJFVnZ1MFVKNkV5eS1JX2pSSFh3QnFYcXhZa2NtMXJuTkFBUUxKc3U3ZThyU3JIV0dNREktcy1lLUsyYm51VGZnelBJSmZZQ19peHplQ0hXU3lnQmV4d1NUd0VfOC04QWJ2SlotQmVjZl9ndnVSQm42TGtYX1FkUndnRWN5d1pGUldka1VvMG90M2xRbFF5a3g1VjFZZ1k3YXMtaEFDZmpSdXRlSFAzUXkyNE1rSmJwLV9rLThDNFp1aGRUQ1pmNlJoRWR1MGpGNF85blhLUkhGUkVOZFUzZThtaENEdFBkblBVeFFoVmoyVjdmZ1hIV2RMZThzdUpkLTlaRjBKdkpqUVJVNEdtWE5qNkxpd3dDWjBQamZZSV9mai1XTFVKVWstMXVSZk0xUDRqRE5jQ01yNjlMdVhoS0U1b2JRYXVEOUxoOF8ydmtQeG1nSTc4T1E3STZ4T2JOWWg2M0hiUHBpelJZcUwtcW53SHcyck45dXZ5S2xTSnh6NW9LVWJPTzdHa3B4bV9TQWg4ZmduOTNYbTZEZFlMbk1zZFlHdGFKSjRnRHBpUVVLTldWeC04SW4wcXBFWUxtNEdsVVNTNWViUnJWQ0JkSjI4TGNaRF8zYktCMHNMMlRVdXk2eE96LS1KdmZLVnBzQ0F3RUFBYUJTTUZBR0NTcUdTSWIzRFFFSkRqRkRNRUV3SUFZRFZSMFJCQmt3RjRJVmFXNXNibVZ6WlhCd2QydG1kMlYzZGpJdVkyOXRNQjBHQTFVZERnUVdCQlQycUd6RUQyTlVidkxnSGhsVVlDZXREczJ0N1RBTkJna3Foa2lHOXcwQkFRd0ZBQU9DQWdFQW1hcVNwY1EzYlZBbEZuNUROYkhfNEFWaHdBdVV1VzlpUkNNSkt4TS16aEVUT1hOdElVdWFsLUFlTEdkMkFCQkdHLUJQcmtVUkR6a21BbTlKOWJHcEJ5UzFDV1A4d19XcmdvRTdlcmp4NjUwSGRFc05JTk80dzhHck4zb2VCdFVUV01KaC0wdWNULXRBN20yUGstaWpPN0NRYW90cmZuUUxXY0pPV3JYM3FWU09vZ204dVpRWWlKM0tENTdXSTNmenZHUTdaM2pNSXhQdk45b0xkLVY3S1JmRGdmNXdXaDJYYVNTM2RWRkY5TFJKaTR3X1RRWjk0eDhtLXE4Y1gxMU9ybXliNGVUYmZiZDJ2MkptRVJhWE8zeUs5SkFpV2lrTHdwbzk0MFMxVHUyWm10YWNmLVQ2elp3eFdONG5UMEJob3dkc3duNmdmQkdFUE9URUduVHZDZ2RiUHFScTZBbWQ0R2NKOFNVVjhJRmpXTC1zTG92VzlSc2VJaDY4dzJab0t3NTFua2ZGX3RXdkVxY0RILWtOajdHRHZCc0xaYTIyWnptV3lNTjRTQlJjdjZKX19OcnlidWowODhVVmlyc2JWcnMzMmQzMFVfOG1TbXBqaURqcmw1dFlyTVd1NUp6U3RNalczUEgzY0hTcFdXM1V6VEVpN2JjQVE1N2ZmZW1VRjlaa2FTOWltdHl4eXZYeW8yNTA2NzNjdEh4aUNCbHhXVm9VTGtZTmswZ3NfdDhLWkEyMUkyblhKQzNOT2dKMi1BRWFPaFQ5X3lkekpvMzh0UmR0MkkwSy0zZ1ZqSUxiYXhWZEJuWGU4cnYwRllaSmFyWXhfdHhXa1VtcE1GZ3dTSllNS0tUa2FzZzZJb1N6bURDcXFKb3d0RmpIMWtSUHRHMWdSMjFVNUVJIn0\",\"signature\":\"RQ9ONpJ_ZFH7x2d0KKvEiv_enItUtRUS2tpvpt9tQVSihOOj9x-UVbSpb5QAc8MNzqAYA_vLzVYu3vj7TwMtUaVTthsaKh6-cb_0NZYqmch6JqNrUcl9G8A2zLXKzkQDbgdNWSKhg19c56HtmW4I2R3YLYZ-j9_zV7C6b0UGgIabLv6WU2wjE7teeCIRNCabkM9aQr_PLf-muaScL_xLDkfr8q5d0UeO2UoXkxwyQDOfY3y5QTHD9eyW7PG3iXSKCZCex3RLZt3PKbZJX2o2Ia8R6z8ZO3IDG3Nqs6OMzgn3hdqB1zA4TJ98NRP3p5RcQkGy7BhPaZEKjkynEZDzCA\"}";
+        final String FINALIZE_URL = "/acme/finalize/10/69";
+
+        final String FINALIZE_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T20:20:42Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"inlneseppwkfwewv2.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/47\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/10/69\"," + System.lineSeparator() +
+                "  \"certificate\": \"http://localhost:4001/acme/cert/ff4d6960900116d153bd9079b2ef4ceb686e\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String FINALIZE_REPLAY_NONCE = "zincMfatmlrYZzGRlf2Lob__5LTX8HmpWUDRDcl7nR6e27Y";
+        final String FINALIZE_LOCATION = "http://localhost:4001/acme/order/10/69";
+
+        final String CHECK_ORDER_URL = "/acme/order/10/69";
+        final String CHECK_ORDER_REPLAY_NONCE = "taroYphvMFXUwHY9NvweFKTFO2ZEHkqXXAAFIGgwRq1XUk8";
+
+        final String CHECK_ORDER_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTAiLCJub25jZSI6InppbmNNZmF0bWxyWVp6R1JsZjJMb2JfXzVMVFg4SG1wV1VEUkRjbDduUjZlMjdZIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvb3JkZXIvMTAvNjkifQ\",\"payload\":\"\",\"signature\":\"N2BAMYSzcrwWhEjFkwBcKSqwe2z2C0p8rOIyF3K-roYwUMX-pA4pjA1dEgpn28YmcuL-oQ3r1dVGirf6lP7-ge1jVClLvoe0xMJnt8wtL5-RfM4huwxCf8nJHilXGAIjexU-23U1gqORTNseUEjmq5C0qM4VO-jI1gctmmpBhh1ND34C0LqwvbgBuErJu3i2aTOJeVa9zslvRNv54qQIH44NN4jaJP_rOkIf5Ip3ol9lhUNp9aWhF1cPrxy8dRoV8wB-zrSidqZcyrdW5S-kBpTU54xQNyerKWJuSBxYMlWWqwwJTxJIDULf3sOBUMIdHITHnD0NVmXA9Hyt4Qi_hQ\"}";
+        final String CHECK_ORDER_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T20:20:42Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"inlneseppwkfwewv2.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/47\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/10/69\"," + System.lineSeparator() +
+                "  \"certificate\": \"http://localhost:4001/acme/cert/ff4d6960900116d153bd9079b2ef4ceb686e\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String CERT_URL = "/acme/cert/ff4d6960900116d153bd9079b2ef4ceb686e";
+        final String CERT_REPLAY_NONCE = "zincKaLFWirFsBTqH1JdVRy2kiSYehDe_Jl_POZcX9Oio2o";
+
+        final String CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTAiLCJub25jZSI6InRhcm9ZcGh2TUZYVXdIWTlOdndlRktURk8yWkVIa3FYWEFBRklHZ3dScTFYVWs4IiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvY2VydC9mZjRkNjk2MDkwMDExNmQxNTNiZDkwNzliMmVmNGNlYjY4NmUifQ\",\"payload\":\"\",\"signature\":\"Ba_xGjJri5ZxNyav1uTH7TPgmzrtCNwwYcVUUn7TX4lhWKPUjYM0QDqUnbDMjt34rY1xe3apIoH4xvLCwaQ-R90ad8sXYr0nBVwRTUPFY0ytDQAFBfwUMLRJ61d8PXZOXp3TNJ6QE-OzgONGDXaw1P2MUvbXbacA5ePsi3_D50fi9RVJGO88Znj-GmgmRm7nP1QlN2Ce-puNt1FoQhM3KFBslnDc5gQPPG1iV7QXyx7o8driUeqY5x87oOXjUfDjzw1LjNEh4ULAGXBeRwZ7jTJSqVYQHh_bnC3nkMxoBRq9sJGoVoNlwhy_d4pavYzUe1oreb1HVeEePicg-PKZ4w\"}";
+        final String CERT_RESPONSE_BODY = "-----BEGIN CERTIFICATE-----" + System.lineSeparator() +
+                "MIIGSjCCBTKgAwIBAgITAP9NaWCQARbRU72QebLvTOtobjANBgkqhkiG9w0BAQsF" + System.lineSeparator() +
+                "ADAfMR0wGwYDVQQDDBRoMnBweSBoMmNrZXIgZmFrZSBDQTAeFw0xOTA3MTYxOTIw" + System.lineSeparator() +
+                "NDNaFw0xOTEwMTQxOTIwNDNaMCAxHjAcBgNVBAMTFWlubG5lc2VwcHdrZndld3Yy" + System.lineSeparator() +
+                "LmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKXNOkW60Q9b3MwQ" + System.lineSeparator() +
+                "suX8YbrEiOzvqM9ld8KMOQx7gHu4cPt2V+7h5jqJjj8kfg++JDeBoqwkiIk6TBQ/" + System.lineSeparator() +
+                "haixBsQZsTtuu7iKDb+ieZHciDhHNiMRVma7ayy1cHBsfkPXWqn1NYvKp19ZbxQt" + System.lineSeparator() +
+                "rgvFWc/TMUgtFqHOt8BOQRa1AdTiONXfR+WaWl0B4PnFZIqVVwrzGxFb7tFCehMs" + System.lineSeparator() +
+                "viP40R18Aal6sWJHJta5zQAECybLu3vK0qx1hjAyPrPnvitm57k34MzyCX2Av4sc" + System.lineSeparator() +
+                "3gh1ksoAXscEk8BP/PvAG7yWfgXnH/4L7kQZ+i5F/0HUcIBHMsGRUVnZFKNKLd5U" + System.lineSeparator() +
+                "JUMpMeVdWIGO2rPoQAn40brXhz90MtuDJCW6fv5PvAuGboXUwmX+kYRHbtIxeP/Z" + System.lineSeparator() +
+                "1ykRxURDXVN3vJoQg7T3Zz1MUIVY9le34Fx1nS3vLLiXfvWRdCbyY0EVOBplzY+i" + System.lineSeparator() +
+                "4sMAmdD432CP34/li1CVJPtbkXzNT+IwzXAjK+vS7l4ShOaG0Grg/S4fP9r5D8Zo" + System.lineSeparator() +
+                "CO/DkOyOsTmzWIetx2z6Ys0WKi/qp8B8Nqzfbr8ipUicc+aClGzjuxpKcZv0gIfH" + System.lineSeparator() +
+                "4J/d15ug3WC5zLHWBrWiSeIA6YkFCjVlcfvCJ9KqRGC5uBpVEkuXm0a1QgXSdvC3" + System.lineSeparator() +
+                "GQ/92ygdLC9k1LsusTs/vib3ylabAgMBAAGjggJ8MIICeDAOBgNVHQ8BAf8EBAMC" + System.lineSeparator() +
+                "BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAw" + System.lineSeparator() +
+                "HQYDVR0OBBYEFPaobMQPY1Ru8uAeGVRgJ60Oza3tMB8GA1UdIwQYMBaAFPt4TxL5" + System.lineSeparator() +
+                "YBWDLJ8XfzQZsy426kGJMGQGCCsGAQUFBwEBBFgwVjAiBggrBgEFBQcwAYYWaHR0" + System.lineSeparator() +
+                "cDovLzEyNy4wLjAuMTo0MDAyLzAwBggrBgEFBQcwAoYkaHR0cDovL2JvdWxkZXI6" + System.lineSeparator() +
+                "NDQzMC9hY21lL2lzc3Vlci1jZXJ0MCAGA1UdEQQZMBeCFWlubG5lc2VwcHdrZndl" + System.lineSeparator() +
+                "d3YyLmNvbTAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8vZXhhbXBsZS5jb20vY3Js" + System.lineSeparator() +
+                "MEAGA1UdIAQ5MDcwCAYGZ4EMAQIBMCsGAyoDBDAkMCIGCCsGAQUFBwIBFhZodHRw" + System.lineSeparator() +
+                "Oi8vZXhhbXBsZS5jb20vY3BzMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUA3Zk0" + System.lineSeparator() +
+                "/KXnJIDJVmh9gTSZCEmySfe1adjHvKs/XMHzbmQAAAFr/HHFxQAABAMARjBEAiAX" + System.lineSeparator() +
+                "5d7ffdn8ctWiJWoPxYtGOwG5yaiqTpHSaiBagPd2xQIgGi68uA+M6MHf80Ko0rgk" + System.lineSeparator() +
+                "Mtp5dkS7p9C8R11o2WCdnBsAdwAW6GnB0ZXq18P4lxrj8HYB94zhtp0xqFIYtoN/" + System.lineSeparator() +
+                "MagVCAAAAWv8ccXFAAAEAwBIMEYCIQD/+kWwYf5pRIKjg5j2VcvUY9IOsKaem/wX" + System.lineSeparator() +
+                "1C/GFU9+VQIhAOHY9SmknOkqMl8HwEYGeD7uksNwTBMzi19Hqowh4s55MA0GCSqG" + System.lineSeparator() +
+                "SIb3DQEBCwUAA4IBAQAS1xht2BdputK1iEdEPG6357zcv5F65aBSOdqIc5WeEoa1" + System.lineSeparator() +
+                "Jx06Wyc+5dQH65iCRF7qXQGb9gP0Bwi6JrfouQMQwjNjERg20CfqfLZdJqeUR+SO" + System.lineSeparator() +
+                "wTZTqVrTQsdKPGUeGrdusC7gHMyvFagqf4J/gonHZvlI3FdGOEP3MiyHeQlsALRW" + System.lineSeparator() +
+                "6WAX3okXEEm91chmdXuU3TRN/ZRNumU6z1J4RHYCW405qxKQWQB8NUIADBSVfm7x" + System.lineSeparator() +
+                "J8KlZBgRH37R1FbIWHmD5W83cTEYRxPeYfS0HGel0wuPnt/JmbJzMcEeh75tDsRI" + System.lineSeparator() +
+                "w/XRgmIMfizJa4LJLcXnUE+9ccraCB/quPldjjEN" + System.lineSeparator() +
+                "-----END CERTIFICATE-----" + System.lineSeparator() +
+                "" + System.lineSeparator() +
+                "-----BEGIN CERTIFICATE-----" + System.lineSeparator() +
+                "MIIERTCCAy2gAwIBAgICElowDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgY2Fj" + System.lineSeparator() +
+                "a2xpbmcgY3J5cHRvZ3JhcGhlciBmYWtlIFJPT1QwHhcNMTYwMzIyMDI0NzUyWhcN" + System.lineSeparator() +
+                "MjEwMzIxMDI0NzUyWjAfMR0wGwYDVQQDDBRoMnBweSBoMmNrZXIgZmFrZSBDQTCC" + System.lineSeparator() +
+                "ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMIKR3maBcUSsncXYzQT13D5" + System.lineSeparator() +
+                "Nr+Z3mLxMMh3TUdt6sACmqbJ0btRlgXfMtNLM2OU1I6a3Ju+tIZSdn2v21JBwvxU" + System.lineSeparator() +
+                "zpZQ4zy2cimIiMQDZCQHJwzC9GZn8HaW091iz9H0Go3A7WDXwYNmsdLNRi00o14U" + System.lineSeparator() +
+                "joaVqaPsYrZWvRKaIRqaU0hHmS0AWwQSvN/93iMIXuyiwywmkwKbWnnxCQ/gsctK" + System.lineSeparator() +
+                "FUtcNrwEx9Wgj6KlhwDTyI1QWSBbxVYNyUgPFzKxrSmwMO0yNff7ho+QT9x5+Y/7" + System.lineSeparator() +
+                "XE59S4Mc4ZXxcXKew/gSlN9U5mvT+D2BhDtkCupdfsZNCQWp27A+b/DmrFI9NqsC" + System.lineSeparator() +
+                "AwEAAaOCAX0wggF5MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGG" + System.lineSeparator() +
+                "MH8GCCsGAQUFBwEBBHMwcTAyBggrBgEFBQcwAYYmaHR0cDovL2lzcmcudHJ1c3Rp" + System.lineSeparator() +
+                "ZC5vY3NwLmlkZW50cnVzdC5jb20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9hcHBzLmlk" + System.lineSeparator() +
+                "ZW50cnVzdC5jb20vcm9vdHMvZHN0cm9vdGNheDMucDdjMB8GA1UdIwQYMBaAFOmk" + System.lineSeparator() +
+                "P+6epeby1dd5YDyTpi4kjpeqMFQGA1UdIARNMEswCAYGZ4EMAQIBMD8GCysGAQQB" + System.lineSeparator() +
+                "gt8TAQEBMDAwLgYIKwYBBQUHAgEWImh0dHA6Ly9jcHMucm9vdC14MS5sZXRzZW5j" + System.lineSeparator() +
+                "cnlwdC5vcmcwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5pZGVudHJ1c3Qu" + System.lineSeparator() +
+                "Y29tL0RTVFJPT1RDQVgzQ1JMLmNybDAdBgNVHQ4EFgQU+3hPEvlgFYMsnxd/NBmz" + System.lineSeparator() +
+                "LjbqQYkwDQYJKoZIhvcNAQELBQADggEBAKvePfYXBaAcYca2e0WwkswwJ7lLU/i3" + System.lineSeparator() +
+                "GIFM8tErKThNf3gD3KdCtDZ45XomOsgdRv8oxYTvQpBGTclYRAqLsO9t/LgGxeSB" + System.lineSeparator() +
+                "jzwY7Ytdwwj8lviEGtiun06sJxRvvBU+l9uTs3DKBxWKZ/YRf4+6wq/vERrShpEC" + System.lineSeparator() +
+                "KuQ5+NgMcStQY7dywrsd6x1p3bkOvowbDlaRwru7QCIXTBSb8TepKqCqRzr6YREt" + System.lineSeparator() +
+                "doIw2FE8MKMCGR2p+U3slhxfLTh13MuqIOvTuA145S/qf6xCkRc9I92GpjoQk87Z" + System.lineSeparator() +
+                "v1uhpkgT9uwbRw0Cs5DMdxT/LgIUSfUTKU83GNrbrQNYinkJ77i6wG0=" + System.lineSeparator() +
+                "-----END CERTIFICATE-----" + System.lineSeparator();
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY_1, QUERY_ACCT_RESPONSE_BODY_1, QUERY_ACCT_REPLAY_NONCE_1, ACCT_LOCATION, 200)
+                .updateAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY_2, QUERY_ACCT_RESPONSE_BODY_2, QUERY_ACCT_REPLAY_NONCE_2, ACCT_PATH, 200)
+                .orderCertificateRequestAndResponse(ORDER_CERT_REQUEST_BODY, ORDER_CERT_RESPONSE_BODY, ORDER_CERT_REPLAY_NONCE, ORDER_LOCATION, 201, false)
+                .addAuthorizationResponseBody(AUTHZ_URL, AUTHZ_REQUEST_BODY, AUTHZ_RESPONSE_BODY, AUTHZ_REPLAY_NONCE)
+                .addChallengeRequestAndResponse(CHALLENGE_REQUEST_BODY, CHALLENGE_URL, CHALLENGE_RESPONSE_BODY, CHALLENGE_REPLAY_NONCE, CHALLENGE_LOCATION, CHALLENGE_LINK, 200, false, VERIFY_CHALLENGE_URL, CHALLENGE_FILE_CONTENTS, AUTHZ_URL, UPDATED_AUTHZ_RESPONSE_BODY, UPDATED_AUTHZ_REPLAY_NONCE)
+                .addFinalizeRequestAndResponse(FINALIZE_RESPONSE_BODY, FINALIZE_REPLAY_NONCE, FINALIZE_URL, FINALIZE_LOCATION, 200)
+                .addCheckOrderRequestAndResponse(CHECK_ORDER_URL, CHECK_ORDER_REQUEST_BODY, CHECK_ORDER_RESPONSE_BODY, CHECK_ORDER_REPLAY_NONCE, 200)
+                .addCertificateRequestAndResponse(CERT_URL, CERT_REQUEST_BODY, CERT_RESPONSE_BODY, CERT_REPLAY_NONCE, 200)
+                .build();
+    }
+
+    private ClientAndServer setupTestObtainCertificateWithECPublicKey() {
+        // set up a mock Let's Encrypt server
+        final String ACCT_PATH = "/acme/acct/18";
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"9DRXKSMFUn0\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "taroFCThaeLOJydoXXRny52fFmFvcqyS_JMmIJr66Zqp2JU";
+
+        final String QUERY_ACCT_REQUEST_BODY_1 = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJxTjcwc2VsZEVrVTlKV0RMUkNibkp2QWo2WWs3UnV4QktUV0dNLTZaMUxsQlpXV1A1OGthbWU5cDA1THFLa05rdC1Yakc3Wkt5T1FQUXZ4cU5oRURKLTNpck93V0NzWi1BRk5aYU5BMlFoZ0dRYnB2MkRkRDIzMWdqVUZRT3dlS2pLdlhDdUg1TFlxVjVObUx0TFBNbjBsTFpFX21NVlB3dnhLTV9FLTBjRFhqeDZzTU9BbWtvVWkzWGRaOU0tUUNNc1BxTUhnbUt1T2xCUnVXdmRJNVRDaUcyemNXMFo2T0Y5T0lybVhoWTBFeVNDTjc3RkJ2dkJNN2NsYkNiN1gxS0ZGLVNpUDQ3a013VlNyR2h1eER6dVpzaU4wOThxT3IwVG8yd1BzQ2V5SzZwT3ZST3VwQi1ZX01yXy1QRjl5dnE5bXkzLVBXeVAtcnB3T09XVWZYZXcifSwibm9uY2UiOiJ0YXJvRkNUaGFlTE9KeWRvWFhSbnk1MmZGbUZ2Y3F5U19KTW1JSnI2NlpxcDJKVSIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6dHJ1ZSwiY29udGFjdCI6WyJtYWlsdG86YWRtaW5AbXlleGFtcGxlLmNvbSJdfQ\",\"signature\":\"YhNeycG9CwuJvGeN61TqI5d88SWif9AFl2zPx2tqQAdvn9fck8Kw4aixTgdu_JWprONuL-H3hDidOhVfkrWa-KQgVbK4jeOkyoIf2tzAFvXPDpa-cMqF6b6G9HwULfPxeLlLnhMLt94sgXzRFm5f00VgXNHgER8-PVI6Zf2x7oHBZvyfY663ZUuSkMPAFitRa4s6hGJj1FNlx5v82f_3tcVB331YlWPv_SldGeelPFjx9puuVgaReqVPHLmfAgdUbYbNTXT2Y4liuXYGS3NZJUKc_qzYlBzgO83cNepHeEaJ3xY1G3xKdQ1C7m9axRduJigTug1LxHocZbg6WxuH5g\"}";
+
+
+        final String QUERY_ACCT_RESPONSE_BODY_1= "";
+
+        final String QUERY_ACCT_REPLAY_NONCE_1 = "zincyZi3eMnAoR1uc1k8yxj7xpiOAPRMhwSQ4IM-hQQ1dAc";
+
+        final String QUERY_ACCT_REQUEST_BODY_2 = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InppbmN5WmkzZU1uQW9SMXVjMWs4eXhqN3hwaU9BUFJNaHdTUTRJTS1oUVExZEFjIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvYWNjdC8xOCJ9\",\"payload\":\"eyJ0ZXJtc09mU2VydmljZUFncmVlZCI6dHJ1ZSwiY29udGFjdCI6WyJtYWlsdG86YWRtaW5AbXlleGFtcGxlLmNvbSJdfQ\",\"signature\":\"OjzGOzYKnNt0nLc8qY4VMzafwFmR-ywSRxEinsAbLzpulASz0xfTBxpidvR0xGx72g0hiLX7G3YAkmPcURtSMl61RVaTQRFZPjTQ12VkctB25QceQyiZQK0Am5B4AbIS6wv0ThV39JXqEASu7mVPERFkbKBiOEnvseASzyYfrnkWVur7z_YWSPCMqG0mtQ31YMRMxzXf8d9JQSnojzKRbBp6YiAyMYOIt4FiA10UMdWmPud5jojw5wKfXpmcJe2yz5cojN247XXNlz1ObkeA12b34M7NlcaRXv9H_ITGeR2cXbrv0TKVN8zkObqZNJjswE6Wl5DdqCWZz14N_Il0ZQ\"}";
+
+        final String QUERY_ACCT_RESPONSE_BODY_2= "";
+
+        final String QUERY_ACCT_REPLAY_NONCE_2 = "tarofVbsbXN3xs8rOEaBjoQn9FmZ7nSiAAChR1qMsvOADyA";
+        final String ACCT_LOCATION = "http://localhost:4001/acme/acct/18";
+
+
+        final String ORDER_CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InRhcm9mVmJzYlhOM3hzOHJPRWFCam9RbjlGbVo3blNpQUFDaFIxcU1zdk9BRHlBIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvbmV3LW9yZGVyIn0\",\"payload\":\"eyJpZGVudGlmaWVycyI6W3sidHlwZSI6ImRucyIsInZhbHVlIjoibW5kZWxrZG5iY2lsb2hndjIuY29tIn1dfQ\",\"signature\":\"gKs76q7TeUcXauHv8Hzky-mKP3BRrmjbjtsbY89_S46jAmSAd2Vs8lwR1KjuuEngROkKbsmVMRqRq-DrCnUzFxPhZVm5yfuqRgLYphaZXeffSABoR1iqyxvVYC0RkqoBLjkj8u8Ttbzq9I8H_-kGkdXyVbR35I9c0oK8gre40u0LtjtMY7Eiw89tA2r0YPnvldv-Osf3ocwlANHlV-W-tCrqxQuTI_MY78MLHyguWFdB8-wMEjbLle6HDNStGFJsidLmDh3qkvukTRyOwRuXiA9ER41oWeDFdzeHTTQnwn9kxvo8gmFX_FPL2b5HdwvEh7ebV0aOb_wnZ_aHQxKVCQ\"}";
+
+        final String ORDER_CERT_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T19:57:55.887357634Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"mndelkdnbcilohgv2.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/46\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/18/68\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String ORDER_CERT_REPLAY_NONCE = "zincEh5_TsAbCPq_V2N78rG3_dUxcZnA6ISd3UBdGC3LN2E";
+        final String ORDER_LOCATION = "http://localhost:4001/acme/order/18/68";
+
+        final String AUTHZ_URL = "/acme/authz/v2/46";
+        final String AUTHZ_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InppbmNFaDVfVHNBYkNQcV9WMk43OHJHM19kVXhjWm5BNklTZDNVQmRHQzNMTjJFIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvYXV0aHovdjIvNDYifQ\",\"payload\":\"\",\"signature\":\"MAVAt8kSDWcy6rZRLz5ClGgXmLSTCRY5V0dhrDnA-3DMdnQyTnFI8NnmuxVBVpCLN1Sse2YGn1yrHp5I6L83Ob90OvCiWMZCi0or1hqxrmDErVE4q-BOKdV6sbrgejwNsDSkdtDaGSvGR8qSBeqFV6VWvny395qXY6ASzpkXgyeSXFGEQ-tlPW_CTAaHS7Eo_IKHQ8puJeOqxhUkgseQogtkC2ExddOnAiZq9M__SV6jysxJmqn-4vNdBmFJtq2F0aHrbWdf-9zUWnrxtgUPP-WvWCfUtejS5CcjDv8kcnvOumKm64b8eHMoGtPSxuGfZ_K1Qoh605KuiwD5lfaSkQ\"}";
+        final String AUTHZ_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"identifier\": {" + System.lineSeparator() +
+                "    \"type\": \"dns\"," + System.lineSeparator() +
+                "    \"value\": \"mndelkdnbcilohgv2.com\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T19:57:55Z\"," + System.lineSeparator() +
+                "  \"challenges\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"http-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/46/1EAfog\"," + System.lineSeparator() +
+                "      \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/46/OHt9Vw\"," + System.lineSeparator() +
+                "      \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"tls-alpn-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/46/WXhsUg\"," + System.lineSeparator() +
+                "      \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String AUTHZ_REPLAY_NONCE = "taroi1V-ebsk9OogUGWzggfhZzPb_caysV4CnnQ4OdjClZ0";
+
+        final String CHALLENGE_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InRhcm9pMVYtZWJzazlPb2dVR1d6Z2dmaFp6UGJfY2F5c1Y0Q25uUTRPZGpDbFowIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvY2hhbGxlbmdlL3YyLzQ2LzFFQWZvZyJ9\",\"payload\":\"e30\",\"signature\":\"XAvtgCZ15XD37k4syk2smvoIoFm-WeXgqnKr74_L8W-AYou4roOQCRAMPE7rmboEFB4ZILxrec__6GN9OS99tdQ9o4T1CLgkwuZUDQFXFBI98tOKF_sjtTrVNQnMitmN2noAWxFBdl-6Mt_FO5tt8l2HG7TGPxriJe2oPDxoMBZszHGzz5GFYEhVcwpTiDWlri3ggXiHQyEWnei-TmO_O5p5a6hJm-TNEziyWDCvmlupRpwDyv9ANJccsrVg6OYVW3jQ1rDscAPqIILQr8EhzA4QyZw9FhrfgGJdn6ru1Wwl86Y8SfTojIq3wKmcac5c3iXBeIKkkq9clGONJpiNwQ\"}";
+        final String CHALLENGE_URL = "/acme/challenge/v2/46/1EAfog";
+
+        final String CHALLENGE_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"type\": \"http-01\"," + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"url\": \"http://localhost:4001/acme/challenge/v2/46/1EAfog\"," + System.lineSeparator() +
+                "  \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String CHALLENGE_REPLAY_NONCE = "zincA0YMk-y4X0yRFWdOVUMHoGsfBE6qgdMPYPcX9-Q-zY4";
+        final String CHALLENGE_LOCATION = "http://localhost:4001/acme/challenge/v2/46/1EAfog";
+        final String CHALLENGE_LINK = "<http://localhost:4001/acme/authz/v2/46>;rel=\"up\"";
+        final String VERIFY_CHALLENGE_URL = "/.well-known/acme-challenge/6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY";
+        final String CHALLENGE_FILE_CONTENTS = "6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY.2NVC_ENUU-TZ83gkUxQvXl7_ixvttxk_dPlNqIyXGKY";
+
+        final String UPDATED_AUTHZ_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"identifier\": {" + System.lineSeparator() +
+                "    \"type\": \"dns\"," + System.lineSeparator() +
+                "    \"value\": \"mndelkdnbcilohgv2.com\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-08-22T19:57:55Z\"," + System.lineSeparator() +
+                "  \"challenges\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"http-01\"," + System.lineSeparator() +
+                "      \"status\": \"valid\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/46/1EAfog\"," + System.lineSeparator() +
+                "      \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"," + System.lineSeparator() +
+                "      \"validationRecord\": [" + System.lineSeparator() +
+                "        {" + System.lineSeparator() +
+                "          \"url\": \"http://mndelkdnbcilohgv2.com/.well-known/acme-challenge/6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"," + System.lineSeparator() +
+                "          \"hostname\": \"mndelkdnbcilohgv2.com\"," + System.lineSeparator() +
+                "          \"port\": \"5002\"," + System.lineSeparator() +
+                "          \"addressesResolved\": [" + System.lineSeparator() +
+                "            \"172.17.0.1\"" + System.lineSeparator() +
+                "          ]," + System.lineSeparator() +
+                "          \"addressUsed\": \"172.17.0.1\"" + System.lineSeparator() +
+                "        }" + System.lineSeparator() +
+                "      ]" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/46/OHt9Vw\"," + System.lineSeparator() +
+                "      \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"tls-alpn-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/46/WXhsUg\"," + System.lineSeparator() +
+                "      \"token\": \"6PAmWU2m3sPP7Lqfz2NAlpztc-Qqw3o9rTbQtrFUrdY\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String UPDATED_AUTHZ_REPLAY_NONCE = "taro_CYDgtDCXgc4gmxsCnwXERad3qCJ6bOEG3ZKVdqMKCQ";
+
+        final String FINALIZE_URL = "/acme/finalize/18/68";
+
+        final String FINALIZE_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T19:57:55Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"mndelkdnbcilohgv2.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/46\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/18/68\"," + System.lineSeparator() +
+                "  \"certificate\": \"http://localhost:4001/acme/cert/ff1093811c2dca68b305c777d1d6b058cb14\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String FINALIZE_REPLAY_NONCE = "zinclJZorHeTFZcnqLLeS1ZgNtVjKLFXeA-sZDk6Od996nI";
+        final String FINALIZE_LOCATION = "http://localhost:4001/acme/order/18/68";
+
+        final String CHECK_ORDER_URL = "/acme/order/18/68";
+        final String CHECK_ORDER_REPLAY_NONCE = "taroRCnVpN7wg7EQvwrBvKkNUdyXISuSwN1_Y1huVn4IQOo";
+
+        final String CHECK_ORDER_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InppbmNsSlpvckhlVEZaY25xTExlUzFaZ050VmpLTEZYZUEtc1pEazZPZDk5Nm5JIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvb3JkZXIvMTgvNjgifQ\",\"payload\":\"\",\"signature\":\"arc3WgxoV-CTvgMRboJhSQmNTNNE6NAHGdPkB6Io3j3fqPSqqyYtAKTKa0fTBhNS2uS7Vh5FOYPPG-11T9f-_asncxD0C43MYX-mWHtvCH_SmhXTyB2rm4kiWoRVjYHuffDgOrauPvmk4WbUY64sq7-7TSUpfDD9Ds6ll8ZDysA-7yG4UZjnGLgN4r-14uyWiSS4PQJYFLdzDsTnmLMjKL09uuC3hW3Sc-T3x8yQ9ONY6wstpyHbLVGL9ZikRpDf4ZWUJDXg-apngRHVwF7eUXAD6nNsERdnF7qBHll-51ItH-LKzfgXu7H9q-I8d1y3RNMx-lqvIuAmi5K2_FmkiQ\"}";
+        final String CHECK_ORDER_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-23T19:57:55Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"mndelkdnbcilohgv2.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/46\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/18/68\"," + System.lineSeparator() +
+                "  \"certificate\": \"http://localhost:4001/acme/cert/ff1093811c2dca68b305c777d1d6b058cb14\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String CERT_URL = "/acme/cert/ff1093811c2dca68b305c777d1d6b058cb14";
+        final String CERT_REPLAY_NONCE = "zinctQYf_mnOJoVGDbAM1CdUSVnq_1X0yixRU_nAWuCrZkU";
+
+        final String CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InRhcm9SQ25WcE43d2c3RVF2d3JCdktrTlVkeVhJU3VTd04xX1kxaHVWbjRJUU9vIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvY2VydC9mZjEwOTM4MTFjMmRjYTY4YjMwNWM3NzdkMWQ2YjA1OGNiMTQifQ\",\"payload\":\"\",\"signature\":\"BY_MtgoIMBOVgh34tkd8qMAWehaC3_II8ghIdkuXVTLqMETipZ97c0uD5zDJGw4BVStxnYvGHgdwk1aOSz8y5-i8IhbFS1dZYOgscaZp5V57VXIvar5t4mKklevafg9Vj3O2fNg5NKdGaJEn7ZgHutGcEyJrqEWqUq4nfYAn5dUZeABrfpxjzR4nksLSQjCdzZcmOHT-OYgb5UiI-IjCJcsZlBcIV_Y9oGKUDJ_BMg7sYS-NIQ7EatToVvY6NasB0gFPJ95vz_oz0cTRU439VCHF7u-YowXO2cXF9M8kak5Oaept8QFQFRBKDODqEIzLjBcP1Um6_ybPO0sLiJG4uw\"}";
+        final String CERT_RESPONSE_BODY = "-----BEGIN CERTIFICATE-----" + System.lineSeparator() +
+                "MIIEoTCCA4mgAwIBAgITAP8Qk4EcLcposwXHd9HWsFjLFDANBgkqhkiG9w0BAQsF" + System.lineSeparator() +
+                "ADAfMR0wGwYDVQQDDBRoMnBweSBoMmNrZXIgZmFrZSBDQTAeFw0xOTA3MTYxODU3" + System.lineSeparator() +
+                "NTZaFw0xOTEwMTQxODU3NTZaMCAxHjAcBgNVBAMTFW1uZGVsa2RuYmNpbG9oZ3Yy" + System.lineSeparator() +
+                "LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNWdSNeeqVApfg5V6xDRpqac" + System.lineSeparator() +
+                "CeW/MR8M8aaMAy37FLeVHewJ9+N/Lk6iov3/lNp6hTuzoljFZTD3/bD3+RVTkAKj" + System.lineSeparator() +
+                "ggKeMIICmjAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG" + System.lineSeparator() +
+                "AQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFLUOwBDYB0/t83fH65E9+EhK" + System.lineSeparator() +
+                "c+e4MB8GA1UdIwQYMBaAFPt4TxL5YBWDLJ8XfzQZsy426kGJMGYGCCsGAQUFBwEB" + System.lineSeparator() +
+                "BFowWDAiBggrBgEFBQcwAYYWaHR0cDovLzEyNy4wLjAuMTo0MDAyLzAyBggrBgEF" + System.lineSeparator() +
+                "BQcwAoYmaHR0cDovLzEyNy4wLjAuMTo0MDAwL2FjbWUvaXNzdWVyLWNlcnQwIAYD" + System.lineSeparator() +
+                "VR0RBBkwF4IVbW5kZWxrZG5iY2lsb2hndjIuY29tMCcGA1UdHwQgMB4wHKAaoBiG" + System.lineSeparator() +
+                "Fmh0dHA6Ly9leGFtcGxlLmNvbS9jcmwwYQYDVR0gBFowWDAIBgZngQwBAgEwTAYD" + System.lineSeparator() +
+                "KgMEMEUwIgYIKwYBBQUHAgEWFmh0dHA6Ly9leGFtcGxlLmNvbS9jcHMwHwYIKwYB" + System.lineSeparator() +
+                "BQUHAgIwEwwRRG8gV2hhdCBUaG91IFdpbHQwggEDBgorBgEEAdZ5AgQCBIH0BIHx" + System.lineSeparator() +
+                "AO8AdQDdmTT8peckgMlWaH2BNJkISbJJ97Vp2Me8qz9cwfNuZAAAAWv8XOpXAAAE" + System.lineSeparator() +
+                "AwBGMEQCID2B0PeB+cxwEuSIr0xakdkDi4zStQffSeXwy5Xi2z3XAiA9b2uo0QJu" + System.lineSeparator() +
+                "W/rZoKjPxO53Q7LclMQYnHucagWfy7irXwB2ABboacHRlerXw/iXGuPwdgH3jOG2" + System.lineSeparator() +
+                "nTGoUhi2g38xqBUIAAABa/xc6lYAAAQDAEcwRQIhAOdHz0WsKkHx9La5p6A4nfGP" + System.lineSeparator() +
+                "HpeOvcNss3feW8qXvGKbAiAleyPIvJjZlXGMR/H5doyiG/uuJ3QLpGnzXH7tegx2" + System.lineSeparator() +
+                "hjANBgkqhkiG9w0BAQsFAAOCAQEAJv2VRPTuDr73+G0aWZMgTSIyCfSutstBRf4S" + System.lineSeparator() +
+                "skZy5OBdtvCJ+KZ//4aO8GzBLIK2oO15zb6J0LzGLBN8fh44zBEXyB82xV77xZsU" + System.lineSeparator() +
+                "h3iXHVr/xJryq5vfxKLQdmSOxljZqIUb1ewk6z0lgVSCkSCysRYFFCO6FUVtCQtL" + System.lineSeparator() +
+                "6QvB8fdtnIP0badkB5N2QJzJ7wqxi2J6HPVhEiCTRHzKjK1d5z8daaVQjd1XU4+x" + System.lineSeparator() +
+                "GgpK++cGcpLrkQ8uCXGfIHz78wnnLxco19K6F41D1zGlevAAaHiG++NafW3/kJIN" + System.lineSeparator() +
+                "hk6FdLvhm+dFuaXMBzFr9sSzXQo9tsady2/VwR55xlTaXeD31w==" + System.lineSeparator() +
+                "-----END CERTIFICATE-----" + System.lineSeparator() +
+                "" + System.lineSeparator() +
+                "-----BEGIN CERTIFICATE-----" + System.lineSeparator() +
+                "MIIERTCCAy2gAwIBAgICElowDQYJKoZIhvcNAQELBQAwKzEpMCcGA1UEAwwgY2Fj" + System.lineSeparator() +
+                "a2xpbmcgY3J5cHRvZ3JhcGhlciBmYWtlIFJPT1QwHhcNMTYwMzIyMDI0NzUyWhcN" + System.lineSeparator() +
+                "MjEwMzIxMDI0NzUyWjAfMR0wGwYDVQQDDBRoMnBweSBoMmNrZXIgZmFrZSBDQTCC" + System.lineSeparator() +
+                "ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMIKR3maBcUSsncXYzQT13D5" + System.lineSeparator() +
+                "Nr+Z3mLxMMh3TUdt6sACmqbJ0btRlgXfMtNLM2OU1I6a3Ju+tIZSdn2v21JBwvxU" + System.lineSeparator() +
+                "zpZQ4zy2cimIiMQDZCQHJwzC9GZn8HaW091iz9H0Go3A7WDXwYNmsdLNRi00o14U" + System.lineSeparator() +
+                "joaVqaPsYrZWvRKaIRqaU0hHmS0AWwQSvN/93iMIXuyiwywmkwKbWnnxCQ/gsctK" + System.lineSeparator() +
+                "FUtcNrwEx9Wgj6KlhwDTyI1QWSBbxVYNyUgPFzKxrSmwMO0yNff7ho+QT9x5+Y/7" + System.lineSeparator() +
+                "XE59S4Mc4ZXxcXKew/gSlN9U5mvT+D2BhDtkCupdfsZNCQWp27A+b/DmrFI9NqsC" + System.lineSeparator() +
+                "AwEAAaOCAX0wggF5MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGG" + System.lineSeparator() +
+                "MH8GCCsGAQUFBwEBBHMwcTAyBggrBgEFBQcwAYYmaHR0cDovL2lzcmcudHJ1c3Rp" + System.lineSeparator() +
+                "ZC5vY3NwLmlkZW50cnVzdC5jb20wOwYIKwYBBQUHMAKGL2h0dHA6Ly9hcHBzLmlk" + System.lineSeparator() +
+                "ZW50cnVzdC5jb20vcm9vdHMvZHN0cm9vdGNheDMucDdjMB8GA1UdIwQYMBaAFOmk" + System.lineSeparator() +
+                "P+6epeby1dd5YDyTpi4kjpeqMFQGA1UdIARNMEswCAYGZ4EMAQIBMD8GCysGAQQB" + System.lineSeparator() +
+                "gt8TAQEBMDAwLgYIKwYBBQUHAgEWImh0dHA6Ly9jcHMucm9vdC14MS5sZXRzZW5j" + System.lineSeparator() +
+                "cnlwdC5vcmcwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5pZGVudHJ1c3Qu" + System.lineSeparator() +
+                "Y29tL0RTVFJPT1RDQVgzQ1JMLmNybDAdBgNVHQ4EFgQU+3hPEvlgFYMsnxd/NBmz" + System.lineSeparator() +
+                "LjbqQYkwDQYJKoZIhvcNAQELBQADggEBAKvePfYXBaAcYca2e0WwkswwJ7lLU/i3" + System.lineSeparator() +
+                "GIFM8tErKThNf3gD3KdCtDZ45XomOsgdRv8oxYTvQpBGTclYRAqLsO9t/LgGxeSB" + System.lineSeparator() +
+                "jzwY7Ytdwwj8lviEGtiun06sJxRvvBU+l9uTs3DKBxWKZ/YRf4+6wq/vERrShpEC" + System.lineSeparator() +
+                "KuQ5+NgMcStQY7dywrsd6x1p3bkOvowbDlaRwru7QCIXTBSb8TepKqCqRzr6YREt" + System.lineSeparator() +
+                "doIw2FE8MKMCGR2p+U3slhxfLTh13MuqIOvTuA145S/qf6xCkRc9I92GpjoQk87Z" + System.lineSeparator() +
+                "v1uhpkgT9uwbRw0Cs5DMdxT/LgIUSfUTKU83GNrbrQNYinkJ77i6wG0=" + System.lineSeparator() +
+                "-----END CERTIFICATE-----" + System.lineSeparator() + System.lineSeparator();
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY_1, QUERY_ACCT_RESPONSE_BODY_1, QUERY_ACCT_REPLAY_NONCE_1, ACCT_LOCATION, 200)
+                .updateAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY_2, QUERY_ACCT_RESPONSE_BODY_2, QUERY_ACCT_REPLAY_NONCE_2, ACCT_PATH, 200)
+                .orderCertificateRequestAndResponse(ORDER_CERT_REQUEST_BODY, ORDER_CERT_RESPONSE_BODY, ORDER_CERT_REPLAY_NONCE, ORDER_LOCATION, 201, false)
+                .addAuthorizationResponseBody(AUTHZ_URL, AUTHZ_REQUEST_BODY, AUTHZ_RESPONSE_BODY, AUTHZ_REPLAY_NONCE)
+                .addChallengeRequestAndResponse(CHALLENGE_REQUEST_BODY, CHALLENGE_URL, CHALLENGE_RESPONSE_BODY, CHALLENGE_REPLAY_NONCE, CHALLENGE_LOCATION, CHALLENGE_LINK, 200, false, VERIFY_CHALLENGE_URL, CHALLENGE_FILE_CONTENTS, AUTHZ_URL, UPDATED_AUTHZ_RESPONSE_BODY, UPDATED_AUTHZ_REPLAY_NONCE)
+                .addFinalizeRequestAndResponse(FINALIZE_RESPONSE_BODY, FINALIZE_REPLAY_NONCE, FINALIZE_URL, FINALIZE_LOCATION, 200)
+                .addCheckOrderRequestAndResponse(CHECK_ORDER_URL, CHECK_ORDER_REQUEST_BODY, CHECK_ORDER_RESPONSE_BODY, CHECK_ORDER_REPLAY_NONCE, 200)
+                .addCertificateRequestAndResponse(CERT_URL, CERT_REQUEST_BODY, CERT_RESPONSE_BODY, CERT_REPLAY_NONCE,  200)
+                .build();
+    }
+
+    private ClientAndServer setupTestObtainCertificateWithUnsupportedPublicKey() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"Cd6YLrbpxmk\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "zincntRzrBcL6fSvrCekkI48w39j89-rUjvGi7QYg9rdnys";
+
+        final String QUERY_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJxTjcwc2VsZEVrVTlKV0RMUkNibkp2QWo2WWs3UnV4QktUV0dNLTZaMUxsQlpXV1A1OGthbWU5cDA1THFLa05rdC1Yakc3Wkt5T1FQUXZ4cU5oRURKLTNpck93V0NzWi1BRk5aYU5BMlFoZ0dRYnB2MkRkRDIzMWdqVUZRT3dlS2pLdlhDdUg1TFlxVjVObUx0TFBNbjBsTFpFX21NVlB3dnhLTV9FLTBjRFhqeDZzTU9BbWtvVWkzWGRaOU0tUUNNc1BxTUhnbUt1T2xCUnVXdmRJNVRDaUcyemNXMFo2T0Y5T0lybVhoWTBFeVNDTjc3RkJ2dkJNN2NsYkNiN1gxS0ZGLVNpUDQ3a013VlNyR2h1eER6dVpzaU4wOThxT3IwVG8yd1BzQ2V5SzZwT3ZST3VwQi1ZX01yXy1QRjl5dnE5bXkzLVBXeVAtcnB3T09XVWZYZXcifSwibm9uY2UiOiJ6aW5jbnRSenJCY0w2ZlN2ckNla2tJNDh3MzlqODktclVqdkdpN1FZZzlyZG55cyIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJvbmx5UmV0dXJuRXhpc3RpbmciOnRydWV9\",\"signature\":\"TDqm_Jpezttg3kUIskpO18JthPtxzm4Q6-bXhYUiiD409_LLHyWt8gpmdSZ2g1EdnvegpKRfGHe-svggQVwJc5sJZrg_s3KrfpC2LwaxvmK6J5czRakBY1HLDhvB-dfDufp9Hua5wTyCM3VJhBzuwxT04C8mBD6TXVMhwt-ELWTviageuVidWJNw9STAfohS3cfU2kDkbLENn93VdnuGwr5PIuvTB7pBbyy7C0VmIDWlh2E9kXTnv2QPmYiIZOkTfHgN1EbRoWdJx4QKIWazOCfTuMT41YJs460a2CnXAk51eo6XlS5gmSlNGux3Qg2S0bzOY1IIMoFQH0MYDGiSMw\"}";
+
+        final String QUERY_ACCT_RESPONSE_BODY= "";
+
+        final String QUERY_ACCT_REPLAY_NONCE = "taroJmBHDyFedEWgCGh75dU3FcP5ubQTK2-WTPz7vZoN3NI";
+        final String ACCT_LOCATION = "http://localhost:4001/acme/acct/18";
+
+
+        final String ORDER_CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InRhcm9KbUJIRHlGZWRFV2dDR2g3NWRVM0ZjUDV1YlFUSzItV1RQejd2Wm9OM05JIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvbmV3LW9yZGVyIn0\",\"payload\":\"eyJpZGVudGlmaWVycyI6W3sidHlwZSI6ImRucyIsInZhbHVlIjoiaXJhY2x6bGNxZ2F5bXJjLmNvbSJ9XX0\",\"signature\":\"GgDQPFBK5AtUwG0100zmtcN0vaqWItG8neHt_UmyWme0zpdcdlDv7Kl_ayTPTRB0dzCEu3mrCbUsk2cHZu80_xkkmuTuGu4RRIpElhVAgkj8h5Gs5nmj1Rx8tY31GIyHgE4WhmQMurDaQUWEVzK8TMNFMuql_gr6b3vT577sTneDVQxRy5yLYzjDw60eQsm687CSHb8JgbUlh3qzz4NvC-bQxMAkHQctLU2WH7xyOyWNTWl49zFDaeaa_xC3FE01goHyToDEMOIuMKvvwXf4XooivWMSMqRlaaGwB81f3wzSNwjNdqsrY-pp2O5WJS2660RfRbWfwjIoQbAV6lNBmw\"}";
+
+        final String ORDER_CERT_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-29T16:28:22.889849436Z\"," + System.lineSeparator() +
+                "  \"identifiers\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns\"," + System.lineSeparator() +
+                "      \"value\": \"iraclzlcqgaymrc.com\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"authorizations\": [" + System.lineSeparator() +
+                "    \"http://localhost:4001/acme/authz/v2/67\"" + System.lineSeparator() +
+                "  ]," + System.lineSeparator() +
+                "  \"finalize\": \"http://localhost:4001/acme/finalize/18/99\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String ORDER_CERT_REPLAY_NONCE = "zinc-xZ1copze4zkgzj2cwJVZ0lg2pZtUEZjaYVTpChDbMs";
+        final String ORDER_LOCATION = "http://localhost:4001/acme/order/18/99";
+
+        final String AUTHZ_REPLAY_NONCE = "tarolh01L8-AR79io0VLNh2X_gInZpiTubW0QhHIE2BPKK4";
+        final String AUTHZ_URL = "/acme/authz/v2/67";
+        final String AUTHZ_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InppbmMteFoxY29wemU0emtnemoyY3dKVlowbGcycFp0VUVaamFZVlRwQ2hEYk1zIiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvYXV0aHovdjIvNjcifQ\",\"payload\":\"\",\"signature\":\"DNpOi-b2YLtBrbIC98LUcovvbYwq0xq5nyc3KOS8e6rl90vf9-ZCLUeWfzjXjXfN4Hgie1zZMySIVb9Blbm9bb2GrhiPdCGv8SixFLEyB5i_ZNDuU15nUrs1dQricv9PH9TTf6YrBJGjQtSH4nkQIRX9K6rzQAX-mPRQtk7TXOxU1cztj0DRpnw9MgqOj3zX54N-2tl9hoeUFyErFGDxRxKHFiEAxuvlaNv30VN9OXyRLxl3qURNhJR1_9T_P5uk1QEraUruAZR5DX1mVYMJLwQKxrkAIEzAJscFj6d8DE01XO2On49x3UKLAdXpyJQeVzP2lJ1uRymwMYzpAu2whA\"}";
+        final String AUTHZ_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"identifier\": {" + System.lineSeparator() +
+                "    \"type\": \"dns\"," + System.lineSeparator() +
+                "    \"value\": \"iraclzlcqgaymrc.com\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-07-29T16:28:22Z\"," + System.lineSeparator() +
+                "  \"challenges\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"http-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/67/jabkIQ\"," + System.lineSeparator() +
+                "      \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/67/nOqZzg\"," + System.lineSeparator() +
+                "      \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"tls-alpn-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/67/5jeSaw\"," + System.lineSeparator() +
+                "      \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String CHALLENGE_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvMTgiLCJub25jZSI6InRhcm9saDAxTDgtQVI3OWlvMFZMTmgyWF9nSW5acGlUdWJXMFFoSElFMkJQS0s0IiwidXJsIjoiaHR0cDovL2xvY2FsaG9zdDo0MDAxL2FjbWUvY2hhbGxlbmdlL3YyLzY3L2phYmtJUSJ9\",\"payload\":\"e30\",\"signature\":\"KOQARJFyGIZpsavmvmyjBPgnY4nSdBGlYCf4HukPe1iOLh-gwY6HTbh8SCjlNfEviWglwwUGUKeQGZaGhXu8dUZg7KnzqD5cN5unHXrJVlt3Atv-ysFXYYswTTihk7gRjHaNkFJ88hoomYdOG5jD_ijQUQyheqU_qsRJXNHw8z1dTdys_gwdDmML3PQNJ-5kkSYnIoBLViI1c8OhHWiBBOWzbeGUNc_nE9M_qJyBqcGRofctGcKlrGaajI4Zbf6Rp6Bc3L2oy1cDC_Ys4UJ-1k_wOeFeRLhhtjftKT3RTFTT9YsEGRxWaEwKnUAsWew8HkCfQjLf7phY6ZjMogubAg\"}";
+        final String CHALLENGE_URL = "/acme/challenge/v2/67/jabkIQ";
+
+        final String CHALLENGE_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"type\": \"http-01\"," + System.lineSeparator() +
+                "  \"status\": \"pending\"," + System.lineSeparator() +
+                "  \"url\": \"http://localhost:4001/acme/challenge/v2/67/jabkIQ\"," + System.lineSeparator() +
+                "  \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String CHALLENGE_REPLAY_NONCE = "zinc45dbw3ymv3Jy609ZCbK-JFYQ7-bukseiA0C9MCG1RaI";
+        final String CHALLENGE_LOCATION = "http://localhost:4001/acme/challenge/v2/67/jabkIQ";
+        final String CHALLENGE_LINK = "<http://localhost:4001/acme/authz/v2/67>;rel=\"up\"";
+        final String VERIFY_CHALLENGE_URL = "/.well-known/acme-challenge/d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ";
+        final String CHALLENGE_FILE_CONTENTS = "d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ.2NVC_ENUU-TZ83gkUxQvXl7_ixvttxk_dPlNqIyXGKY";
+
+        final String UPDATED_AUTHZ_REPLAY_NONCE = "taroU2YGBQVFTtrEh8v1qkH5DxOMYWG0rO4ABhGAzt2A6yc";
+        final String UPDATED_AUTHZ_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"identifier\": {" + System.lineSeparator() +
+                "    \"type\": \"dns\"," + System.lineSeparator() +
+                "    \"value\": \"iraclzlcqgaymrc.com\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"status\": \"valid\"," + System.lineSeparator() +
+                "  \"expires\": \"2019-08-28T16:28:22Z\"," + System.lineSeparator() +
+                "  \"challenges\": [" + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"http-01\"," + System.lineSeparator() +
+                "      \"status\": \"valid\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/67/jabkIQ\"," + System.lineSeparator() +
+                "      \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"," + System.lineSeparator() +
+                "      \"validationRecord\": [" + System.lineSeparator() +
+                "        {" + System.lineSeparator() +
+                "          \"url\": \"http://iraclzlcqgaymrc.com/.well-known/acme-challenge/d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"," + System.lineSeparator() +
+                "          \"hostname\": \"iraclzlcqgaymrc.com\"," + System.lineSeparator() +
+                "          \"port\": \"5002\"," + System.lineSeparator() +
+                "          \"addressesResolved\": [" + System.lineSeparator() +
+                "            \"172.17.0.1\"" + System.lineSeparator() +
+                "          ]," + System.lineSeparator() +
+                "          \"addressUsed\": \"172.17.0.1\"" + System.lineSeparator() +
+                "        }" + System.lineSeparator() +
+                "      ]" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"dns-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/67/nOqZzg\"," + System.lineSeparator() +
+                "      \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"" + System.lineSeparator() +
+                "    }," + System.lineSeparator() +
+                "    {" + System.lineSeparator() +
+                "      \"type\": \"tls-alpn-01\"," + System.lineSeparator() +
+                "      \"status\": \"pending\"," + System.lineSeparator() +
+                "      \"url\": \"http://localhost:4001/acme/challenge/v2/67/5jeSaw\"," + System.lineSeparator() +
+                "      \"token\": \"d2fs_-qypCU68P4jck7U9k1JGdN-SlQbjfWUCIo8SAQ\"" + System.lineSeparator() +
+                "    }" + System.lineSeparator() +
+                "  ]" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String FINALIZE_URL = "/acme/finalize/18/99";
+
+        final String FINALIZE_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"type\": \"urn:ietf:params:acme:error:malformed\"," + System.lineSeparator() +
+                "  \"detail\": \"Error finalizing order :: invalid public key in CSR: unknown key type *dsa.PublicKey\"," + System.lineSeparator() +
+                "  \"status\": 400" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String FINALIZE_REPLAY_NONCE = "zincIG_1w_6ME9wlbC5CmT7FQ9h2LLtLFzONU5qh1bkaDh8";
+        final String FINALIZE_LOCATION = "";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY, QUERY_ACCT_RESPONSE_BODY, QUERY_ACCT_REPLAY_NONCE, ACCT_LOCATION, 200)
+                .orderCertificateRequestAndResponse(ORDER_CERT_REQUEST_BODY, ORDER_CERT_RESPONSE_BODY, ORDER_CERT_REPLAY_NONCE, ORDER_LOCATION, 201, false)
+                .addAuthorizationResponseBody(AUTHZ_URL, AUTHZ_REQUEST_BODY, AUTHZ_RESPONSE_BODY, AUTHZ_REPLAY_NONCE)
+                .addChallengeRequestAndResponse(CHALLENGE_REQUEST_BODY, CHALLENGE_URL, CHALLENGE_RESPONSE_BODY, CHALLENGE_REPLAY_NONCE, CHALLENGE_LOCATION, CHALLENGE_LINK, 200, false, VERIFY_CHALLENGE_URL, CHALLENGE_FILE_CONTENTS, AUTHZ_URL, UPDATED_AUTHZ_RESPONSE_BODY, UPDATED_AUTHZ_REPLAY_NONCE)
+                .addFinalizeRequestAndResponse(FINALIZE_RESPONSE_BODY, FINALIZE_REPLAY_NONCE, FINALIZE_URL, FINALIZE_LOCATION, 400, true)
+                .build();
+    }
+
+    private ClientAndServer setupTestRevokeCertificateWithoutReason() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"," + System.lineSeparator() +
+                "  \"kgIgyHU3yA0\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "taroDvhk2H7ErEkhFCq8zux1hCbY0KzFQDEFGjMaSvvCC_k";
+
+        final String QUERY_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJoOE9lZTViZURSZ3hOUGVfZU1FOUg2Vm83NEZ1ZzhIZ3Jpa2ZiZkNhVTNsS0Y2NDhRRzFYMWtHRFpUaEF5OGRhcUo4YnY2YzNQSmRueDJIcjhqT3psNTA5Ym5NNmNDV2Z5d1RwY0lab1V6UVFaTFlfSzhHTURBeWdsc1FySXRnQ2lRYWxJcWJ1SkVrb2MzV1FBSXhKMjN4djliSzV4blZRa1RXNHJWQkFjWU5Rd29CakdZT1dTaXpUR2ZqZ21RcVRYbG9hYW1GWkpuOTdIbmIxcWp5NVZZbTA2YnV5cXdBYUdIczFDTHUzY0xaZ1FwVkhRNGtGc3prOFlPNVVBRWppb2R1Z1dwWlVSdTlUdFJLek4wYmtFZGVRUFlWcGF1cFVxMWNxNDdScDJqcVZVWGRpUUxla3l4clFidDhBMnVHNEx6RFF1LWI0Y1pwcG16YzNobGhTR3cifSwibm9uY2UiOiJ0YXJvRHZoazJIN0VyRWtoRkNxOHp1eDFoQ2JZMEt6RlFERUZHak1hU3Z2Q0NfayIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJvbmx5UmV0dXJuRXhpc3RpbmciOnRydWV9\",\"signature\":\"WpICzZNwgHJckeO7fn8rytSB23poud38FEg1fwmVvd3rag-KLZ5rOrqmOzr6BIUpaY0DEeZ03QzQFYIoywVNg8Apvbh12RZvkWW_VuIfpnJOz6dWOhV-lM5aH9oVy7mW9nNVqzqlTEyWRXPGo8XSD_vWtxSu-zLbHOTvnURiiCOO3DM96xRZrnvexTI97RRO6cBrI4HzjSBpat03YOkwxEWzrbqdZD7RVgUxTh6ELK7BE1U87IF2iBO_V1VllUZdH9P2EiTtFBwj5xkBXhyeBiTj2BqWzb4-Y5o_W0b5hMX1IQiPa-zb56L-SkcEJMNu-hJSGmPy6uoRJVAwCHcP-w\"}";
+
+        final String QUERY_ACCT_RESPONSE_BODY= "";
+
+        final String QUERY_ACCT_REPLAY_NONCE = "zincgzgBIqMgfFmkcIQYn6rGST-aEs9SOGlh0b8u4QYFqiA";
+        final String ACCT_LOCATION = "http://localhost:4001/acme/acct/5";
+
+        final String REVOKE_CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvNSIsIm5vbmNlIjoiemluY2d6Z0JJcU1nZkZta2NJUVluNnJHU1QtYUVzOVNPR2xoMGI4dTRRWUZxaUEiLCJ1cmwiOiJodHRwOi8vbG9jYWxob3N0OjQwMDEvYWNtZS9yZXZva2UtY2VydCJ9\",\"payload\":\"eyJjZXJ0aWZpY2F0ZSI6Ik1JSUZUVENDQkRXZ0F3SUJBZ0lUQVA4b01Ib3hOS19JbWdkN3lzelh3S2RXd3pBTkJna3Foa2lHOXcwQkFRc0ZBREFmTVIwd0d3WURWUVFEREJSb01uQndlU0JvTW1OclpYSWdabUZyWlNCRFFUQWVGdzB4T1RBM01UWXhOalE0TWpkYUZ3MHhPVEV3TVRReE5qUTRNamRhTUNFeEh6QWRCZ05WQkFNVEZtbHViRzVsYzJWd2NIZHJabmRsZDNaNE1pNWpiMjB3Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLQW9JQkFRQ1NaQllqclZ0S05jbFVhQV9nZ3hJaGNSVVdrOUVJbXBJMG5heWQwaURsYUdUWkxicTZVNHZvUWxzNkRDZmpzdzIwU2QzdTgzb2RqTDU2QUdOeHBIUzZaYTVjN3RLS1hGUmgwOVFjVEkzdFJwbWF5bFgwZXhWd2tVcllSaUdLSXA3Mjg2YzhWdi1qenk4VkkyLXlnaFpvLThHRDNjVm9XdFhEWnpWNWxnZlFGeGhDc2tUUjhWUXB6b0FOMm5Fai01UVRNdi1HdUhfSDJ5U3FNLWtTN0NwR2JUaDZZSUp2OVZfblFUaC1FTEFnY29ic01UN24tU2dfRTdUQ21nNmxqaWduaGRwdzZGMElMdWlfX3pJYzFEbG0yRC1UVi0tWm4yQnp1b2FkeFJlZ05TcXMyRkkyUDF3MXlSSHFHYmtTOEpabEY0LWg3MVhWV01kazFtWUVaRTVCQWdNQkFBR2pnZ0otTUlJQ2VqQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUdDQ3NHQVFVRkJ3TUNNQXdHQTFVZEV3RUJfd1FDTUFBd0hRWURWUjBPQkJZRUZObThPaFpQbWYweWdhNUR6MHNGaTB3TXZ3cWJNQjhHQTFVZEl3UVlNQmFBRlB0NFR4TDVZQldETEo4WGZ6UVpzeTQyNmtHSk1HUUdDQ3NHQVFVRkJ3RUJCRmd3VmpBaUJnZ3JCZ0VGQlFjd0FZWVdhSFIwY0Rvdkx6RXlOeTR3TGpBdU1UbzBNREF5THpBd0JnZ3JCZ0VGQlFjd0FvWWthSFIwY0RvdkwySnZkV3hrWlhJNk5EUXpNQzloWTIxbEwybHpjM1ZsY2kxalpYSjBNQ0VHQTFVZEVRUWFNQmlDRm1sdWJHNWxjMlZ3Y0hkclpuZGxkM1o0TWk1amIyMHdKd1lEVlIwZkJDQXdIakFjb0JxZ0dJWVdhSFIwY0RvdkwyVjRZVzF3YkdVdVkyOXRMMk55YkRCQUJnTlZIU0FFT1RBM01BZ0dCbWVCREFFQ0FUQXJCZ01xQXdRd0pEQWlCZ2dyQmdFRkJRY0NBUllXYUhSMGNEb3ZMMlY0WVcxd2JHVXVZMjl0TDJOd2N6Q0NBUVVHQ2lzR0FRUUIxbmtDQkFJRWdmWUVnZk1BOFFCM0FCYm9hY0hSbGVyWHdfaVhHdVB3ZGdIM2pPRzJuVEdvVWhpMmczOHhxQlVJQUFBQmFfdm1ZVElBQUFRREFFZ3dSZ0loQUt0b2NobEprQm5idFduQzFLUjlVZ2p0TXZldFFjeUEyaTRvVE9rVjVTUFVBaUVBdEFqeXd6RW11eHRJcmc0US1oWExHTllqbVlFSWROSUxnVDBTZGVkUE5kQUFkZ0FvZGhvWWtDZjc3enpRMWhvQmpYYXdVRmNweDZkQkc4eTk5Z1QwWFVKaFV3QUFBV3Y3NW1FekFBQUVBd0JITUVVQ0lGVVJmVkJfUWVaV3N1dk1LVVpUVDJDaVAzR182OVkzVUNhV0pfNExYbWozQWlFQXBkQXVXMVU1T2Z5TF9ZcGVBRVBBbVpyOVpvNWFDejRsWU0zcTluTGh4V0l3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQURtODV2cHZFaU9VWWNQRXB3bE9RdlRJYW4ybm1MMWN0ejhUN0xLbmJpQ3pYX2lYcjNUY2FrSEV3NUVNVUk0ZEFEN3ZTRklIclhDem5GZTVlYTVQWGh2bi1KQjFFVnQtVnZmV3lGQXlWLVBuVzc0dDBGa1p5Z1ZQSGdwbktnVWozemFSMHhfRDlZMEEybW16REZCYkpHNmpDR0k1V3lmSnY2c0gyS2xuTDRvaWhGS1VQVm9HY3VNZWhySkd3TWNUMllhRnM3dDhXaHROTkM4ek9HbkxHODdiQUM4SjUxY0VEdjlGeUYyaUtBc0NLY1JNWFRnd0Q2Y2pRVExacnZ1ZnJQN1FTR3pzYWdRYXlPZEVNZkl3N2UydXZoSS1iRWtMdFdxb1BKcmZFV2Y4YU1CY2RLVEhXQXc4NGhDOXR0am52S0xGbFVvNjlHYWhmZm5KV2ZEN1RucyJ9\",\"signature\":\"A14QNG3HbUD341rmJ7ibxiIMlcCuDIUrLWtvcmnH-byrBetX5J5VrXaiHOOPYKK2YCjDJEr2f29Cq3i6Q0IlC2UGAPGOEETYKNDBv3zHrtNe7I0VMXMqfB8ClNydSoNdAL9OB1m9syZT7ijZxq_RldTWLsCIDDdWom1xEgb3RUCpTTMUMhsTQZdf5t3y0CNa5p7wfCT8ejLcQ3aYMUm-chDjn4nC8YBdGVSlpacLdafrsDeoTFSF8yhCL9pBk_hz8FMXFKS3ctCBGVJTIHeWPWvnYJn4owEAjbmVqC_khACM-Zo7N-Gx7--47_qyG4dW2IvYansrMrlIwLlwDtmPig\"}";
+        final String REVOKE_CERT_REPLAY_NONCE = "taroo4s_zllDSu1x5i0l1x595sQJalOjAPXRnz6oc7vMiHc";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY, QUERY_ACCT_RESPONSE_BODY, QUERY_ACCT_REPLAY_NONCE, ACCT_LOCATION, 200)
+                .addRevokeCertificateRequestAndResponse(REVOKE_CERT_REQUEST_BODY, REVOKE_CERT_REPLAY_NONCE, 200)
+                .build();
+    }
+
+    private ClientAndServer setupTestRevokeCertificateWithReason() {
+
+        // set up a mock Let's Encrypt server
+        final String DIRECTORY_RESPONSE_BODY = "{" + System.lineSeparator() +
+                "  \"oBarDLD1zzc\": \"https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417\"," + System.lineSeparator() +
+                "  \"keyChange\": \"http://localhost:4001/acme/key-change\"," + System.lineSeparator() +
+                "  \"meta\": {" + System.lineSeparator() +
+                "    \"caaIdentities\": [" + System.lineSeparator() +
+                "      \"happy-hacker-ca.invalid\"" + System.lineSeparator() +
+                "    ]," + System.lineSeparator() +
+                "    \"termsOfService\": \"https://boulder:4431/terms/v7\"," + System.lineSeparator() +
+                "    \"website\": \"https://github.com/letsencrypt/boulder\"" + System.lineSeparator() +
+                "  }," + System.lineSeparator() +
+                "  \"newAccount\": \"http://localhost:4001/acme/new-acct\"," + System.lineSeparator() +
+                "  \"newNonce\": \"http://localhost:4001/acme/new-nonce\"," + System.lineSeparator() +
+                "  \"newOrder\": \"http://localhost:4001/acme/new-order\"," + System.lineSeparator() +
+                "  \"revokeCert\": \"http://localhost:4001/acme/revoke-cert\"" + System.lineSeparator() +
+                "}" + System.lineSeparator();
+
+        final String NEW_NONCE_RESPONSE = "zincwFvSlMEm-Dg4LsDtx1JBKaWnu2qiBYBUG6jSZLiexMY";
+
+        final String QUERY_ACCT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImp3ayI6eyJlIjoiQVFBQiIsImt0eSI6IlJTQSIsIm4iOiJoOE9lZTViZURSZ3hOUGVfZU1FOUg2Vm83NEZ1ZzhIZ3Jpa2ZiZkNhVTNsS0Y2NDhRRzFYMWtHRFpUaEF5OGRhcUo4YnY2YzNQSmRueDJIcjhqT3psNTA5Ym5NNmNDV2Z5d1RwY0lab1V6UVFaTFlfSzhHTURBeWdsc1FySXRnQ2lRYWxJcWJ1SkVrb2MzV1FBSXhKMjN4djliSzV4blZRa1RXNHJWQkFjWU5Rd29CakdZT1dTaXpUR2ZqZ21RcVRYbG9hYW1GWkpuOTdIbmIxcWp5NVZZbTA2YnV5cXdBYUdIczFDTHUzY0xaZ1FwVkhRNGtGc3prOFlPNVVBRWppb2R1Z1dwWlVSdTlUdFJLek4wYmtFZGVRUFlWcGF1cFVxMWNxNDdScDJqcVZVWGRpUUxla3l4clFidDhBMnVHNEx6RFF1LWI0Y1pwcG16YzNobGhTR3cifSwibm9uY2UiOiJ6aW5jd0Z2U2xNRW0tRGc0THNEdHgxSkJLYVdudTJxaUJZQlVHNmpTWkxpZXhNWSIsInVybCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL25ldy1hY2N0In0\",\"payload\":\"eyJvbmx5UmV0dXJuRXhpc3RpbmciOnRydWV9\",\"signature\":\"bFUmpw50SUd29FFzPgpZw-lkSzl8tlO4ZEUkxRNyL3NSfBZvKDUpPA9P4gg7NkKq-kLl09O2_w_9zoDu_AxIpfylnBuQmK3PGA_f61tQHjWG41hX7NaPUqPieFiEMD4EC7-z4oEN2O79hdCLzhtujwkX8kUav7q60VoUDdmLongJkoQJYHqYJisYmmvGBf28qe3jq9KmgeLav33z8xdsg3i-Cc7jZDWdRMtY72PqEMT53WhYBof15HXrrSZf5b6AAEOX8xMfPkMvx0p_TG2RCEiYY-L7yxgE634_-ye146uUL47X7h5ajmuqu3EsOL4456cjpcKGyhpU9aAhCDKHNQ\"}";
+
+        final String QUERY_ACCT_RESPONSE_BODY= "";
+
+        final String QUERY_ACCT_REPLAY_NONCE = "taroaIprXC7Gi1SYzYi8ETK0IooQwJyv-Qsv4ALL-xw8uu0";
+        final String ACCT_LOCATION = "http://localhost:4001/acme/acct/5";
+
+        final String REVOKE_CERT_REQUEST_BODY = "{\"protected\":\"eyJhbGciOiJSUzI1NiIsImtpZCI6Imh0dHA6Ly9sb2NhbGhvc3Q6NDAwMS9hY21lL2FjY3QvNSIsIm5vbmNlIjoidGFyb2FJcHJYQzdHaTFTWXpZaThFVEswSW9vUXdKeXYtUXN2NEFMTC14dzh1dTAiLCJ1cmwiOiJodHRwOi8vbG9jYWxob3N0OjQwMDEvYWNtZS9yZXZva2UtY2VydCJ9\",\"payload\":\"eyJjZXJ0aWZpY2F0ZSI6Ik1JSUZSVENDQkMyZ0F3SUJBZ0lUQVA4S2RpM2JyejdmaTlHYkpDM2pQRGxUT2pBTkJna3Foa2lHOXcwQkFRc0ZBREFmTVIwd0d3WURWUVFEREJSb01uQndlU0JvTW1OclpYSWdabUZyWlNCRFFUQWVGdzB4T1RBM01UWXhOekV5TURkYUZ3MHhPVEV3TVRReE56RXlNRGRhTUI0eEhEQWFCZ05WQkFNVEUyMXVaR1ZzYTJSdVltTnBiRzlvWnk1amIyMHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDSXhLNzVXS0dCSzJ4Y0F1QWVfTmJPRnJvcUJaU3hHUFZFOWd0Y0lMRF9HU0hSYzFWbHNmc2x1UXpsdThiSDNnaW91OFdEUU85NDNYaUxWdldJSU1oSGQ4MzJZM0xRdXMwQnlUeEtlUnVubXdhVjdHWkZoQTNrTEFJclpzUUNRNGxMUUtLTHB4N09PcVREZUhSY1Q4UHV1NDNqQXh6NTItZ0ZFc1MzOFM2WS14aGxmdTZSN1ZvMUJnenlNNFV2MkVLQVNwbDh0N2twOFdiRzUwejhSYzd4SjR1VnZEa3dSQmhJWUtPTmttaHFPVkJvNGlIT0ZoU3JFRGhzRXJERHZjdi00dzdLZU43ZDhURmtucjR1R1U2emtrWDFZYi1GX2ZSSEpzMFhXYTFJSTlGcDFmTXNnQ3lPb0R4MERKSFBIVDE0WS10TVc1bHlRTS1MT2ZYMnJ5RzdBZ01CQUFHamdnSjVNSUlDZFRBT0JnTlZIUThCQWY4RUJBTUNCYUF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQl93UUNNQUF3SFFZRFZSME9CQllFRkREdmMwX1JzRG1pTjhrUlFBbmxicWNfUUJ5Mk1COEdBMVVkSXdRWU1CYUFGUHQ0VHhMNVlCV0RMSjhYZnpRWnN5NDI2a0dKTUdRR0NDc0dBUVVGQndFQkJGZ3dWakFpQmdnckJnRUZCUWN3QVlZV2FIUjBjRG92THpFeU55NHdMakF1TVRvME1EQXlMekF3QmdnckJnRUZCUWN3QW9Za2FIUjBjRG92TDJKdmRXeGtaWEk2TkRRek1DOWhZMjFsTDJsemMzVmxjaTFqWlhKME1CNEdBMVVkRVFRWE1CV0NFMjF1WkdWc2EyUnVZbU5wYkc5b1p5NWpiMjB3SndZRFZSMGZCQ0F3SGpBY29CcWdHSVlXYUhSMGNEb3ZMMlY0WVcxd2JHVXVZMjl0TDJOeWJEQkFCZ05WSFNBRU9UQTNNQWdHQm1lQkRBRUNBVEFyQmdNcUF3UXdKREFpQmdnckJnRUZCUWNDQVJZV2FIUjBjRG92TDJWNFlXMXdiR1V1WTI5dEwyTndjekNDQVFNR0Npc0dBUVFCMW5rQ0JBSUVnZlFFZ2ZFQTd3QjJBQmJvYWNIUmxlclh3X2lYR3VQd2RnSDNqT0cyblRHb1VoaTJnMzh4cUJVSUFBQUJhX3Y4QzRFQUFBUURBRWN3UlFJaEFQbC1wWUdvcGZGb0xwSS1VT2pQN2J3YjQ2UmhlYXl6a1VUZDFxV3U4TUhiQWlBa0xFaG5fNllXTm1iWEtxNmtiNk9aQzFSNy1ud1NKNk41X1BQNm9KQlhvZ0IxQU4yWk5QeWw1eVNBeVZab2ZZRTBtUWhKc2tuM3RXbll4N3lyUDF6QjgyNWtBQUFCYV92OERYWUFBQVFEQUVZd1JBSWdXZkRRU2Rfamo1SzV5ZHh6MFU2Z0xpVV9LcGtZek44bG9DTHZNUXVPSDlFQ0lHT0d5eWJNcXA2ZVRtUFZxeXdDcEVEa0xRS0J2NE1DNV9McmtqN3JaMmhxTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBUjZTLWl6NlUteU41YTNVSmJlVVR1TU9XZUNkZWFPdVBMYy1GUnpSUExxamlvb240U2VOSnp4QXNBVnNrQmtjN3ZfRGpNWFVTR3BYSm1IUVkwM1pJYUNoSWRuVXRyUTdLX0FhaXFLck1IeTV5U29JSUFENzFKU09kT1RRdTBvRDBVZVZBdUVJMlExcVBZcnNoYmZ6UGhraWxBV3BwaGhTc1l1U0g0aFlHQVRyck4zaEE5ckF3UkN4eVFmTUpUQXBiWnc5T0dZOVp5MW12NWU3cDh6WXZsanlRWEFmUmpTaEhjQ1R2UVhXUFNIb2VGVTRMa1ViMHdlXy1uRzNtdDdfTGhYckpNUFZ2T1VNQlB6R2RQSDE3dDFYeWYzVEdaV2x0Wkdjc0MzcmRjdWkxaGJkcHpxNU5zcHV3Qlg4b0F4d0Rnck9CajF4VldfRkFMSXd3NTBCMHkiLCJyZWFzb24iOjF9\",\"signature\":\"bmgU30KFfJ5QLUBFF6b2e1mBV0W3YgKJHHS3goSyxzaANUocAEBYaEAId4EglE8op1HqvVBul5o7hCA6UfkNRE_hv0Y6c5xS_OQPRt0sRk_KRe6rVeVZd2ov5IqXmjdGq7xOnyRFXq1ErPfb3KSoz1IUOagemSZzUgbPNwIIJMSnQuRXW8ScOECssoDTy_R4OL6drkyxN8qXP7dJUQ4T4rTRBXnSEv1fUHFBZLRvVb2jqMc-Iiwp6hjdahBlWqPudiMyD8pinghyns0m5btw_OmOWERMEI4lIsOJjVg2Tu7HALDiLGSk6dyUV1HXyAeWBVr1QJBFeq2Gw3rD-26d1w\"}";
+        final String REVOKE_CERT_REPLAY_NONCE = "zinci0BXolnLRwsa-i7xBiVz4Zy0LDbw7hjIv9UvBDP10CQ";
+
+        return new AcmeMockServerBuilder(server)
+                .addDirectoryResponseBody(DIRECTORY_RESPONSE_BODY)
+                .addNewNonceResponse(NEW_NONCE_RESPONSE)
+                .addNewAccountRequestAndResponse(QUERY_ACCT_REQUEST_BODY, QUERY_ACCT_RESPONSE_BODY, QUERY_ACCT_REPLAY_NONCE, ACCT_LOCATION, 200)
+                .addRevokeCertificateRequestAndResponse(REVOKE_CERT_REQUEST_BODY, REVOKE_CERT_REPLAY_NONCE, 200)
+                .build();
+    }
+}
\ No newline at end of file
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ResolveExpressionAttributesTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ResolveExpressionAttributesTestCase.java
new file mode 100644
index 0000000..f02f478
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/ResolveExpressionAttributesTestCase.java
@@ -0,0 +1,249 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+
+import static org.junit.Assert.assertEquals;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import org.jboss.as.controller.RunningMode;
+import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
+import org.jboss.as.subsystem.test.AbstractSubsystemBaseTest;
+import org.jboss.as.subsystem.test.AdditionalInitialization;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.as.subsystem.test.KernelServicesBuilder;
+import org.jboss.dmr.ModelNode;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies that attributes that allow expressions resolve them correctly.
+ *
+ * @author <a href="mailto:szaldana@redhat.com">Sonia Zaldana</a>
+ */
+public class ResolveExpressionAttributesTestCase extends AbstractSubsystemBaseTest {
+
+    private ModelNode serverModel;
+
+    public ResolveExpressionAttributesTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    @Before
+    public void init() throws Exception {
+        KernelServicesBuilder builder = createKernelServicesBuilder(createAdditionalInitialization())
+                .setSubsystemXml(getSubsystemXml());
+        KernelServices kernelServices = builder.build();
+        Assert.assertTrue("Subsystem boot failed!", kernelServices.isSuccessfulBoot());
+        ModelNode rootModel = kernelServices.readWholeModel();
+        serverModel =  rootModel.require(ModelDescriptionConstants.SUBSYSTEM).require(ElytronTlsExtension.SUBSYSTEM_NAME);
+    }
+
+    @Override
+    protected String getSubsystemXml() throws IOException {
+        return readResource("elytron-tls-expressions.xml");
+    }
+
+    @Override
+    protected AdditionalInitialization createAdditionalInitialization() {
+        // Our use of the expression=encryption resource requires kernel capability setup that TestEnvironment provides
+        return new TestEnvironment(RunningMode.ADMIN_ONLY);
+    }
+
+    @Test
+    public void testExpressionAttributesResolved() {
+        testCertificateAuthorityAccount();
+        testCertificateAuthority();
+        testCredentialStore();
+        // testCustomComponent();
+        testElytronTlsDefinition();
+        // testFilteringKeyStoreDefinition();
+        testKeyStore();
+        // testLdapKeyStore();
+        testProvider();
+        // testSaslServer();
+        testTLSComponents();
+    }
+
+    private void testCertificateAuthorityAccount() {
+        ModelNode caAccount = serverModel.get(Constants.CERTIFICATE_AUTHORITY_ACCOUNT).get("MyCA");
+        assertEquals(Arrays.asList("https://www.test.com"), getValue(caAccount, Constants.CONTACT_URLS, true));
+        assertEquals("LetsEncrypt", getValue(caAccount, Constants.CERTIFICATE_AUTHORITY));
+        assertEquals("server", getValue(caAccount, Constants.ALIAS));
+    }
+
+    private void testCertificateAuthority() {
+        ModelNode ca = serverModel.get(Constants.CERTIFICATE_AUTHORITY).get("testCA");
+        assertEquals("https://www.test.com", getValue(ca, Constants.STAGING_URL));
+        assertEquals("https://www.test.com", getValue(ca, Constants.URL));
+    }
+
+    private void testCredentialStore() {
+        // Credential Stores
+        ModelNode cs = serverModel.get(Constants.CREDENTIAL_STORE).get("test1");
+        assertEquals("test1.store", getValue(cs, Constants.LOCATION));
+        assertEquals("JCEKS", getValue(cs, Constants.TYPE));
+        assertEquals("provider", getValue(cs, Constants.PROVIDER_NAME));
+        cs = cs.get(Constants.IMPLEMENTATION_PROPERTIES);
+        assertEquals("JCEKS", getValue(cs, "keyStoreType"));
+        cs = serverModel.get(Constants.CREDENTIAL_STORE).get("test4");
+        assertEquals("test1.store", getValue(cs, Constants.PATH));
+
+        // Secret Credential Store
+        cs = serverModel.get(Constants.SECRET_KEY_CREDENTIAL_STORE).get("test3");
+        assertEquals("false", getValue(cs, Constants.CREATE));
+        assertEquals("false", getValue(cs, Constants.POPULATE));
+        assertEquals("192", getValue(cs, Constants.KEY_SIZE));
+        assertEquals("test3", getValue(cs, Constants.DEFAULT_ALIAS));
+    }
+
+    private void testCustomComponent() {
+        // TODO: is there a different custom component that could go here?
+        // Using custom permission mapper as example
+        ModelNode mapper = serverModel.get(Constants.CUSTOM_PERMISSION_MAPPER).get("MyPermissionMapper");
+        assertEquals("value", getValue(mapper.get(Constants.CONFIGURATION), "test"));
+    }
+
+    private void testElytronTlsDefinition() {
+        assertEquals(Arrays.asList("test"), getValue(serverModel, Constants.DISALLOWED_PROVIDERS, true));
+        // assertEquals("false", getValue(serverModel, Constants.REGISTER_JASPI_FACTORY));
+    }
+
+    private void testFilteringKeyStoreDefinition() {
+        ModelNode keystore = serverModel.get(Constants.FILTERING_KEY_STORE).get("FilteringKeyStore");
+        assertEquals("NONE:+firefly", getValue(keystore, Constants.ALIAS_FILTER));
+    }
+
+    private void testJaspiConfiguration() {
+        ModelNode jaspi = serverModel.get(Constants.JASPI_CONFIGURATION).get("test");
+        assertEquals("HttpServlet", getValue(jaspi, Constants.LAYER));
+        assertEquals("default /test", getValue(jaspi, Constants.APPLICATION_CONTEXT));
+        assertEquals("Test Definition", getValue(jaspi, Constants.DESCRIPTION));
+
+        ModelNode testModule = jaspi.get(Constants.SERVER_AUTH_MODULES).get(0);
+        assertEquals("REQUISITE", getValue(testModule, Constants.FLAG));
+
+        ModelNode options = testModule.get(Constants.OPTIONS);
+        assertEquals("b", getValue(options, "a"));
+    }
+
+    private void testKeyStore() {
+        ModelNode keystore = serverModel.get(Constants.KEY_STORE).get("jks_store");
+        assertEquals("jks", getValue(keystore, Constants.TYPE));
+        assertEquals("SunJSSE", getValue(keystore, Constants.PROVIDER_NAME));
+        assertEquals("one,two,three", getValue(keystore, Constants.ALIAS_FILTER));
+        assertEquals("true", getValue(keystore, Constants.REQUIRED));
+    }
+
+    private void testLdapKeyStore() {
+        ModelNode keystore = serverModel.get(Constants.LDAP_KEY_STORE).get("LdapKeyStore");
+
+        // search
+        assertEquals("dc=elytron,dc=wildfly,dc=org", getValue(keystore, Constants.SEARCH_PATH));
+        assertEquals("true", getValue(keystore, Constants.SEARCH_RECURSIVE));
+        assertEquals("1000", getValue(keystore, Constants.SEARCH_TIME_LIMIT));
+        assertEquals("(&(objectClass=inetOrgPerson)(sn={0}))", getValue(keystore, Constants.FILTER_ALIAS));
+        assertEquals("(&(objectClass=inetOrgPerson)(usercertificate={0}))", getValue(keystore, Constants.FILTER_CERTIFICATE));
+        assertEquals("(sn=serenity*)", getValue(keystore, Constants.FILTER_ITERATE));
+
+        // attribute mapping
+        assertEquals("sn", getValue(keystore, Constants.ALIAS_ATTRIBUTE));
+        assertEquals("usercertificate", getValue(keystore, Constants.CERTIFICATE_ATTRIBUTE));
+        assertEquals("X.509", getValue(keystore, Constants.CERTIFICATE_TYPE));
+        assertEquals("userSMIMECertificate", getValue(keystore, Constants.CERTIFICATE_CHAIN_ATTRIBUTE));
+        assertEquals("PKCS7", getValue(keystore, Constants.CERTIFICATE_CHAIN_ENCODING));
+        assertEquals("userPKCS12", getValue(keystore, Constants.KEY_ATTRIBUTE));
+        assertEquals("PKCS12", getValue(keystore, Constants.KEY_TYPE));
+
+        // new item template
+        ModelNode template = keystore.get(Constants.NEW_ITEM_TEMPLATE);
+        assertEquals("ou=keystore,dc=elytron,dc=wildfly,dc=org", getValue(template, Constants.NEW_ITEM_PATH));
+        assertEquals("cn", getValue(template, Constants.NEW_ITEM_RDN));
+        assertEquals("objectClass", getValue(template.get(Constants.NEW_ITEM_ATTRIBUTES).get(0), Constants.NAME));
+        assertEquals(Arrays.asList("top", "inetOrgPerson"), getValue(template.get(Constants.NEW_ITEM_ATTRIBUTES).get(0), Constants.VALUE, true));
+    }
+
+
+    private void testProvider() {
+        ModelNode provider = serverModel.get(Constants.PROVIDER_LOADER).get("openssl");
+        assertEquals("val", getValue(provider.get(Constants.CONFIGURATION), "prop"));
+        provider = serverModel.get(Constants.PROVIDER_LOADER).get("elytron");
+        assertEquals("arg", getValue(provider, Constants.ARGUMENT));
+    }
+
+    private void testSaslServer() {
+        ModelNode factory = serverModel.get(Constants.SASL_AUTHENTICATION_FACTORY).get("SaslAuthenticationDefinition").get(Constants.MECHANISM_CONFIGURATIONS).get(0);
+        assertEquals("PLAIN", getValue(factory, Constants.MECHANISM_NAME));
+        assertEquals("host", getValue(factory, Constants.HOST_NAME));
+        assertEquals("protocol", getValue(factory, Constants.PROTOCOL));
+    }
+
+    private void testTLSComponents() {
+        // SSL Context
+        ModelNode context = serverModel.get(Constants.SERVER_SSL_CONTEXT).get("server");
+        assertEquals(Arrays.asList("TLSv1.2"), getValue(context, Constants.PROTOCOLS, true));
+        assertEquals("true", getValue(context, Constants.WANT_CLIENT_AUTH));
+        assertEquals("true", getValue(context, Constants.NEED_CLIENT_AUTH));
+        assertEquals("true", getValue(context, Constants.AUTHENTICATION_OPTIONAL));
+        assertEquals("false", getValue(context, Constants.USE_CIPHER_SUITES_ORDER));
+        assertEquals("false", getValue(context, Constants.WRAP));
+        assertEquals("first", getValue(context, Constants.PROVIDER_NAME));
+        assertEquals("DEFAULT", getValue(context, Constants.CIPHER_SUITE_FILTER));
+        assertEquals("name", getValue(context, Constants.CIPHER_SUITE_NAMES));
+        assertEquals("10", getValue(context, Constants.MAXIMUM_SESSION_CACHE_SIZE));
+        assertEquals("120", getValue(context, Constants.SESSION_TIMEOUT));
+
+        // Trust Managers
+        ModelNode tm = serverModel.get(Constants.TRUST_MANAGER).get("trust-with-ocsp").get(Constants.OCSP);
+        assertEquals("http://localhost/ocsp", getValue(tm, Constants.RESPONDER));
+        assertEquals("jceks_store", getValue(tm, Constants.RESPONDER_KEYSTORE));
+        assertEquals("responder-alias", getValue(tm, Constants.RESPONDER_CERTIFICATE));
+
+        tm = serverModel.get(Constants.TRUST_MANAGER).get("trust-with-crl").get(Constants.CERTIFICATE_REVOCATION_LIST);
+        assertEquals("crl.pem", getValue(tm, Constants.PATH));
+        assertEquals("2", getValue(tm, Constants.MAXIMUM_CERT_PATH));
+
+        // Key Managers
+        ModelNode keyManager = serverModel.get(Constants.KEY_MANAGER).get("serverKey2");
+        assertEquals("SunX509", getValue(keyManager, Constants.ALGORITHM));
+        assertEquals("one,two,three", getValue(keyManager, Constants.ALIAS_FILTER));
+        assertEquals("localhost", getValue(keyManager, Constants.GENERATE_SELF_SIGNED_CERTIFICATE_HOST));
+    }
+
+    private Object getValue(ModelNode node, String attributeName) {
+        return getValue(node, attributeName, false);
+    }
+
+    private Object getValue(ModelNode node, String attributeName, boolean isList) {
+        ModelNode result = node.get(attributeName).resolve();
+        if (! isList) {
+            return result.asString();
+        }
+        List<String> results = new ArrayList<>();
+        for (ModelNode n : result.asList()) {
+            results.add(n.asString());
+        }
+        return results;
+    }
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/SecurityPropertiesTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/SecurityPropertiesTestCase.java
new file mode 100644
index 0000000..a289a98
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/SecurityPropertiesTestCase.java
@@ -0,0 +1,96 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2017, Red Hat, Inc., and individual contributors as indicated
+ * by the @authors tag.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+/**
+ * @author Tomaz Cerar (c) 2017 Red Hat Inc.
+ */
+public class SecurityPropertiesTestCase {
+
+    @Test
+    public void testPropertyDiff(){
+        Map<String, String> newMap = new HashMap<>();
+        Map<String, String> oldMap = new HashMap<>();
+
+        Map<String, String> updated = new HashMap<>();
+        Map<String, String> added = new HashMap<>();
+        Map<String, String> removed = new HashMap<>();
+
+        newMap.put("key1","value");
+        newMap.put("key2","value");
+        newMap.put("key3","value");
+
+        SecurityPropertiesWriteHandler.doDifference(newMap, oldMap, added, removed, updated );
+        Assert.assertEquals(0, updated.size());
+        Assert.assertEquals(3, added.size());
+        Assert.assertEquals(0, removed.size());
+
+        oldMap.put("key1","value2");
+
+        updated.clear();
+        removed.clear();
+        added.clear();
+
+        SecurityPropertiesWriteHandler.doDifference(newMap, oldMap, added, removed, updated);
+        Assert.assertEquals(1, updated.size());
+        Assert.assertEquals(2, added.size());
+        Assert.assertEquals(0, removed.size());
+
+
+        oldMap.put("key1", "value1");
+        oldMap.put("key2", "value2");
+        oldMap.put("key3", "value3");
+
+        updated.clear();
+        removed.clear();
+        added.clear();
+
+        SecurityPropertiesWriteHandler.doDifference(newMap, oldMap, added, removed, updated);
+        Assert.assertEquals(3, updated.size());
+        Assert.assertEquals(0, added.size());
+        Assert.assertEquals(0, removed.size());
+
+
+        newMap.clear();
+        newMap.put("key1", "value");
+        newMap.put("key2", "value");
+        newMap.put("key4", "value");
+
+        oldMap.clear();
+        oldMap.put("key1", "value1");
+        oldMap.put("key2", "value2");
+        oldMap.put("key3", "value3");
+
+        updated.clear();
+        removed.clear();
+        added.clear();
+
+        SecurityPropertiesWriteHandler.doDifference(newMap, oldMap, added, removed, updated);
+        Assert.assertEquals(2, updated.size());
+        Assert.assertEquals(1, added.size());
+        Assert.assertEquals(1, removed.size());
+
+    }
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/SubsystemParsingTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/SubsystemParsingTestCase.java
new file mode 100644
index 0000000..b107438
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/SubsystemParsingTestCase.java
@@ -0,0 +1,98 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2014 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.jboss.as.subsystem.test.AbstractSubsystemBaseTest;
+import org.jboss.as.subsystem.test.AdditionalInitialization;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.junit.Assert;
+import org.junit.Ignore;
+import org.junit.Test;
+
+/**
+ * Tests all management expects for subsystem, parsing, marshaling, model definition and other
+ * Here is an example that allows you a fine grained controller over what is tested and how. So it can give you ideas what can be done and tested.
+ * If you have no need for advanced testing of subsystem you look at {@link ElytronTlsSubsystem1_0TestCase} that tests same stuff but most of the code
+ * is hidden inside of test harness
+ *
+ * @author <a href="kabir.khan@jboss.com">Kabir Khan</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class SubsystemParsingTestCase extends AbstractSubsystemBaseTest {
+
+    public SubsystemParsingTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    @Override
+    protected String getSubsystemXml() throws IOException {
+        return readResource("elytron-tls-subsystem-1.0.xml");
+    }
+
+    @Test
+    public void testParseAndMarshalModel_TLS() throws Exception {
+        standardSubsystemTest("tls.xml");
+    }
+
+    @Test
+    public void testParseAndMarshalModel_ProviderLoader() throws Exception {
+        standardSubsystemTest("providers.xml");
+    }
+
+    @Test
+    public void testDisallowedProviders() throws Exception {
+        KernelServices services = standardSubsystemTest("providers.xml", true);
+        List<ModelNode> disallowedProviders = services.readWholeModel().get("subsystem", "elytron-tls", "disallowed-providers").asList();
+        Assert.assertNotNull(disallowedProviders);
+        Assert.assertEquals(3, disallowedProviders.size());
+    }
+
+    @Ignore("to be determined if needed")
+    @Test
+    public void testParseAndMarshalModel_Sasl() throws Exception {
+        standardSubsystemTest("sasl.xml");
+    }
+
+    @Test
+    public void testParseAndMarshalModel_SecurityProperties() throws Exception {
+        standardSubsystemTest("security-properties.xml");
+    }
+
+    @Test
+    public void testParseAndMarshalModel_CredentialStores() throws Exception {
+        standardSubsystemTest("credential-stores.xml");
+    }
+
+    @Ignore("to be determined if needed")
+    @Test
+    public void testParseAndMarshalModel_JASPI() throws Exception {
+        standardSubsystemTest("jaspi.xml");
+    }
+
+    @Override
+    protected AdditionalInitialization createAdditionalInitialization() {
+        return AdditionalInitialization.MANAGEMENT;
+    }
+
+
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/TestEnvironment.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/TestEnvironment.java
new file mode 100644
index 0000000..4ee9c56
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/TestEnvironment.java
@@ -0,0 +1,232 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.extension.elytron.tls;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.math.BigInteger;
+import java.net.URL;
+import java.nio.file.FileVisitResult;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.SimpleFileVisitor;
+import java.nio.file.attribute.BasicFileAttributes;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+
+import javax.security.auth.x500.X500Principal;
+
+import org.jboss.as.controller.RunningMode;
+import org.jboss.as.controller.capability.RuntimeCapability;
+import org.jboss.as.controller.capability.registry.RuntimeCapabilityRegistry;
+import org.jboss.as.controller.extension.ExtensionRegistry;
+import org.jboss.as.controller.registry.ManagementResourceRegistration;
+import org.jboss.as.controller.registry.Resource;
+import org.jboss.as.subsystem.test.AdditionalInitialization;
+import org.jboss.as.subsystem.test.ControllerInitializer;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.wildfly.security.x500.cert.BasicConstraintsExtension;
+import org.wildfly.security.x500.cert.SelfSignedX509CertificateAndSigningKey;
+import org.wildfly.security.x500.cert.X509CertificateBuilder;
+
+class TestEnvironment extends AdditionalInitialization {
+    // TODO reenable tests after LDAP is added
+
+    static final int LDAPS1_PORT = 11391;
+    static final int LDAPS2_PORT = 11392;
+
+    private static final String WORKING_DIRECTORY_LOCATION = "./target/test-classes/org/wildfly/extension/elytron/tls";
+    private static final char[] GENERATED_KEYSTORE_PASSWORD = "Elytron".toCharArray();
+    private static final X500Principal ISSUER_DN = new X500Principal("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA");
+    private static final X500Principal LOCALHOST_DN = new X500Principal("OU=Elytron, O=Elytron, C=CZ, ST=Elytron, CN=localhost");
+
+    private static KeyStore loadKeyStore() throws Exception{
+        KeyStore ks = KeyStore.getInstance("JKS");
+        ks.load(null, null);
+        return ks;
+    }
+
+    private static SelfSignedX509CertificateAndSigningKey createIssuer() {
+        return SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(ISSUER_DN)
+                .setKeyAlgorithmName("RSA")
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .addExtension(false, "BasicConstraints", "CA:true,pathlen:2147483647")
+                .build();
+    }
+
+    private static KeyStore createTrustStore(SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyStore trustStore = loadKeyStore();
+
+        X509Certificate issuerCertificate = issuerSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        trustStore.setCertificateEntry("mykey", issuerCertificate);
+
+        return trustStore;
+    }
+
+    private static KeyStore createLocalhostKeyStore(SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+        KeyPair localhostKeys = keyPairGenerator.generateKeyPair();
+        PrivateKey localhostSigningKey = localhostKeys.getPrivate();
+        PublicKey localhostPublicKey = localhostKeys.getPublic();
+
+        KeyStore localhostKeyStore = loadKeyStore();
+
+        X509Certificate issuerCertificate = issuerSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        localhostKeyStore.setCertificateEntry("ca", issuerCertificate);
+
+        X509Certificate localhostCertificate = new X509CertificateBuilder()
+                .setIssuerDn(ISSUER_DN)
+                .setSubjectDn(LOCALHOST_DN)
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .setSigningKey(issuerSelfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(localhostPublicKey)
+                .setSerialNumber(new BigInteger("3"))
+                .addExtension(new BasicConstraintsExtension(false, false, -1))
+                .build();
+        localhostKeyStore.setKeyEntry("localhost", localhostSigningKey, GENERATED_KEYSTORE_PASSWORD, new X509Certificate[]{localhostCertificate,issuerCertificate});
+
+        return localhostKeyStore;
+    }
+
+    private static void createTemporaryKeyStoreFile(KeyStore keyStore, File outputFile) throws Exception {
+        try (FileOutputStream fos = new FileOutputStream(outputFile)){
+            keyStore.store(fos, GENERATED_KEYSTORE_PASSWORD);
+        }
+    }
+
+    public static void setUpKeyStores() throws Exception {
+        File workingDir = new File(WORKING_DIRECTORY_LOCATION);
+        if (workingDir.exists() == false) {
+            workingDir.mkdirs();
+        }
+
+        SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey = createIssuer();
+        File trustFile = new File(workingDir, "ca.truststore");
+        KeyStore trustStore = createTrustStore(issuerSelfSignedX509CertificateAndSigningKey);
+        File localhostFile = new File(workingDir, "localhost.keystore");
+        KeyStore localhostKeyStore = createLocalhostKeyStore(issuerSelfSignedX509CertificateAndSigningKey);
+
+        createTemporaryKeyStoreFile(trustStore, trustFile);
+        createTemporaryKeyStoreFile(localhostKeyStore, localhostFile);
+    }
+
+    private final RunningMode runningMode;
+
+    TestEnvironment() {
+        this(RunningMode.NORMAL);
+    }
+
+    TestEnvironment(RunningMode runningMode) {
+        this.runningMode = runningMode;
+
+    }
+
+    @Override
+    protected RunningMode getRunningMode() {
+        return runningMode;
+    }
+
+    @Override
+    protected ControllerInitializer createControllerInitializer() {
+        ControllerInitializer initializer = new ControllerInitializer();
+
+        // TODO perform check without realms
+        try {
+            URL fsr = getClass().getResource("keystore.jceks");
+            if (fsr != null) emptyDirectory(new File(fsr.getFile()).toPath());
+        } catch (Exception e) {
+            throw new RuntimeException("Could ensure empty testing filesystem directory", e);
+        }
+
+        try {
+            initializer.addPath("jboss.server.config.dir", getClass().getResource(".").getFile(), null);
+            initializer.addPath("jboss.server.data.dir", "target", null);
+        } catch (Exception e) {
+            throw new RuntimeException("Could not create test config directory", e);
+        }
+
+        return initializer;
+    }
+
+    /* public static void startLdapService() {
+        try {
+            setUpKeyStores();
+            LdapService.builder()
+                    .setWorkingDir(new File("./target/apache-ds/working1"))
+                    .createDirectoryService("TestService1")
+                    .addPartition("Elytron", "dc=elytron,dc=wildfly,dc=org", 5, "uid")
+                    .importLdif(TestEnvironment.class.getResourceAsStream("ldap-schemas.ldif"))
+                    .importLdif(TestEnvironment.class.getResourceAsStream("ldap-data.ldif"))
+                    .addTcpServer("Default TCP", "localhost", LDAPS1_PORT, "localhost.keystore", "Elytron")
+                    .start();
+            LdapService.builder()
+                    .setWorkingDir(new File("./target/apache-ds/working2"))
+                    .createDirectoryService("TestService2")
+                    .addPartition("Elytron", "dc=elytron,dc=wildfly,dc=org", 5, "uid")
+                    .importLdif(TestEnvironment.class.getResourceAsStream("ldap-schemas.ldif"))
+                    .importLdif(TestEnvironment.class.getResourceAsStream("ldap-referred.ldif"))
+                    .addTcpServer("Default TCP", "localhost", LDAPS2_PORT, "localhost.keystore", "Elytron")
+                    .start();
+        } catch (Exception e) {
+            throw new RuntimeException("Could not start LDAP embedded server.", e);
+        }
+    } */
+
+    private void emptyDirectory(Path directory) throws IOException {
+        Files.walkFileTree(directory, new SimpleFileVisitor<Path>() {
+            @Override
+            public FileVisitResult visitFile(Path file, BasicFileAttributes attrs) throws IOException {
+                Files.delete(file);
+                return FileVisitResult.CONTINUE;
+            }
+
+            @Override
+            public FileVisitResult postVisitDirectory(Path dir, IOException exc) throws IOException {
+                Files.delete(dir);
+                return FileVisitResult.CONTINUE;
+            }
+        });
+    }
+
+    // classloader obtaining mock to load classes from testsuite
+    /* private static class ClassLoadingAttributeDefinitionsMock extends MockUp<ClassLoadingAttributeDefinitions> {
+        @Mock
+        static ClassLoader resolveClassLoader(String module) {
+            return SaslTestCase.class.getClassLoader();
+        }
+    }
+
+    static void mockCallerModuleClassloader() {
+        new ClassLoadingAttributeDefinitionsMock();
+    } */
+
+    static void activateService(KernelServices services, RuntimeCapability capability, String... dynamicNameElements) throws InterruptedException {
+        ServiceName serviceName = capability.getCapabilityServiceName(dynamicNameElements);
+        ServiceController<?> serviceController = services.getContainer().getService(serviceName);
+        serviceController.setMode(ServiceController.Mode.ACTIVE);
+        serviceController.awaitValue();
+    }
+}
diff --git a/subsystem/src/test/java/org/wildfly/extension/elytron/tls/TlsTestCase.java b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/TlsTestCase.java
new file mode 100644
index 0000000..ae64b57
--- /dev/null
+++ b/subsystem/src/test/java/org/wildfly/extension/elytron/tls/TlsTestCase.java
@@ -0,0 +1,769 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.extension.elytron.tls;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.FAILED;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.OutputStreamWriter;
+import java.math.BigInteger;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
+import java.security.AccessController;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
+import java.security.Principal;
+import java.security.PrivateKey;
+import java.security.PrivilegedAction;
+import java.security.Provider;
+import java.security.PublicKey;
+import java.security.Security;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Calendar;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLHandshakeException;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509ExtendedTrustManager;
+import javax.net.ssl.X509TrustManager;
+import javax.security.auth.x500.X500Principal;
+
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.CRLReason;
+import org.bouncycastle.cert.X509CRLHolder;
+import org.bouncycastle.cert.X509v2CRLBuilder;
+import org.bouncycastle.openssl.MiscPEMGenerator;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+import org.bouncycastle.util.io.pem.PemWriter;
+import org.hamcrest.CoreMatchers;
+import org.hamcrest.MatcherAssert;
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.security.CredentialReference;
+import org.jboss.as.subsystem.test.AbstractSubsystemTest;
+import org.jboss.as.subsystem.test.KernelServices;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceController;
+import org.jboss.msc.service.ServiceName;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.wildfly.security.WildFlyElytronProvider;
+import org.wildfly.security.ssl.X509RevocationTrustManager;
+import org.wildfly.security.x500.cert.BasicConstraintsExtension;
+import org.wildfly.security.x500.cert.SelfSignedX509CertificateAndSigningKey;
+import org.wildfly.security.x500.cert.X509CertificateBuilder;
+
+/**
+ * @author <a href="mailto:jkalina@redhat.com">Jan Kalina</a>
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class TlsTestCase extends AbstractSubsystemTest {
+
+    private static final Provider wildFlyElytronProvider = new WildFlyElytronProvider();
+    private final int TESTING_PORT = 18202;
+
+    private static CredentialStoreUtility csUtil = null;
+    private KernelServices services = null;
+
+
+    private static final String WORKING_DIRECTORY_LOCATION = "./target/test-classes/org/wildfly/extension/elytron/tls";
+    private static final File TRUST_FILE = new File(WORKING_DIRECTORY_LOCATION, "ca.truststore");
+    private static final File FIREFLY_FILE = new File(WORKING_DIRECTORY_LOCATION, "firefly.keystore");
+    private static final File LOCALHOST_FILE = new File(WORKING_DIRECTORY_LOCATION, "localhost.keystore");
+    private static final File CRL_FILE = new File(WORKING_DIRECTORY_LOCATION, "crl.pem");
+    private static final File CRL_FILE_NEW = new File(WORKING_DIRECTORY_LOCATION, "crl-new.pem");
+    private static final String INIT_TEST_FILE = "/trust-manager-reload-test.truststore";
+    private static final String INIT_TEST_TRUSTSTORE = "myTS";
+    private static final String INIT_TEST_TRUSTMANAGER = "myTM";
+
+    private static final char[] GENERATED_KEYSTORE_PASSWORD = "Elytron".toCharArray();
+    private static final String PROTOCOLS_SERVER = "enabledProtocolsServer";
+    private static final String PROTOCOLS_CLIENT = "enabledProtocolsClient";
+    private static final String NEGOTIATED_PROTOCOL = "negotiatedProtocol";
+    private static final X500Principal ISSUER_DN = new X500Principal("O=Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA ");
+    private static final X500Principal OTHER_ISSUER_DN = new X500Principal("O= Other Root Certificate Authority, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=WildFly, CN=WildFly CA ");
+    private static final X500Principal FIREFLY_DN = new X500Principal("OU=Elytron, O=Elytron, C=UK, ST=Elytron, CN=Firefly");
+    private static final X500Principal LOCALHOST_DN = new X500Principal("OU=Elytron, O=Elytron, C=CZ, ST=Elytron, CN=localhost");
+    private static final X500Principal NEW_DN = new X500Principal("O=Root Certificate Authority New, EMAILADDRESS=elytron@wildfly.org, C=UK, ST=Elytron, CN=Elytron CA");
+    public static String disabledAlgorithms;
+
+    public TlsTestCase() {
+        super(ElytronTlsExtension.SUBSYSTEM_NAME, new ElytronTlsExtension());
+    }
+
+    private static KeyStore loadKeyStore() throws Exception{
+        KeyStore ks = KeyStore.getInstance("JKS");
+        ks.load(null, null);
+        return ks;
+    }
+
+    private static SelfSignedX509CertificateAndSigningKey createIssuer(X500Principal issuerDN) {
+        return SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(issuerDN)
+                .setKeyAlgorithmName("RSA")
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .addExtension(false, "BasicConstraints", "CA:true,pathlen:2147483647")
+                .build();
+    }
+
+    private static KeyStore createTrustStore(SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyStore trustStore = loadKeyStore();
+
+        X509Certificate issuerCertificate = issuerSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        trustStore.setCertificateEntry("mykey", issuerCertificate);
+
+        return trustStore;
+    }
+
+    private static KeyStore createFireflyKeyStore(SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+        KeyPair fireflyKeys = keyPairGenerator.generateKeyPair();
+        PrivateKey fireflySigningKey = fireflyKeys.getPrivate();
+        PublicKey fireflyPublicKey = fireflyKeys.getPublic();
+
+        KeyStore fireflyKeyStore = loadKeyStore();
+        X509Certificate issuerCertificate = issuerSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        fireflyKeyStore.setCertificateEntry("ca", issuerCertificate);
+
+        X509Certificate fireflyCertificate = new X509CertificateBuilder()
+                .setIssuerDn(ISSUER_DN)
+                .setSubjectDn(FIREFLY_DN)
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .setSigningKey(issuerSelfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(fireflyPublicKey)
+                .setSerialNumber(new BigInteger("1"))
+                .addExtension(new BasicConstraintsExtension(false, false, -1))
+                .build();
+        fireflyKeyStore.setKeyEntry("firefly", fireflySigningKey, GENERATED_KEYSTORE_PASSWORD, new X509Certificate[]{fireflyCertificate,issuerCertificate});
+
+        return fireflyKeyStore;
+    }
+
+    private static KeyStore createLocalhostKeyStore(SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey) throws Exception {
+        KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
+        KeyPair localhostKeys = keyPairGenerator.generateKeyPair();
+        PrivateKey localhostSigningKey = localhostKeys.getPrivate();
+        PublicKey localhostPublicKey = localhostKeys.getPublic();
+
+        KeyStore localhostKeyStore = loadKeyStore();
+
+        X509Certificate issuerCertificate = issuerSelfSignedX509CertificateAndSigningKey.getSelfSignedCertificate();
+        localhostKeyStore.setCertificateEntry("ca", issuerCertificate);
+
+        X509Certificate localhostCertificate = new X509CertificateBuilder()
+                .setIssuerDn(ISSUER_DN)
+                .setSubjectDn(LOCALHOST_DN)
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .setSigningKey(issuerSelfSignedX509CertificateAndSigningKey.getSigningKey())
+                .setPublicKey(localhostPublicKey)
+                .setSerialNumber(new BigInteger("3"))
+                .addExtension(new BasicConstraintsExtension(false, false, -1))
+                .build();
+        localhostKeyStore.setKeyEntry("localhost", localhostSigningKey, GENERATED_KEYSTORE_PASSWORD, new X509Certificate[]{localhostCertificate,issuerCertificate});
+
+        return localhostKeyStore;
+    }
+
+    private static X509CRLHolder createCRL(SelfSignedX509CertificateAndSigningKey issuerCertificateAndSigningKey,
+                                           String[] serialNumbers) throws Exception {
+        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
+
+        Calendar calendar = Calendar.getInstance();
+        Date currentDate = calendar.getTime();
+        calendar.add(Calendar.YEAR, 1);
+        Date nextYear = calendar.getTime();
+        calendar.add(Calendar.YEAR, -1);
+        calendar.add(Calendar.SECOND, -30);
+        Date revokeDate = calendar.getTime();
+
+        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(
+                convertSunStyleToBCStyle(issuerCertificateAndSigningKey.getSelfSignedCertificate().getSubjectDN()),
+                currentDate
+        );
+
+        for (String serialNumber : serialNumbers) {
+            crlBuilder.addCRLEntry(
+                    new BigInteger(serialNumber),
+                    revokeDate,
+                    CRLReason.unspecified
+            );
+        }
+
+        return crlBuilder.setNextUpdate(nextYear).build(
+                new JcaContentSignerBuilder("SHA256withRSA")
+                        .setProvider("BC")
+                        .build(issuerCertificateAndSigningKey.getSigningKey())
+        );
+
+    }
+
+    private static org.bouncycastle.asn1.x500.X500Name convertSunStyleToBCStyle(Principal dn) {
+        String dnName = dn.getName();
+        String[] dnComponents = dnName.split(", ");
+        StringBuilder dnBuffer = new StringBuilder(dnName.length());
+
+        dnBuffer.append(dnComponents[dnComponents.length-1]);
+        for(int i = dnComponents.length-2; i >= 0; i--){
+            dnBuffer.append(',');
+            dnBuffer.append(dnComponents[i]);
+        }
+
+        return new X500Name(dnBuffer.toString());
+    }
+
+    private static void createTemporaryCRLFile(X509CRLHolder crlHolder, File outputFile) throws Exception {
+        try (PemWriter output = new PemWriter(new OutputStreamWriter(Files.newOutputStream(outputFile.toPath())))){
+            output.writeObject(new MiscPEMGenerator(crlHolder));
+        }
+    }
+
+    private static void createTemporaryKeyStoreFile(KeyStore keyStore, File outputFile) throws Exception {
+        try (FileOutputStream fos = new FileOutputStream(outputFile)){
+            keyStore.store(fos, GENERATED_KEYSTORE_PASSWORD);
+        }
+    }
+
+    private static void setUpKeyStores() throws Exception {
+        File workingDir = new File(WORKING_DIRECTORY_LOCATION);
+        if (!workingDir.exists()) {
+            workingDir.mkdirs();
+        }
+
+        SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey = createIssuer(ISSUER_DN);
+        SelfSignedX509CertificateAndSigningKey secondIssuerSelfSignedX509CertificateAndSigningKey = createIssuer(OTHER_ISSUER_DN);
+        KeyStore trustStore = createTrustStore(issuerSelfSignedX509CertificateAndSigningKey);
+
+        KeyStore fireflyKeyStore = createFireflyKeyStore(issuerSelfSignedX509CertificateAndSigningKey);
+        KeyStore localhostKeyStore = createLocalhostKeyStore(issuerSelfSignedX509CertificateAndSigningKey);
+
+        createTemporaryKeyStoreFile(trustStore, TRUST_FILE);
+        createTemporaryKeyStoreFile(fireflyKeyStore, FIREFLY_FILE);
+        createTemporaryKeyStoreFile(localhostKeyStore, LOCALHOST_FILE);
+
+        // Create CRL for LOCALHOST
+        String[] serialNumbers = new String[]{"3"};
+        X509CRLHolder crlHolder = createCRL(issuerSelfSignedX509CertificateAndSigningKey, serialNumbers);
+        createTemporaryCRLFile(crlHolder, CRL_FILE);
+
+        // Create empty CRL for some other CA to test multiple CRLs
+        serialNumbers = new String[]{};
+        X509CRLHolder crlHolderNew = createCRL(secondIssuerSelfSignedX509CertificateAndSigningKey, serialNumbers);
+        createTemporaryCRLFile(crlHolderNew, CRL_FILE_NEW);
+    }
+
+    private static void deleteKeyStoreFiles() {
+        File[] testFiles = {
+                TRUST_FILE,
+                FIREFLY_FILE,
+                LOCALHOST_FILE,
+                CRL_FILE,
+                CRL_FILE_NEW
+        };
+        for (File file : testFiles) {
+            if (file.exists()) {
+                file.delete();
+            }
+        }
+    }
+
+    private static boolean isJDK14Plus() {
+        return "14".equals(System.getProperty("java.specification.version"));
+    }
+
+    @BeforeClass
+    public static void initTests() throws Exception {
+        disabledAlgorithms = Security.getProperty("jdk.tls.disabledAlgorithms");
+        if (disabledAlgorithms != null && (disabledAlgorithms.contains("TLSv1") || disabledAlgorithms.contains("TLSv1.1"))) {
+            // reset the disabled algorithms to make sure that the protocols required in this test are available
+            Security.setProperty("jdk.tls.disabledAlgorithms", "");
+        }
+
+        if (isJDK14Plus()) return; // TODO: remove this line once WFCORE-4532 is fixed
+        setUpKeyStores();
+        AccessController.doPrivileged((PrivilegedAction<Integer>) () -> Security.insertProviderAt(wildFlyElytronProvider, 1));
+        csUtil = new CredentialStoreUtility("target/tlstest.keystore");
+        csUtil.addEntry("the-key-alias", "Elytron");
+        csUtil.addEntry("master-password-alias", "Elytron");
+    }
+
+    @AfterClass
+    public static void cleanUpTests() {
+        if (disabledAlgorithms != null) {
+            Security.setProperty("jdk.tls.disabledAlgorithms", disabledAlgorithms);
+        }
+        if (isJDK14Plus()) return; // TODO: remove this line once WFCORE-4532 is fixed
+        deleteKeyStoreFiles();
+        csUtil.cleanUp();
+        AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+            Security.removeProvider(wildFlyElytronProvider.getName());
+            return null;
+        });
+    }
+
+    @Before
+    public void prepare() throws Throwable {
+        if (services != null) return;
+        String subsystemXml;
+        if (JdkUtils.isIbmJdk()) {
+            subsystemXml = "tls-ibm.xml";
+        } else {
+            subsystemXml = JdkUtils.getJavaSpecVersion() <= 12 ? "tls-sun.xml" : "tls-oracle13plus.xml";
+        }
+        services = super.createKernelServicesBuilder(new TestEnvironment()).setSubsystemXmlResource(subsystemXml).build();
+        if (!services.isSuccessfulBoot()) {
+            Assert.fail(services.getBootError().toString());
+        }
+    }
+
+    @Test
+    public void testSslServiceNoAuth() throws Throwable {
+        testCommunication("ServerSslContextNoAuth", "ClientSslContextNoAuth", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost", null);
+    }
+
+    @Test
+    public void testSslServiceNoAuth_Default() throws Throwable {
+        testCommunication("ServerSslContextNoAuth", "ClientSslContextNoAuth", true, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost", null);
+    }
+
+    @Test
+    public void testSslServiceAuth() throws Throwable {
+        System.out.println("Ok lets begin this test." + System.getProperty("java.home"));
+        testCommunication("ServerSslContextAuth", "ClientSslContextAuth", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost", "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly");
+    }
+
+    @Test
+    public void testSslServiceAuthTLS13() throws Throwable {
+        testCommunication("ServerSslContextTLS13", "ClientSslContextTLS13", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly", "TLS_AES_256_GCM_SHA384", true);
+    }
+
+    @Test
+    public void testSslServiceAuthSSLv2Hello() throws Throwable {
+        Assume.assumeFalse("Skipping testSslServiceAuthSSLv2Hello as IBM JDK does not support enabling SSLv2Hello " +
+                "in the client", JdkUtils.isIbmJdk());
+        String[] enabledProtocols = new String[]{"SSLv2Hello", "TLSv1"};
+
+        HashMap<String, String[]> protocolChecker = new HashMap<>();
+        protocolChecker.put(PROTOCOLS_SERVER, enabledProtocols);
+        protocolChecker.put(PROTOCOLS_CLIENT, enabledProtocols);
+        protocolChecker.put(NEGOTIATED_PROTOCOL, new String[]{"TLSv1"});
+
+        testCommunication("ServerSslContextSSLv2Hello", "ClientSslContextSSLv2Hello", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly", null, false, protocolChecker);
+
+    }
+
+    @Test
+    public void testSslServiceAuthSSLv2HelloOneWay() throws Throwable {
+        Assume.assumeFalse("Skipping testSslServiceAuthSSLv2Hello as IBM JDK does not support enabling SSLv2Hello " +
+                "in the client", JdkUtils.isIbmJdk());
+        String[] enabledProtocols = new String[]{"SSLv2Hello", "TLSv1"};
+
+        HashMap<String, String[]> protocolChecker = new HashMap<>();
+        protocolChecker.put(PROTOCOLS_SERVER, enabledProtocols);
+        protocolChecker.put(PROTOCOLS_CLIENT, enabledProtocols);
+        protocolChecker.put(NEGOTIATED_PROTOCOL, new String[]{"TLSv1"});
+
+        testCommunication("ServerSslContextSSLv2HelloOneWay", "ClientSslContextSSLv2HelloOneWay", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                null, null, false, protocolChecker);
+
+    }
+
+    @Test
+    public void testSslServiceAuthProtocolMismatchSSLv2Hello() throws Throwable {
+        Assume.assumeFalse("Skipping testSslServiceAuthSSLv2Hello as IBM JDK does not support enabling SSLv2Hello " +
+                "in the client", JdkUtils.isIbmJdk());
+        try {
+            testCommunication("ServerSslContextTLS12Only", "ClientSslContextSSLv2Hello", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                    "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly");
+            fail("Excepted SSLHandshakeException not thrown");
+        } catch (SSLHandshakeException ignored) {
+
+        }
+    }
+
+    @Test
+    public void testSslServiceAuthProtocolOnlyServerSupportsSSLv2Hello() throws Throwable {
+        String[] serverEnabledProtocols = JdkUtils.isIbmJdk() ? new String[]{"TLSv1"} : new String[]{"SSLv2Hello", "TLSv1"};
+        String[] clientEnabledProtocols = new String[]{"TLSv1"};
+
+        HashMap<String, String[]> protocolChecker = new HashMap<>();
+        protocolChecker.put(PROTOCOLS_SERVER, serverEnabledProtocols);
+        protocolChecker.put(PROTOCOLS_CLIENT, clientEnabledProtocols);
+        protocolChecker.put(NEGOTIATED_PROTOCOL, new String[]{"TLSv1"});
+
+        testCommunication("ServerSslContextSSLv2Hello", "ClientSslContextOnlyTLS1", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly", null, false, protocolChecker);
+    }
+
+    /**
+     * Enables multiple protocols in the client and server excluding SSLv2Hello
+     */
+    @Test
+    public void testSslServiceAuthProtocolNoSSLv2HelloOnServerOrClient() throws Throwable {
+        String[] enabledProtocols = new String[]{"TLSv1", "TLSv1.1", "TLSv1.2"};
+
+        HashMap<String, String[]> protocolChecker = new HashMap<>();
+        protocolChecker.put(PROTOCOLS_SERVER, enabledProtocols);
+        protocolChecker.put(PROTOCOLS_CLIENT, enabledProtocols);
+        protocolChecker.put(NEGOTIATED_PROTOCOL, new String[]{"TLSv1.2"});
+
+        testCommunication("ServerSslContextMultipleProtocolsNoSSLv2Hello", "ClientSslContextMultipleProtocolsNoSSLv2Hello", false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly", null, false, protocolChecker);
+    }
+
+    @Test
+    public void testSslServiceAuthSSLv2HelloOpenSsl() throws Throwable {
+        Assume.assumeFalse("Skipping testSslServiceAuthSSLv2Hello as IBM JDK does not support enabling SSLv2Hello " +
+                "in the client", JdkUtils.isIbmJdk());
+
+        ServiceName serviceName = Capabilities.SSL_CONTEXT_RUNTIME_CAPABILITY.getCapabilityServiceName(
+                "SeverSslContextSSLv2HelloOpenSsl");
+
+        ServiceController<?> service = services.getContainer().getService(serviceName);
+        Assume.assumeTrue("Skipping testSslServiceAuthSSLv2HelloOpenSSL as WildFly OpenSSL Provider " +
+                "isn't being used as specified in WFCORE-5219", service != null && service.getValue() != null);
+
+        String[] enabledProtocols = new String[]{"SSLv2Hello", "TLSv1"};
+        HashMap<String, String[]> protocolChecker = new HashMap<>();
+        protocolChecker.put(PROTOCOLS_SERVER, enabledProtocols);
+        protocolChecker.put(PROTOCOLS_CLIENT, enabledProtocols);
+        protocolChecker.put(NEGOTIATED_PROTOCOL, new String[]{"TLSv1"});
+
+        testCommunication("SeverSslContextSSLv2HelloOpenSsl", "ClientSslContextSSLv2HelloOpenSsl", false,
+                "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly", null, false, protocolChecker);
+    }
+
+    @Test
+    public void testSslServiceAuthProtocolMismatch() throws Throwable {
+        try {
+            testCommunication("ServerSslContextTLS12Only", "ClientSslContextTLS13Only", false, "",
+                    "", "");
+            fail("Expected SSLHandshakeException not thrown");
+        } catch (SSLHandshakeException expected) {
+        }
+    }
+
+    @Test
+    public void testSslServiceAuthCipherSuiteMismatch() throws Throwable {
+        try {
+            testCommunication("ServerSslContextTLS13Only", "ClientSslContextTLS13Only", false, "",
+                    "", "");
+            fail("Expected SSLHandshakeException not thrown");
+        } catch (SSLHandshakeException expected) {
+        }
+    }
+
+    @Test(expected = SSLHandshakeException.class)
+    public void testSslServiceAuthRequiredButNotProvided() throws Throwable {
+        testCommunication("ServerSslContextAuth", "ClientSslContextNoAuth", false, "OU=Elytron,O=Elytron,C=UK,ST=Elytron,CN=Firefly", "");
+    }
+
+    @Test
+    public void testProviderTrustManager() throws Throwable {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("ProviderTrustManager");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        Assert.assertNotNull(trustManager);
+    }
+
+    @Test
+    public void testRevocationLists() throws Throwable {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-crl");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        Assert.assertNotNull(trustManager);
+
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.TRUST_MANAGER, "trust-with-crl");
+        operation.get(ClientConstants.OP).set(Constants.RELOAD_CERTIFICATE_REVOCATION_LIST);
+        assertEquals(SUCCESS, services.executeOperation(operation).get(OUTCOME).asString());
+    }
+
+    @Test
+    public void testMultipleRevocationLists() throws Throwable {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-multiple-crls");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        Assert.assertNotNull(trustManager);
+
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.TRUST_MANAGER, "trust-with-multiple-crls");
+        operation.get(ClientConstants.OP).set(Constants.RELOAD_CERTIFICATE_REVOCATION_LIST);
+        assertEquals(SUCCESS, services.executeOperation(operation).get(OUTCOME).asString());
+    }
+
+    /**
+     * Tests communication fails when server sends a certificate present in one of the CRLs
+     * configured by the client.
+     */
+    @Test(expected = SSLHandshakeException.class)
+    public void testRevocationWithMultipleCrls() throws Throwable {
+        testCommunication("ServerSslContextNoAuth", "ClientWithMultipleCRLs",
+                false, "OU=Elytron,O=Elytron,C=CZ,ST=Elytron,CN=localhost",
+                null);
+    }
+
+    @Test
+    public void testRevocationListsDp() throws Throwable {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-crl-dp");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        MatcherAssert.assertThat(trustManager, CoreMatchers.instanceOf(X509RevocationTrustManager.class));
+
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.TRUST_MANAGER, "trust-with-crl-dp");
+        operation.get(ClientConstants.OP).set(Constants.RELOAD_CERTIFICATE_REVOCATION_LIST);
+        assertEquals(FAILED, services.executeOperation(operation).get(OUTCOME).asString()); // not realoadable
+    }
+
+    /**
+     * Tests distribution points work using certificate-revocation-lists attribute
+     */
+    @Test
+    public void testCertificateRevocationListsDp() throws Throwable {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-crls-dp");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        MatcherAssert.assertThat(trustManager, CoreMatchers.instanceOf(X509RevocationTrustManager.class));
+
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.TRUST_MANAGER, "trust-with-crls-dp");
+        operation.get(ClientConstants.OP).set(Constants.RELOAD_CERTIFICATE_REVOCATION_LIST);
+        assertEquals(FAILED, services.executeOperation(operation).get(OUTCOME).asString()); // not realoadable
+    }
+
+    /**
+     * Verifies accepted issuers are sent when CRLs are configured.
+     * Verifies ELY-2057 (No acceptedIssuers sent when CRLs are configured) is resolved.
+     */
+    @Test
+    public void testAcceptedIssuersWithCRLs() throws Throwable {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-crl");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        Assert.assertNotNull(trustManager);
+        Assert.assertTrue(((X509TrustManager) trustManager).getAcceptedIssuers().length > 0);
+    }
+
+    @Test
+    public void testReloadTrustManager() throws Throwable {
+        Path resources = Paths.get(Objects.requireNonNull(TlsTestCase.class.getResource(".")).toURI());
+        Path initTestFilePath = Paths.get(WORKING_DIRECTORY_LOCATION + INIT_TEST_FILE);
+        Files.copy(Paths.get(TRUST_FILE.toString()), initTestFilePath, StandardCopyOption.REPLACE_EXISTING);
+
+        ModelNode operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.KEY_STORE, INIT_TEST_TRUSTSTORE);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.PATH).set(resources + INIT_TEST_FILE);
+        operation.get(Constants.TYPE).set("JKS");
+        operation.get(CredentialReference.CREDENTIAL_REFERENCE).get(CredentialReference.CLEAR_TEXT).set("Elytron");
+        Assert.assertEquals(SUCCESS, services.executeOperation(operation).get(OUTCOME).asString());
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.TRUST_MANAGER, INIT_TEST_TRUSTMANAGER);
+        operation.get(ClientConstants.OP).set(ClientConstants.ADD);
+        operation.get(Constants.KEY_STORE).set(INIT_TEST_TRUSTSTORE);
+        Assert.assertEquals(SUCCESS, services.executeOperation(operation).get(OUTCOME).asString());
+
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName(INIT_TEST_TRUSTMANAGER);
+        X509ExtendedTrustManager trustManager = (X509ExtendedTrustManager) services.getContainer().getService(serviceName).getValue();
+        Assert.assertNotNull(trustManager);
+        Assert.assertEquals(1, trustManager.getAcceptedIssuers().length);
+
+        X509Certificate originalFoundDN = trustManager.getAcceptedIssuers()[0];
+        Assert.assertEquals(originalFoundDN.getIssuerX500Principal().getName(), ISSUER_DN.getName());
+
+        // Update the trust store certificate
+        SelfSignedX509CertificateAndSigningKey issuerSelfSignedX509CertificateAndSigningKey = SelfSignedX509CertificateAndSigningKey.builder()
+                .setDn(NEW_DN)
+                .setKeyAlgorithmName("RSA")
+                .setSignatureAlgorithmName("SHA256withRSA")
+                .addExtension(false, "BasicConstraints", "CA:true,pathlen:2147483647")
+                .build();
+        KeyStore trustStore = createTrustStore(issuerSelfSignedX509CertificateAndSigningKey);
+        createTemporaryKeyStoreFile(trustStore, new File(WORKING_DIRECTORY_LOCATION + INIT_TEST_FILE));
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.KEY_STORE, INIT_TEST_TRUSTSTORE);
+        operation.get(ClientConstants.OP).set(Constants.LOAD);
+        Assert.assertEquals(SUCCESS, services.executeOperation(operation).get(OUTCOME).asString());
+
+        operation = new ModelNode();
+        operation.get(ClientConstants.OP_ADDR).add("subsystem", "elytron-tls").add(Constants.TRUST_MANAGER, INIT_TEST_TRUSTMANAGER);
+        operation.get(ClientConstants.OP).set(Constants.INIT);
+        Assert.assertEquals(SUCCESS, services.executeOperation(operation).get(OUTCOME).asString());
+
+        Assert.assertEquals(1, trustManager.getAcceptedIssuers().length);
+
+        // See if the trust manager contains the new certificate
+        X509Certificate newFoundDN = trustManager.getAcceptedIssuers()[0];
+        Assert.assertEquals(newFoundDN.getIssuerX500Principal().getName(), NEW_DN.getName());
+
+        Files.delete(initTestFilePath);
+    }
+
+    @Test
+    public void testOcspCrl() {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-ocsp-crl");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        MatcherAssert.assertThat(trustManager, CoreMatchers.instanceOf(X509RevocationTrustManager.class));
+    }
+
+    @Test
+    public void testOcspSimple() {
+        ServiceName serviceName = Capabilities.TRUST_MANAGER_RUNTIME_CAPABILITY.getCapabilityServiceName("trust-with-ocsp-simple");
+        TrustManager trustManager = (TrustManager) services.getContainer().getService(serviceName).getValue();
+        MatcherAssert.assertThat(trustManager, CoreMatchers.instanceOf(X509RevocationTrustManager.class));
+    }
+
+    private SSLContext getSslContext(String contextName) {
+        return getSslContext(contextName, true);
+    }
+
+    private SSLContext getSslContext(String contextName, boolean assertNotNull) {
+        ServiceName serviceName = Capabilities.SSL_CONTEXT_RUNTIME_CAPABILITY.getCapabilityServiceName(contextName);
+        SSLContext sslContext = (SSLContext) services.getContainer().getService(serviceName).getValue();
+        if (assertNotNull) {
+            Assert.assertNotNull(sslContext);
+        }
+        return sslContext;
+    }
+
+    private void testCommunication(String serverContextName, String clientContextName, boolean defaultClient, String expectedServerPrincipal, String expectedClientPrincipal) throws Throwable {
+        testCommunication(serverContextName, clientContextName, defaultClient, expectedServerPrincipal, expectedClientPrincipal, null);
+    }
+
+    private void testCommunication(String serverContextName, String clientContextName, boolean defaultClient, String expectedServerPrincipal, String expectedClientPrincipal, String expectedCipherSuite) throws Throwable {
+        testCommunication(serverContextName, clientContextName, defaultClient, expectedServerPrincipal, expectedClientPrincipal, expectedCipherSuite, false);
+    }
+
+    private void testCommunication(String serverContextName, String clientContextName, boolean defaultClient, String expectedServerPrincipal, String expectedClientPrincipal, String expectedCipherSuite, boolean tls13Test) throws Throwable {
+        testCommunication(serverContextName, clientContextName, defaultClient, expectedServerPrincipal, expectedClientPrincipal, expectedCipherSuite, tls13Test, null);
+    }
+
+    private void testCommunication(String serverContextName, String clientContextName, boolean defaultClient, String expectedServerPrincipal, String expectedClientPrincipal, String expectedCipherSuite, boolean tls13Test, Map<String, String[]> protocolChecker) throws Throwable{
+        SSLContext serverContext = getSslContext(serverContextName);
+        SSLContext clientContext = defaultClient ? SSLContext.getDefault() : getSslContext(clientContextName);
+        ServerSocket listeningSocket;
+
+
+        listeningSocket = serverContext.getServerSocketFactory().createServerSocket(TESTING_PORT, 10, InetAddress.getByName("localhost"));
+        SSLSocket clientSocket = (SSLSocket) clientContext.getSocketFactory().createSocket("localhost", TESTING_PORT);
+        SSLSocket serverSocket = (SSLSocket) listeningSocket.accept();
+
+        ExecutorService serverExecutorService = Executors.newSingleThreadExecutor();
+        Future<byte[]> serverFuture = serverExecutorService.submit(() -> {
+            try {
+                byte[] received = new byte[2];
+                serverSocket.getInputStream().read(received);
+                serverSocket.getOutputStream().write(new byte[]{0x56, 0x78});
+
+                if (expectedClientPrincipal != null) {
+                    Assert.assertEquals(expectedClientPrincipal, serverSocket.getSession().getPeerPrincipal().getName());
+                }
+
+                return received;
+            } catch (Exception e) {
+                throw new RuntimeException("Server exception", e);
+            }
+        });
+
+        ExecutorService clientExecutorService = Executors.newSingleThreadExecutor();
+        Future<byte[]> clientFuture = clientExecutorService.submit(() -> {
+            try {
+                byte[] received = new byte[2];
+                clientSocket.getOutputStream().write(new byte[]{0x12, 0x34});
+                clientSocket.getInputStream().read(received);
+
+                if (expectedServerPrincipal != null) {
+                    Assert.assertEquals(expectedServerPrincipal, clientSocket.getSession().getPeerPrincipal().getName());
+                }
+
+                return received;
+            } catch (Exception e) {
+                throw new RuntimeException("Client exception", e);
+            }
+        });
+
+        try {
+            Assert.assertArrayEquals(new byte[]{0x12, 0x34}, serverFuture.get());
+            Assert.assertArrayEquals(new byte[]{0x56, 0x78}, clientFuture.get());
+            if (expectedCipherSuite != null) {
+                Assert.assertEquals(expectedCipherSuite, serverSocket.getSession().getCipherSuite());
+                Assert.assertEquals(expectedCipherSuite, clientSocket.getSession().getCipherSuite());
+            }
+            if (protocolChecker != null) { // Check enabled protocols match what we configured
+                checkProtocolConfiguration(protocolChecker, serverSocket, clientSocket);
+            }
+            if (tls13Test) {
+                Assert.assertEquals("TLSv1.3", serverSocket.getSession().getProtocol());
+                Assert.assertEquals("TLSv1.3", clientSocket.getSession().getProtocol());
+            } else {
+                Assert.assertNotEquals("TLSv1.3", serverSocket.getSession().getProtocol()); // since TLS 1.3 is not enabled by default (WFCORE-4789)
+                Assert.assertNotEquals("TLSv1.3", clientSocket.getSession().getProtocol()); // since TLS 1.3 is not enabled by default
+            }
+        } catch (ExecutionException e) {
+            if (e.getCause() != null && e.getCause() instanceof RuntimeException && e.getCause().getCause() != null) {
+                throw e.getCause().getCause(); // unpack
+            } else {
+                throw e;
+            }
+        } finally {
+            serverSocket.close();
+            clientSocket.close();
+            listeningSocket.close();
+        }
+    }
+
+    private void checkProtocolConfiguration(Map<String, String[]> protocolChecker, SSLSocket serverSocket, SSLSocket clientSocket) {
+        Set<String> serverProtocols = new HashSet<>(Arrays.asList(serverSocket.getEnabledProtocols()));
+        Set<String> clientProtocols = new HashSet<>(Arrays.asList(clientSocket.getEnabledProtocols()));
+        Set<String> enabledServer = new HashSet<>(Arrays.asList(protocolChecker.get(PROTOCOLS_SERVER)));
+        Set<String> enabledClient = new HashSet<>(Arrays.asList(protocolChecker.get(PROTOCOLS_CLIENT)));
+
+        // Check enabled protocols match the ones we configured
+        assertEquals(enabledServer, serverProtocols);
+        assertEquals(enabledClient, clientProtocols);
+
+        // Check negotiated protocol is the one we expected
+        assertEquals(protocolChecker.get(NEGOTIATED_PROTOCOL)[0], serverSocket.getSession().getProtocol());
+        assertEquals(protocolChecker.get(NEGOTIATED_PROTOCOL)[0], clientSocket.getSession().getProtocol());
+    }
+}
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/account.keystore b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/account.keystore
new file mode 100644
index 0000000..cc62266
Binary files /dev/null and b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/account.keystore differ
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-store-updates.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-store-updates.xml
new file mode 100644
index 0000000..360409b
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-store-updates.xml
@@ -0,0 +1,14 @@
+<!-- for needs of SaslTestCase and KeyStoresTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0">
+    <credential-stores>
+        <credential-store name="store1" location="target/test.credential.store1" create="true">
+            <credential-reference clear-text="super_secret1"/>
+        </credential-store>
+        <credential-store name="store2" location="target/test.credential.store2" create="true">
+            <credential-reference clear-text="super_secret2"/>
+        </credential-store>
+        <credential-store name="store3" location="target/test.credential.store3" create="true">
+            <credential-reference clear-text="super_secret3"/>
+        </credential-store>
+    </credential-stores>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-store.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-store.xml
new file mode 100644
index 0000000..6d36283
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-store.xml
@@ -0,0 +1,17 @@
+<!-- Initial configuration as used by the CredentailStoreTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0">
+    <credential-stores>
+        <credential-store name="test" relative-to="jboss.server.config.dir" location="test.cs" create="true">
+            <credential-reference clear-text="password"/>
+        </credential-store>
+        <secret-key-credential-store name="testEmpty" relative-to="jboss.server.config.dir" path="testEmpty.cs" create="true" 
+            populate="false" />
+        <secret-key-credential-store name="test128" relative-to="jboss.server.config.dir" path="test128.cs" create="true" key-size="128" />
+        <secret-key-credential-store name="test192" relative-to="jboss.server.config.dir" path="test192.cs" create="true"
+            default-alias="192" key-size="192" />
+        <secret-key-credential-store name="test256" relative-to="jboss.server.config.dir" path="test256.cs" />
+    </credential-stores>
+    <expression-resolver default-resolver="A" prefix="CIPHER">
+        <resolver name="A" credential-store="test256" secret-key="key"/>
+    </expression-resolver>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-stores.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-stores.xml
new file mode 100644
index 0000000..59e6f5c
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/credential-stores.xml
@@ -0,0 +1,14 @@
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0">
+    <credential-stores>
+        <credential-store name="test1" relative-to="jboss.server.data.dir" location="test1.store" create="true">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+                <property name="keyAlias" value="adminKey"/>
+            </implementation-properties>
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <credential-store name="test2" relative-to="jboss.server.data.dir" modifiable="true">
+            <credential-reference store="test1" alias="to_open_test2"/>
+        </credential-store>
+    </credential-stores>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-expressions.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-expressions.xml
new file mode 100644
index 0000000..eafc85a
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-expressions.xml
@@ -0,0 +1,162 @@
+<!--
+  ~ JBoss, Home of Professional Open Source
+  ~ Copyright 2020, Red Hat, Inc., and individual contributors as indicated
+  ~ by the @authors tag.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!-- for needs of DomainTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="client" disallowed-providers="${exp.providers:test}">
+    <providers>
+        <provider-loader name="openssl" module="org.wildfly.openssl">
+            <configuration>
+                <property name="prop" value="${exp.value:val}"/>
+            </configuration>
+        </provider-loader>
+        <provider-loader name="elytron" module="org.wildfly.security.elytron" argument="${exp.argument:arg}"/>
+    </providers>
+    <tls>
+        <key-stores>
+            <key-store name="PKCS_11">
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11"/>
+            </key-store>
+            <key-store name="jks_store" alias-filter="${exp.alias.filter:one,two,three}">
+                <credential-reference clear-text="password"/>
+                <implementation type="${exp.type:jks}" provider-name="${exp.provider:SunJSSE}"/>
+                <file relative-to="jboss.server.config.dir" path="keystore.jks" required="${exp.required:true}"/>
+            </key-store>
+            <key-store name="jceks_store">
+                <credential-reference clear-text="password"/>
+                <implementation type="jceks"/>
+                <file relative-to="jboss.server.config.dir" path="keystore.jceks"/>
+            </key-store>
+            <key-store name="Custom_PKCS_11">
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11" providers="custom-loader"/>
+            </key-store>
+            <key-store name="accounts.keystore">
+                <credential-reference clear-text="elytron"/>
+                <implementation type="JKS"/>
+                <file path="accounts.keystore.jks" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <key-store name="test.keystore">
+                <credential-reference clear-text="elytron"/>
+                <implementation type="PKCS12"/>
+                <file path="test.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <!-- <ldap-key-store name="LdapKeyStore" dir-context="DirContextSsl" > -->
+                <!-- <new-item-template new-item-path="${exp.path:ou=keystore,dc=elytron,dc=wildfly,dc=org}" new-item-rdn="${exp.item:cn}"> -->
+                    <!-- <attribute name="${exp.name:objectClass}" value="${exp.value:top} ${exp.value2:inetOrgPerson}"/> -->
+                    <!-- <attribute name="sn" value="NewKeyStoreItem"/> -->
+                <!-- </new-item-template> -->
+                <!-- <search path="${exp.path:dc=elytron,dc=wildfly,dc=org}" recursive="${exp.recursive:true}" time-limit="${exp.time:1000}" filter-alias="${exp.filter:(&amp;(objectClass=inetOrgPerson)(sn={0}))}" -->
+                        <!-- filter-certificate="${exp.filter:(&amp;(objectClass=inetOrgPerson)(usercertificate={0}))}" filter-iterate="${exp.iterate:(sn=serenity*)}"/> -->
+                <!-- <attribute-mapping alias-attribute="${exp.alias:sn}" certificate-attribute="${exp.certificate:usercertificate}" certificate-chain-attribute="${exp.chain:userSMIMECertificate}" certificate-chain-encoding="${exp.encoding:PKCS7}" certificate-type="${exp.type:X.509}" key-attribute="${exp.key:userPKCS12}" -->
+                                   <!-- key-type="${exp.type:PKCS12}"/> -->
+            <!-- </ldap-key-store> -->
+            <!-- <filtering-key-store name="FilteringKeyStore" key-store="Custom_PKCS_11" alias-filter="${exp.alias.filter:NONE:+firefly}"/> -->
+        </key-stores>
+        <key-managers>
+            <key-manager name="serverKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference clear-text="password"/>
+            </key-manager>
+            <key-manager name="serverKey2" algorithm="${exp.algo:SunX509}" key-store="jks_store" providers="custom-loader" provider-name="first" alias-filter="${exp.alias:one,two,three}" generate-self-signed-certificate-host="${exp.generate:localhost}">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+            <key-manager name="clientKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+            <key-manager name="LazyKeyManager" key-store="test.keystore" generate-self-signed-certificate-host="localhost">
+                <credential-reference clear-text="elytron"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="serverTrust" algorithm="SunX509" key-store="jks_store"/>
+            <trust-manager name="serverTrust2" algorithm="SunX509" key-store="jks_store" providers="custom-loader" provider-name="first"/>
+            <trust-manager name="trust-with-crl" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list path="${exp.path:crl.pem}" relative-to="jboss.server.config.dir" maximum-cert-path="${exp.max:2}"/>
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp" algorithm="${exp.algorithm:PKIX}" key-store="jks_store">
+                <ocsp responder="${exp.responder:http://localhost/ocsp}" responder-keystore="${exp.responder.keystore:jceks_store}" responder-certificate="${exp.responder.certificate:responder-alias}"/>
+            </trust-manager>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="server" protocols="${exp.protocols:TLSv1.2}" want-client-auth="${exp.client.auth:true}" need-client-auth="${exp.need.client:true}" authentication-optional="${exp.authentication:true}"
+                                use-cipher-suites-order="${exp.cipher.suites:false}" maximum-session-cache-size="${exp.cache:10}" cipher-suite-filter="${exp.filter:DEFAULT}" cipher-suite-names="${exp.names:name}"
+                                session-timeout="${exp.session:120}" wrap="${exp.wrap:false}" key-manager="serverKey" trust-manager="serverTrust" providers="custom-loader" provider-name="${exp.provider.name:first}"/>
+            <server-ssl-context name="server2" protocols="TLSv1.2" want-client-auth="true" need-client-auth="true" authentication-optional="true"
+                                use-cipher-suites-order="false" maximum-session-cache-size="10"
+                                session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust"  providers="custom-loader" provider-name="first"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="client" protocols="TLSv1.3 TLSv1.2" key-manager="clientKey" trust-manager="serverTrust" providers="custom-loader"
+                                provider-name="first"/>
+        </client-ssl-contexts>
+        <certificate-authorities>
+            <certificate-authority name="testCA" url="${exp.url:https://www.test.com}" staging-url="${exp.staging.url:https://www.test.com}"/>
+        </certificate-authorities>
+        <certificate-authority-accounts>
+            <certificate-authority-account name="MyCA" certificate-authority="${exp.certificate.authority:LetsEncrypt}" contact-urls="${exp.contact.urls:https://www.test.com}">
+                <account-key key-store="accounts.keystore" alias="${exp.alias:server}">
+                    <credential-reference clear-text="elytron"/>
+                </account-key>
+            </certificate-authority-account>
+            <certificate-authority-account name="MyCA2" certificate-authority="testCA">
+                <account-key key-store="accounts.keystore" alias="server">
+                    <credential-reference clear-text="elytron"/>
+                </account-key>
+            </certificate-authority-account>
+        </certificate-authority-accounts>
+        <!-- <server-ssl-sni-contexts> -->
+            <!-- <server-ssl-sni-context name="sni" default-ssl-context="server"> -->
+                <!-- <sni-mapping host="server" ssl-context="server" /> -->
+                <!-- <sni-mapping host=".*\.server" ssl-context="server2" /> -->
+            <!-- </server-ssl-sni-context> -->
+        <!-- </server-ssl-sni-contexts> -->
+    </tls>
+    <credential-stores>
+        <credential-store name="test1" relative-to="jboss.server.data.dir" location="${exp.location:test1.store}" create="true" type="${exp.type:JCEKS}" provider-name="${exp.provider:provider}">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+                <property name="keyAlias" value="adminKey"/>
+            </implementation-properties>
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <credential-store name="test2" relative-to="jboss.server.data.dir" modifiable="true">
+            <credential-reference store="test1" alias="to_open_test2"/>
+        </credential-store>
+        <credential-store name="test4" relative-to="jboss.server.data.dir" path="${exp.path:test1.store}" create="true">
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <secret-key-credential-store name="secretkeycredstore" relative-to="jboss.server.data.dir" path="mysecretkeycredstore.cs" create="${exp.create:true}" populate="${exp.populate:true}" />
+        <secret-key-credential-store name="test3" relative-to="jboss.server.data.dir" path="test3.cs"
+                                     create="${exp.create:false}" populate="${exp.populate:false}"
+                                     key-size="${exp.key:192}" default-alias="${exp.alias:test3}" />
+    </credential-stores>
+    <expression-resolver default-resolver="A" prefix="G">
+        <resolver name="A" credential-store="test1" secret-key="C"/>
+        <resolver name="D" credential-store="test2" secret-key="F"/>
+    </expression-resolver>
+    <!-- <dir-contexts> -->
+        <!-- <dir-context name="DirContextSsl" authentication-context="ldapAuthContext" referral-mode="throw" url="ldaps://localhost:11391/" connection-timeout="6000" read-timeout="10000"> -->
+            <!-- <properties> -->
+                <!-- <property name="java.naming.dns.url" value="dns://dnsserver/wiz.com"/> -->
+            <!-- </properties> -->
+        <!-- </dir-context> -->
+    <!-- </dir-contexts> -->
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-subsystem-1.0.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-subsystem-1.0.xml
new file mode 100644
index 0000000..2a0caa2
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-subsystem-1.0.xml
@@ -0,0 +1,206 @@
+<!--
+  ~ JBoss, Home of Professional Open Source
+  ~ Copyright 2021, Red Hat, Inc., and individual contributors as indicated
+  ~ by the @authors tag.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<!-- for needs of DomainTestCase -->
+<!-- <subsystem xmlns="urn:wildfly:elytron:15.1" register-jaspi-factory="false" default-ssl-context="client"> -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="client">
+    <!-- <sasl>
+        <sasl-authentication-factory name="SaslAuthenticationDefinition" security-domain="MyDomain" sasl-server-factory="ConfigurableSaslServerFactory">
+            <mechanism-configuration>
+                <mechanism mechanism-name="PLAIN" pre-realm-principal-transformer="PreRealmNameRewriter" post-realm-principal-transformer="PostRealmNameRewriter"
+                           final-principal-transformer="FinalNameRewriter" realm-mapper="RegexMapper">
+                    <mechanism-realm realm-name="Test Realm" pre-realm-principal-transformer="PreRealmNameRewriter_II"
+                                     post-realm-principal-transformer="PostRealmNameRewriter_II" final-principal-transformer="FinalNameRewriter_II"
+                                     realm-mapper="RegexMapper_II"/>
+                </mechanism>
+            </mechanism-configuration>
+        </sasl-authentication-factory>
+        <sasl-authentication-factory name="KerberosHttpMgmtSaslTestCase" sasl-server-factory="KerberosHttpMgmtSaslTestCase"
+                                     security-domain="KerberosHttpMgmtSaslTestCase">
+            <mechanism-configuration>
+                <mechanism mechanism-name="GSSAPI" credential-security-factory="KerberosHttpMgmtSaslTestCase">
+                    <mechanism-realm realm-name="KerberosHttpMgmtSaslTestCase" />
+                </mechanism>
+                <mechanism mechanism-name="GS2-KRB5" credential-security-factory="KerberosHttpMgmtSaslTestCase">
+                    <mechanism-realm realm-name="KerberosHttpMgmtSaslTestCase" />
+                </mechanism>
+                <mechanism mechanism-name="GS2-KRB5-PLUS" credential-security-factory="KerberosHttpMgmtSaslTestCase">
+                    <mechanism-realm realm-name="KerberosHttpMgmtSaslTestCase" />
+                </mechanism>
+            </mechanism-configuration>
+        </sasl-authentication-factory>
+        <aggregate-sasl-server-factory name="AggregateSaslFactory">
+            <sasl-server-factory name="ProviderSaslFactory"/>
+            <sasl-server-factory name="ServiceSaslFactory"/>
+        </aggregate-sasl-server-factory>
+        <configurable-sasl-server-factory name="ConfigurableSaslServerFactory" server-name="server" protocol="test-protocol" sasl-server-factory="MechFiltering">
+            <properties>
+                <property name="a" value="b"/>
+                <property name="c" value="d"/>
+            </properties>
+            <filters>
+                <filter enabling="false" pattern="x"/>
+                <filter enabling="false" predefined="HASH_MD5"/>
+            </filters>
+        </configurable-sasl-server-factory>
+        <mechanism-provider-filtering-sasl-server-factory name="MechFiltering" sasl-server-factory="AggregateSaslFactory" enabling="false">
+            <filters>
+                <filter mechanism-name="Digest" provider-name="Sun" provider-version="1.5" version-comparison="greater-than"/>
+                <filter mechanism-name="Scram" provider-name="Sun" provider-version="1.5" version-comparison="greater-than"/>
+            </filters>
+        </mechanism-provider-filtering-sasl-server-factory>
+        <provider-sasl-server-factory name="ProviderSaslFactory" providers="TestProviderLoader"/>
+        <service-loader-sasl-server-factory name="ServiceSaslFactory" module="a.b.c"/>
+    </sasl> -->
+    <tls>
+        <key-stores>
+            <key-store name="PKCS_11">
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11"/>
+            </key-store>
+            <key-store name="jks_store" alias-filter="one,two,three">
+                <credential-reference clear-text="password"/>
+                <implementation type="jks"/>
+                <file relative-to="jboss.server.config.dir" path="keystore.jks" required="true"/>
+            </key-store>
+            <key-store name="jceks_store">
+                <credential-reference clear-text="password"/>
+                <implementation type="jceks"/>
+                <file relative-to="jboss.server.config.dir" path="keystore.jceks"/>
+            </key-store>
+            <key-store name="Custom_PKCS_11">
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11" providers="custom-loader"/>
+            </key-store>
+            <key-store name="accounts.keystore">
+                <credential-reference clear-text="elytron"/>
+                <implementation type="JKS"/>
+                <file path="accounts.keystore.jks" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <key-store name="test.keystore">
+                <credential-reference clear-text="elytron"/>
+                <implementation type="PKCS12"/>
+                <file path="test.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <!-- <filtering-key-store name="FilteringKeyStore" key-store="Custom_PKCS_11" alias-filter="NONE:+firefly"/> -->
+        </key-stores>
+        <key-managers>
+            <key-manager name="serverKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference clear-text="password"/>
+            </key-manager>
+            <key-manager name="serverKey2" algorithm="SunX509" key-store="jks_store" providers="custom-loader" provider-name="first">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+            <key-manager name="clientKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+            <key-manager name="LazyKeyManager" key-store="test.keystore" generate-self-signed-certificate-host="localhost">
+                <credential-reference clear-text="elytron"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="serverTrust" algorithm="SunX509" key-store="jks_store"/>
+            <trust-manager name="serverTrust2" algorithm="SunX509" key-store="jks_store" providers="custom-loader" provider-name="first"/>
+            <trust-manager name="trust-with-crl" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir" maximum-cert-path="2"/>
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp" algorithm="PKIX" key-store="jks_store">
+                <ocsp responder="http://localhost/ocsp" responder-keystore="jceks_store" responder-certificate="responder-alias"/>
+            </trust-manager>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="server" protocols="TLSv1.2" want-client-auth="true" need-client-auth="true" authentication-optional="true"
+                                use-cipher-suites-order="false" maximum-session-cache-size="10"
+                                session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust" providers="custom-loader" provider-name="first"/>
+            <server-ssl-context name="server2" protocols="TLSv1.2" want-client-auth="true" need-client-auth="true" authentication-optional="true"
+                                use-cipher-suites-order="false" maximum-session-cache-size="10"
+                                session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust" providers="custom-loader" provider-name="first"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="client" protocols="TLSv1.3 TLSv1.2" key-manager="clientKey" trust-manager="serverTrust" providers="custom-loader"
+                                provider-name="first"/>
+        </client-ssl-contexts>
+        <certificate-authorities>
+            <certificate-authority name="testCA" url="https://www.test.com"/>
+        </certificate-authorities>
+        <certificate-authority-accounts>
+            <certificate-authority-account name="MyCA" certificate-authority="LetsEncrypt">
+                <account-key key-store="accounts.keystore" alias="server">
+                    <credential-reference clear-text="elytron"/>
+                </account-key>
+            </certificate-authority-account>
+            <certificate-authority-account name="MyCA2" certificate-authority="testCA">
+                <account-key key-store="accounts.keystore" alias="server">
+                    <credential-reference clear-text="elytron"/>
+                </account-key>
+            </certificate-authority-account>
+        </certificate-authority-accounts>
+        <!-- <server-ssl-sni-contexts>
+            <server-ssl-sni-context name="sni" default-ssl-context="server">
+                <sni-mapping host="server" ssl-context="server" />
+                <sni-mapping host=".*\.server" ssl-context="server2" />
+            </server-ssl-sni-context>
+        </server-ssl-sni-contexts> -->
+    </tls>
+    <credential-stores>
+        <credential-store name="test1" relative-to="jboss.server.data.dir" location="test1.store" create="true">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+                <property name="keyAlias" value="adminKey"/>
+            </implementation-properties>
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <credential-store name="test2" relative-to="jboss.server.data.dir" modifiable="true">
+            <credential-reference store="test1" alias="to_open_test2"/>
+        </credential-store>
+        <credential-store name="test4" relative-to="jboss.server.data.dir" path="test1.store" create="true">
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <secret-key-credential-store name="test3" relative-to="jboss.server.data.dir" path="test3.cs" create="false" populate="false" key-size="192" default-alias="test3" />
+    </credential-stores>
+    <expression-resolver default-resolver="A" prefix="G">
+        <resolver name="A" credential-store="test1" secret-key="C"/>
+        <resolver name="D" credential-store="test2" secret-key="F"/>
+    </expression-resolver>
+    <!-- <jaspi>
+        <jaspi-configuration name="test" layer="HttpServlet" application-context="default /test" description="Test Definition">
+            <server-auth-modules>
+                <server-auth-module class-name="org.wildfly.Test" module="org.test" flag="REQUISITE">
+                    <options>
+                        <property name="a" value="b"/>
+                        <property name="c" value="d"/>
+                    </options>
+                </server-auth-module>
+                <server-auth-module class-name="org.wildfly.Test2" module="org.test2" flag="SUFFICIENT">
+                    <options>
+                        <property name="e" value="f"/>
+                        <property name="g" value="h"/>
+                    </options>
+                </server-auth-module>
+            </server-auth-modules>
+        </jaspi-configuration>
+        <jaspi-configuration name="minimal">
+            <server-auth-modules>
+                <server-auth-module class-name="org.wildfly.Test3" />
+            </server-auth-modules>
+        </jaspi-configuration>
+    </jaspi> -->
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-subsystem-test.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-subsystem-test.xml
new file mode 100644
index 0000000..8442a81
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/elytron-tls-subsystem-test.xml
@@ -0,0 +1,114 @@
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="server">
+    <!-- TODO: ssl-contexts that also create key stores, managers, oscp, etc. -->
+    <tls>
+        <key-stores>
+            <key-store name="PKCS_11">
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11"/>
+            </key-store>
+            <key-store name="jks_store" alias-filter="one,two,three">
+                <credential-reference clear-text="password"/>
+                <implementation type="jks"/>
+                <file relative-to="jboss.server.config.dir" path="keystore.jks" required="true"/>
+            </key-store>
+            <key-store name="jceks_store">
+                <credential-reference clear-text="password"/>
+                <implementation type="jceks"/>
+                <file relative-to="jboss.server.config.dir" path="keystore.jceks"/>
+            </key-store>
+            <key-store name="Custom_PKCS_11">
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11" providers="custom-loader"/>
+            </key-store>
+            <key-store name="accounts.keystore">
+                <credential-reference clear-text="elytron"/>
+                <implementation type="JKS"/>
+                <file path="accounts.keystore.jks" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <key-store name="test.keystore">
+                <credential-reference clear-text="elytron"/>
+                <implementation type="PKCS12"/>
+                <file path="test.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+        </key-stores>
+        <key-managers>
+            <key-manager name="serverKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference clear-text="password"/>
+            </key-manager>
+            <key-manager name="clientKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+            <key-manager name="LazyKeyManager" key-store="test.keystore" generate-self-signed-certificate-host="localhost">
+                <credential-reference clear-text="elytron"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="serverTrust" algorithm="SunX509" key-store="jks_store"/>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="server" protocols="TLSv1.2" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="true" use-cipher-suites-order="false" maximum-session-cache-size="10"
+                                session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust"
+                                providers="custom-loader" provider-name="first"/>
+            <server-ssl-context name="server2" protocols="TLSv1.2" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="true" use-cipher-suites-order="false" maximum-session-cache-size="10"
+                                session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust"
+                                providers="custom-loader" provider-name="first"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="client" protocols="TLSv1.3 TLSv1.2" key-manager="clientKey" trust-manager="serverTrust"
+                                providers="custom-loader" provider-name="first"/>
+        </client-ssl-contexts>
+        <certificate-authorities>
+            <certificate-authority name="testCA" url="https://www.test.com"/>
+        </certificate-authorities>
+        <certificate-authority-accounts>
+            <certificate-authority-account name="MyCA" certificate-authority="LetsEncrypt">
+                <account-key key-store="accounts.keystore" alias="server">
+                    <credential-reference clear-text="elytron"/>
+                </account-key>
+            </certificate-authority-account>
+            <certificate-authority-account name="MyCA2" certificate-authority="testCA">
+                <account-key key-store="accounts.keystore" alias="server">
+                    <credential-reference clear-text="elytron"/>
+                </account-key>
+            </certificate-authority-account>
+        </certificate-authority-accounts>
+        <!-- TODO: server-ssl-sni-context -->
+    </tls>
+    <credential-stores>
+        <credential-store name="test1" relative-to="jboss.server.data.dir" location="test1.store" create="true">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+                <property name="keyAlias" value="adminKey"/>
+            </implementation-properties>
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <credential-store name="test2" relative-to="jboss.server.data.dir" modifiable="true">
+            <credential-reference store="test1" alias="to_open_test2"/>
+        </credential-store>
+        <credential-store name="test4" relative-to="jboss.server.data.dir" path="test1.store" create="true">
+            <credential-reference clear-text="secret2"/>
+        </credential-store>
+        <secret-key-credential-store name="test3" relative-to="jboss.server.data.dir" path="test3.cs" create="false" populate="false" key-size="192" default-alias="test3" />
+    </credential-stores>
+    <expression-resolver default-resolver="A" prefix="G">
+        <resolver name="A" credential-store="test1" secret-key="C"/>
+        <resolver name="D" credential-store="test2" secret-key="F"/>
+    </expression-resolver>
+</subsystem>
\ No newline at end of file
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/expression-encryption.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/expression-encryption.xml
new file mode 100644
index 0000000..dea21b6
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/expression-encryption.xml
@@ -0,0 +1,32 @@
+<!-- Initial configuration as used by the ExpressionResolutionTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0">
+    <tls>
+        <key-stores>
+            <key-store name="KeyStoreOne">
+                <credential-reference store="CredentialStoreOne" alias="ksone"/>
+                <implementation type="jks" />
+                <file path="target/key-store-one.ks" />
+            </key-store>
+            <key-store name="KeyStoreTwo">
+                <credential-reference clear-text="${ENC::RUxZAUMQAR0sjDUg2IrglcxXWT9MLa+HPmfopnnwkzbgsepmXd8=}"/>
+                <implementation type="jks" />
+                <file path="target/key-store-two.ks" />
+            </key-store>
+        </key-stores>
+    </tls>
+    <credential-stores>
+        <credential-store name="CredentialStoreOne" location="target/credential-store-one.cs">
+            <credential-reference store="CredentialStoreTwo" alias="csone"/>
+        </credential-store>
+        <credential-store name="CredentialStoreTwo" location="target/credential-store-two.cs">
+            <credential-reference clear-text="${ENC::Initial:RUxZAUMQXUj3qP1hbXyO5PpmsbgkepjoscIf3tKXvGiPDXYqNAc=}"/>
+        </credential-store>
+        <secret-key-credential-store name="CredentialStoreThree" 
+            path="target/credential-store-three.cs" 
+            create="false" />
+    </credential-stores>
+    <expression-resolver default-resolver="Default">
+        <resolver name="Initial" credential-store="CredentialStoreThree" secret-key="testkey"/>
+        <resolver name="Default" credential-store="CredentialStoreOne" secret-key="securekey"/>
+    </expression-resolver>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/jaspi.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/jaspi.xml
new file mode 100644
index 0000000..cfe77eb
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/jaspi.xml
@@ -0,0 +1,26 @@
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" />
+<!-- <subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" register-jaspi-factory="false">
+    <jaspi>
+        <jaspi-configuration name="test" layer="HttpServlet" application-context="default /test" description="Test Definition">
+            <server-auth-modules>
+                <server-auth-module class-name="org.wildfly.Test" module="org.test" flag="REQUISITE">
+                    <options>
+                        <property name="a" value="b"/>
+                        <property name="c" value="d"/>
+                    </options>
+                </server-auth-module>
+                <server-auth-module class-name="org.wildfly.Test2" module="org.test2" flag="SUFFICIENT">
+                    <options>
+                        <property name="e" value="f"/>
+                        <property name="g" value="h"/>
+                    </options>
+                </server-auth-module>
+            </server-auth-modules>
+        </jaspi-configuration>
+        <jaspi-configuration name="minimal">
+            <server-auth-modules>
+                <server-auth-module class-name="org.wildfly.Test3" />
+            </server-auth-modules>
+        </jaspi-configuration>
+    </jaspi>
+</subsystem> -->
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/providers.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/providers.xml
new file mode 100644
index 0000000..0756b70
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/providers.xml
@@ -0,0 +1,16 @@
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" disallowed-providers="a b c">
+    <providers>
+        <aggregate-providers name="AggregateProviders">
+            <providers name="ModelConfigured" />
+            <providers name="ByClassNames" />
+        </aggregate-providers>
+        <provider-loader name="ModelConfigured" module="test.class.module" >
+            <configuration>
+                <property name="a" value="b" />
+                <property name="c" value="d" />
+            </configuration>
+        </provider-loader>
+        <provider-loader name="ByClassNames" module="test.class.module" class-names="org.wildfly.elytron-tls.TestOne org.wildfly.elytron-tls.TestTwo" argument="test-argument" />
+        <provider-loader name="PathConfigured" module="test.class.module" path="config.test" relative-to="some.path" />
+    </providers>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/security-properties.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/security-properties.xml
new file mode 100644
index 0000000..1e13f51
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/security-properties.xml
@@ -0,0 +1,6 @@
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0">
+    <security-properties>
+        <security-property name="a" value="b" />
+        <security-property name="c" value="d" />
+    </security-properties>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/test-original.keystore b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/test-original.keystore
new file mode 100644
index 0000000..d6f215c
Binary files /dev/null and b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/test-original.keystore differ
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-ibm.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-ibm.xml
new file mode 100644
index 0000000..95d805f
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-ibm.xml
@@ -0,0 +1,154 @@
+<!-- for needs of SaslTestCase and KeyStoresTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="ClientSslContextNoAuth">
+    <providers>
+        <provider-loader name="ManagerProviderLoader" class-names="com.ibm.crypto.provider.IBMJCE com.ibm.jsse.IBMJSSEProvider com.ibm.jsse2.IBMJSSEProvider2 com.ibm.security.jgss.IBMJGSSProvider com.ibm.security.cert.IBMCertPath com.ibm.security.cmskeystore.CMSProvider com.ibm.security.jgss.mech.spnego.IBMSPNEGO" />
+        <provider-loader name="openssl" module="org.wildfly.openssl"/>
+    </providers>
+    <tls>
+        <key-stores>
+            <key-store name="FireflyKeystore" >
+                <credential-reference store="test" alias="master-password-alias"/>
+                <implementation type="JKS" />
+                <file path="firefly.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <key-store name="LocalhostKeystore" >
+                <credential-reference store="test" alias="master-password-alias"/>
+                <implementation type="JKS" />
+                <file path="localhost.keystore" relative-to="jboss.server.config.dir" required="true"/>
+            </key-store>
+            <key-store name="ElytronCaTruststore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation type="JKS" />
+                <file path="target/test-classes/org/wildfly/extension/elytron/tls/ca.truststore"/>
+            </key-store>
+            <key-store name="NewKeyStore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation type="JKS" />
+                <file path="target/not-existing.keystore" required="false"/>
+            </key-store>
+            <key-store name="AutomaticKeystore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation/>
+                <file path="firefly.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <!-- TODO: reenable when filtering key stores are added -->
+            <!-- <filtering-key-store name="FilteringKeyStore" key-store="FireflyKeystore" alias-filter="NONE:+firefly"/> -->
+        </key-stores>
+        <key-managers>
+            <key-manager name="ServerKeyManager" algorithm="IbmX509" key-store="LocalhostKeystore" alias-filter="NONE:+localhost">
+                <credential-reference store="test" alias="the-key-alias"/>
+            </key-manager>
+            <key-manager name="ClientKeyManager" algorithm="IbmX509" key-store="FireflyKeystore">
+                <credential-reference clear-text="Elytron"/>
+            </key-manager>
+            <key-manager name="MyKeyManager" algorithm="IbmX509" key-store="FireflyKeystore" providers="ManagerProviderLoader" provider-name="IBMJSSE">
+                <credential-reference store="test" alias="the-key-alias"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="CaTrustManager" algorithm="IbmX509" key-store="ElytronCaTruststore" alias-filter="NONE:+mykey"/>
+            <trust-manager name="MyTrustManager" algorithm="IbmX509" key-store="ElytronCaTruststore" providers="ManagerProviderLoader" provider-name="IBMJSSE"/>
+            <trust-manager name="ProviderTrustManager" algorithm="IbmX509" key-store="ElytronCaTruststore" providers="ManagerProviderLoader" provider-name="IBMJSSE"/>
+            <trust-manager name="trust-with-crl" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir" maximum-cert-path="2"/>
+            </trust-manager>
+            <trust-manager name="trust-with-multiple-crls" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists>
+                    <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir"/>
+                    <certificate-revocation-list path="crl-new.pem" relative-to="jboss.server.config.dir" />
+                </certificate-revocation-lists>
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list />
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp-deprecated-max-cert-path" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list maximum-cert-path="1"/>
+            </trust-manager>
+            <trust-manager name="trust-with-crls-dp" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists />
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-crl" algorithm="PKIX" key-store="ElytronCaTruststore" soft-fail="true" only-leaf-cert="true">
+                <certificate-revocation-list />
+                <ocsp responder="http://localhost/ocsp"/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-simple" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <ocsp/>
+            </trust-manager>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="ServerSslContextNoAuth" key-manager="ServerKeyManager" trust-manager="CaTrustManager"/>
+            <server-ssl-context name="ServerSslContextAuth" protocols="TLSv1.3 TLSv1.2 TLSv1.1" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" use-cipher-suites-order="false"
+                                providers="ManagerProviderLoader" provider-name="IBMJSSE2" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13" protocols="TLSv1.3 TLSv1.2 TLSv1.1" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="ManagerProviderLoader" provider-name="IBMJSSE2"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13Only" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="ManagerProviderLoader" provider-name="IBMJSSE2"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS12Only" protocols="TLSv1.2" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" providers="ManagerProviderLoader"
+                                provider-name="IBMJSSE2" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13OpenSsl" protocols="TLSv1.3 TLSv1.2 TLSv1.1" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS12OnlyOpenSsl" protocols="TLSv1.2" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13OnlyOpenSsl" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextNoTLS13CipherSuites" protocols="TLSv1.2 TLSv1.3"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextSSLv2Hello" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="ManagerProviderLoader" provider-name="IBMJSSE2"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextMultipleProtocolsNoSSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="ManagerProviderLoader" provider-name="IBMJSSE2"
+                                session-timeout="321" maximum-session-cache-size="123"
+                                protocols="TLSv1 TLSv1.1 TLSv1.2"/>
+            <server-ssl-context name="ServerSslContextSSLv2HelloOneWay" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" providers="ManagerProviderLoader" provider-name="IBMJSSE2"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="ClientSslContextNoAuth" trust-manager="CaTrustManager" />
+            <client-ssl-context name="ClientSslContextAuth" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13Only" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_GCM_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13OpenSsl" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" cipher-suite-names="TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextTLS13OnlyOpenSsl" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_GCM_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextNoTLS13CipherSuites" protocols="TLSv1.2 TLSv1.3"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientWithMultipleCRLs" key-manager="ClientKeyManager" trust-manager="trust-with-multiple-crls" />
+            <client-ssl-context name="ClientSslContextOnlyTLS1" protocols="TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader" />
+            <client-ssl-context name="ClientSslContextMultipleProtocolsNoSSLv2Hello" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader" protocols="TLSv1 TLSv1.1 TLSv1.2"/>
+            <client-ssl-context name="ClientSslContextSSLv2Hello" protocols="SSLv2Hello TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextSSLv2HelloOneWay" protocols="SSLv2Hello TLSv1"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+        </client-ssl-contexts>
+    </tls>
+    <credential-stores>
+        <credential-store name="test" location="target/tlstest.keystore">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+            </implementation-properties>
+            <credential-reference clear-text="super_secret"/>
+        </credential-store>
+    </credential-stores>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-oracle13plus.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-oracle13plus.xml
new file mode 100644
index 0000000..a2a882b
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-oracle13plus.xml
@@ -0,0 +1,158 @@
+<!-- for needs of SaslTestCase and KeyStoresTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="ClientSslContextNoAuth">
+    <providers>
+        <provider-loader name="ManagerProviderLoader" class-names="sun.security.ssl.SunJSSE"/>
+        <provider-loader name="openssl" module="org.wildfly.openssl"/>
+    </providers>
+    <tls>
+        <key-stores>
+            <key-store name="FireflyKeystore" >
+                <credential-reference store="test" alias="master-password-alias"/>
+                <implementation type="JKS" />
+                <file path="firefly.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <key-store name="LocalhostKeystore" >
+                <credential-reference store="test" alias="master-password-alias"/>
+                <implementation type="JKS" />
+                <file path="localhost.keystore" relative-to="jboss.server.config.dir" required="true"/>
+            </key-store>
+            <key-store name="ElytronCaTruststore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation type="JKS" />
+                <file path="target/test-classes/org/wildfly/extension/elytron/tls/ca.truststore"/>
+            </key-store>
+            <key-store name="NewKeyStore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation type="JKS" />
+                <file path="target/not-existing.keystore" required="false"/>
+            </key-store>
+            <key-store name="AutomaticKeystore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation/>
+                <file path="firefly.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <!-- <filtering-key-store name="FilteringKeyStore" key-store="FireflyKeystore" alias-filter="NONE:+firefly"/> -->
+        </key-stores>
+        <key-managers>
+            <key-manager name="ServerKeyManager" algorithm="SunX509" key-store="LocalhostKeystore" alias-filter="NONE:+localhost">
+                <credential-reference store="test" alias="the-key-alias"/>
+            </key-manager>
+            <key-manager name="ClientKeyManager" algorithm="SunX509" key-store="FireflyKeystore">
+                <credential-reference clear-text="Elytron"/>
+            </key-manager>
+            <key-manager name="MyKeyManager" algorithm="SunX509" key-store="FireflyKeystore" providers="ManagerProviderLoader" provider-name="SunJSSE">
+                <credential-reference store="test" alias="the-key-alias"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="CaTrustManager" algorithm="SunX509" key-store="ElytronCaTruststore" alias-filter="NONE:+mykey"/>
+            <trust-manager name="MyTrustManager" algorithm="SunX509" key-store="ElytronCaTruststore" providers="ManagerProviderLoader" provider-name="SunJSSE"/>
+            <trust-manager name="ProviderTrustManager" algorithm="SunX509" key-store="ElytronCaTruststore" providers="ManagerProviderLoader" provider-name="SunJSSE"/>
+            <trust-manager name="trust-with-crl" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir" maximum-cert-path="2"/>
+            </trust-manager>
+            <trust-manager name="trust-with-multiple-crls" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists>
+                    <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir"/>
+                    <certificate-revocation-list path="crl-new.pem" relative-to="jboss.server.config.dir" />
+                </certificate-revocation-lists>
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list />
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp-deprecated-max-cert-path" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list maximum-cert-path="1"/>
+            </trust-manager>
+            <trust-manager name="trust-with-crls-dp" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists />
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-crl" algorithm="PKIX" key-store="ElytronCaTruststore" soft-fail="true" only-leaf-cert="true">
+                <certificate-revocation-list />
+                <ocsp responder="http://localhost/ocsp"/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-simple" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <ocsp/>
+            </trust-manager>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="ServerSslContextNoAuth" key-manager="ServerKeyManager" trust-manager="CaTrustManager"/>
+            <server-ssl-context name="ServerSslContextAuth" protocols="TLSv1.3 TLSv1.2 TLSv1.1" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" use-cipher-suites-order="false"
+                                providers="ManagerProviderLoader" provider-name="SunJSSE" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13" protocols="TLSv1.3 TLSv1.2 TLSv1.1" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13Only" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS12Only" protocols="TLSv1.2" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" providers="ManagerProviderLoader"
+                                provider-name="SunJSSE" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13OpenSsl" protocols="TLSv1.3 TLSv1.2 TLSv1.1" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS12OnlyOpenSsl" protocols="TLSv1.2" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13OnlyOpenSsl" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextNoTLS13CipherSuites" protocols="TLSv1.2 TLSv1.3"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextSSLv2Hello" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextMultipleProtocolsNoSSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"
+                                protocols="TLSv1 TLSv1.1 TLSv1.2"/>
+            <server-ssl-context name="SeverSslContextSSLv2HelloOpenSsl" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="openssl" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextSSLv2HelloOneWay" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="ClientSslContextNoAuth" trust-manager="CaTrustManager" />
+            <client-ssl-context name="ClientSslContextAuth" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13Only" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_GCM_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13OpenSsl" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" cipher-suite-names="TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextTLS13OnlyOpenSsl" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_GCM_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextNoTLS13CipherSuites" protocols="TLSv1.2 TLSv1.3"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientWithMultipleCRLs" key-manager="ClientKeyManager" trust-manager="trust-with-multiple-crls" />
+            <client-ssl-context name="ClientSslContextSSLv2Hello" protocols="SSLv2Hello TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextOnlyTLS1" protocols="TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader" />
+            <client-ssl-context name="ClientSslContextMultipleProtocolsNoSSLv2Hello" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader" protocols="TLSv1 TLSv1.1 TLSv1.2"/>
+            <client-ssl-context name="ClientSslContextSSLv2HelloOpenSsl" protocols="SSLv2Hello TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextSSLv2HelloOneWay" protocols="SSLv2Hello TLSv1"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+        </client-ssl-contexts>
+    </tls>
+    <credential-stores>
+        <credential-store name="test" location="target/tlstest.keystore">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+            </implementation-properties>
+            <credential-reference clear-text="super_secret"/>
+        </credential-store>
+    </credential-stores>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-sun.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-sun.xml
new file mode 100644
index 0000000..b4cd116
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls-sun.xml
@@ -0,0 +1,158 @@
+<!-- for needs of SaslTestCase and KeyStoresTestCase -->
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="ClientSslContextNoAuth">
+    <providers>
+        <provider-loader name="ManagerProviderLoader" class-names="com.sun.net.ssl.internal.ssl.Provider" />
+        <provider-loader name="openssl" module="org.wildfly.openssl"/>
+    </providers>
+    <tls>
+        <key-stores>
+            <key-store name="FireflyKeystore" >
+                <credential-reference store="test" alias="master-password-alias"/>
+                <implementation type="JKS" />
+                <file path="firefly.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <key-store name="LocalhostKeystore" >
+                <credential-reference store="test" alias="master-password-alias"/>
+                <implementation type="JKS" />
+                <file path="localhost.keystore" relative-to="jboss.server.config.dir" required="true"/>
+            </key-store>
+            <key-store name="ElytronCaTruststore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation type="JKS" />
+                <file path="target/test-classes/org/wildfly/extension/elytron/tls/ca.truststore"/>
+            </key-store>
+            <key-store name="NewKeyStore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation type="JKS" />
+                <file path="target/not-existing.keystore" required="false"/>
+            </key-store>
+            <key-store name="AutomaticKeystore" >
+                <credential-reference clear-text="Elytron"/>
+                <implementation/>
+                <file path="firefly.keystore" relative-to="jboss.server.config.dir"/>
+            </key-store>
+            <!-- <filtering-key-store name="FilteringKeyStore" key-store="FireflyKeystore" alias-filter="NONE:+firefly"/> -->
+        </key-stores>
+        <key-managers>
+            <key-manager name="ServerKeyManager" algorithm="SunX509" key-store="LocalhostKeystore" alias-filter="NONE:+localhost">
+                <credential-reference store="test" alias="the-key-alias"/>
+            </key-manager>
+            <key-manager name="ClientKeyManager" algorithm="SunX509" key-store="FireflyKeystore">
+                <credential-reference clear-text="Elytron"/>
+            </key-manager>
+            <key-manager name="MyKeyManager" algorithm="SunX509" key-store="FireflyKeystore" providers="ManagerProviderLoader" provider-name="SunJSSE">
+                <credential-reference store="test" alias="the-key-alias"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="CaTrustManager" algorithm="SunX509" key-store="ElytronCaTruststore" alias-filter="NONE:+mykey"/>
+            <trust-manager name="MyTrustManager" algorithm="SunX509" key-store="ElytronCaTruststore" providers="ManagerProviderLoader" provider-name="SunJSSE"/>
+            <trust-manager name="ProviderTrustManager" algorithm="SunX509" key-store="ElytronCaTruststore" providers="ManagerProviderLoader" provider-name="SunJSSE"/>
+            <trust-manager name="trust-with-crl" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir" maximum-cert-path="2"/>
+            </trust-manager>
+            <trust-manager name="trust-with-multiple-crls" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists>
+                    <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir"/>
+                    <certificate-revocation-list path="crl-new.pem" relative-to="jboss.server.config.dir" />
+                </certificate-revocation-lists>
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list />
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp-deprecated-max-cert-path" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-list maximum-cert-path="1"/>
+            </trust-manager>
+            <trust-manager name="trust-with-crls-dp" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists />
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-crl" algorithm="PKIX" key-store="ElytronCaTruststore" soft-fail="true" only-leaf-cert="true">
+                <certificate-revocation-list />
+                <ocsp responder="http://localhost/ocsp"/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-simple" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <ocsp/>
+            </trust-manager>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="ServerSslContextNoAuth" key-manager="ServerKeyManager" trust-manager="CaTrustManager"/>
+            <server-ssl-context name="ServerSslContextAuth" protocols="TLSv1.3 TLSv1.2 TLSv1.1" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" use-cipher-suites-order="false"
+                                providers="ManagerProviderLoader" provider-name="SunJSSE" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13" protocols="TLSv1.3 TLSv1.2 TLSv1.1" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13Only" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS12Only" protocols="TLSv1.2" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" providers="ManagerProviderLoader"
+                                provider-name="SunJSSE" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13OpenSsl" protocols="TLSv1.3 TLSv1.2 TLSv1.1" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS12OnlyOpenSsl" protocols="TLSv1.2" key-manager="ServerKeyManager" trust-manager="CaTrustManager"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextTLS13OnlyOpenSsl" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextNoTLS13CipherSuites" protocols="TLSv1.2 TLSv1.3"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" use-cipher-suites-order="false" providers="openssl"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextSSLv2Hello" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextMultipleProtocolsNoSSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"
+                                protocols="TLSv1 TLSv1.1 TLSv1.2"/>
+            <server-ssl-context name="SeverSslContextSSLv2HelloOpenSsl" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" trust-manager="CaTrustManager" want-client-auth="true" need-client-auth="true"
+                                authentication-optional="false" providers="openssl" session-timeout="321" maximum-session-cache-size="123"/>
+            <server-ssl-context name="ServerSslContextSSLv2HelloOneWay" protocols="TLSv1 SSLv2Hello"
+                                key-manager="ServerKeyManager" providers="ManagerProviderLoader" provider-name="SunJSSE"
+                                session-timeout="321" maximum-session-cache-size="123"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="ClientSslContextNoAuth" trust-manager="CaTrustManager" />
+            <client-ssl-context name="ClientSslContextAuth" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13Only" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_GCM_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextTLS13OpenSsl" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2" cipher-suite-names="TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextTLS13OnlyOpenSsl" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_GCM_SHA256"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextNoTLS13CipherSuites" protocols="TLSv1.2 TLSv1.3"
+                                key-manager="ClientKeyManager" trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientWithMultipleCRLs" key-manager="ClientKeyManager" trust-manager="trust-with-multiple-crls" />
+            <client-ssl-context name="ClientSslContextSSLv2Hello" protocols="SSLv2Hello TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+            <client-ssl-context name="ClientSslContextOnlyTLS1" protocols="TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader" />
+            <client-ssl-context name="ClientSslContextMultipleProtocolsNoSSLv2Hello" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader" protocols="TLSv1 TLSv1.1 TLSv1.2"/>
+            <client-ssl-context name="ClientSslContextSSLv2HelloOpenSsl" protocols="SSLv2Hello TLSv1" key-manager="ClientKeyManager"
+                                trust-manager="CaTrustManager" providers="openssl"/>
+            <client-ssl-context name="ClientSslContextSSLv2HelloOneWay" protocols="SSLv2Hello TLSv1"
+                                trust-manager="CaTrustManager" providers="ManagerProviderLoader"/>
+        </client-ssl-contexts>
+    </tls>
+    <credential-stores>
+        <credential-store name="test" location="target/tlstest.keystore">
+            <implementation-properties>
+                <property name="keyStoreType" value="JCEKS"/>
+            </implementation-properties>
+            <credential-reference clear-text="super_secret"/>
+        </credential-store>
+    </credential-stores>
+</subsystem>
diff --git a/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls.xml b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls.xml
new file mode 100644
index 0000000..746fd57
--- /dev/null
+++ b/subsystem/src/test/resources/org/wildfly/extension/elytron/tls/tls.xml
@@ -0,0 +1,87 @@
+<subsystem xmlns="urn:wildfly:elytron-tls-subsystem:1.0" default-ssl-context="client">
+    <providers>
+        <provider-loader name="custom-loader" />
+    </providers>
+    <tls>
+        <key-stores>
+            <key-store name="PKCS_11" >
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11"/>
+            </key-store>
+            <key-store name="jks_store" alias-filter="one,two,three">
+                <credential-reference clear-text="password"/>
+                <implementation type="jks" />
+                <file relative-to="jboss.server.config.dir" path="keystore.jks" required="true" />
+            </key-store>
+            <key-store name="jceks_store" >
+                <credential-reference clear-text="password"/>
+                <implementation type="jceks" />
+                <file relative-to="jboss.server.config.dir" path="keystore.jceks" />
+            </key-store>
+            <key-store name="Custom_PKCS_11" >
+                <credential-reference clear-text="password"/>
+                <implementation type="PKCS#11" provider-name="SunPKCS#11" providers="custom-loader" />
+            </key-store>
+    <!--    <filtering-key-store name="FilteringKeyStore" key-store="Custom_PKCS_11" alias-filter="NONE:+firefly"/>-->
+        </key-stores>
+        <key-managers>
+            <key-manager name="serverKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference clear-text="password"/>
+            </key-manager>
+            <key-manager name="serverKey2" algorithm="SunX509" key-store="jks_store" providers="custom-loader" provider-name="first">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+            <key-manager name="clientKey" algorithm="SunX509" key-store="jks_store">
+                <credential-reference store="credstore1" alias="password-alias" type="PasswordCredential"/>
+            </key-manager>
+        </key-managers>
+        <trust-managers>
+            <trust-manager name="serverTrust" algorithm="SunX509" key-store="jks_store" />
+            <trust-manager name="serverTrust2" algorithm="SunX509" key-store="jks_store" providers="custom-loader" provider-name="first" />
+            <trust-manager name="trust-with-crl" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir" maximum-cert-path="2"/>
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list />
+            </trust-manager>
+            <trust-manager name="trust-with-crl-dp-deprecated-max-cert-path" algorithm="SunX509" key-store="jks_store">
+                <certificate-revocation-list maximum-cert-path="1"/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-crl" algorithm="PKIX" key-store="jks_store" soft-fail="true" only-leaf-cert="true">
+                <certificate-revocation-list />
+                <ocsp responder="http://localhost/ocsp"/>
+            </trust-manager>
+            <trust-manager name="trust-with-ocsp-simple" algorithm="PKIX" key-store="jks_store">
+                <ocsp/>
+            </trust-manager>
+            <trust-manager name="trust-with-multiple-crls" algorithm="PKIX" key-store="ElytronCaTruststore">
+                <certificate-revocation-lists>
+                    <certificate-revocation-list path="crl.pem" relative-to="jboss.server.config.dir"/>
+                    <certificate-revocation-list path="crl-new.pem" relative-to="jboss.server.config.dir" />
+                </certificate-revocation-lists>
+            </trust-manager>
+        </trust-managers>
+        <server-ssl-contexts>
+            <server-ssl-context name="server" protocols="TLSv1.2" want-client-auth="true" need-client-auth="true" authentication-optional="true" use-cipher-suites-order="false" maximum-session-cache-size="10"
+                session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust" providers="custom-loader" provider-name="first" />
+            <server-ssl-context name="serverTLS13" protocols="TLSv1.3" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"
+                                want-client-auth="true" need-client-auth="true" authentication-optional="true" use-cipher-suites-order="false"
+                                maximum-session-cache-size="10" session-timeout="120" wrap="false" key-manager="serverKey" trust-manager="serverTrust"
+                                providers="custom-loader" provider-name="first" />
+            <server-ssl-context name="serverSSLv2Hello" protocols="TLSv1 SSLv2Hello" key-manager="serverKey" trust-manager="serverTrust" session-timeout="120"
+                                want-client-auth="true" need-client-auth="true"/>
+        </server-ssl-contexts>
+        <client-ssl-contexts>
+            <client-ssl-context name="client" protocols="TLSv1.3 TLSv1.2" key-manager="clientKey" trust-manager="serverTrust" providers="custom-loader" provider-name="first" />
+            <client-ssl-context name="clientTLS13" protocols="TLSv1.3 TLSv1.2" key-manager="clientKey" trust-manager="serverTrust" providers="custom-loader"
+                                provider-name="first" cipher-suite-names="TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384"/>
+            <client-ssl-context name="clientSSlv2Hello" protocols="SSLv2Hello TLSv1" key-manager="clientKey" trust-manager="serverTrust" providers="custom-loader"
+                                provider-name="first" />
+        </client-ssl-contexts>
+    </tls>
+    <credential-stores>
+        <credential-store name="credstore1">
+            <credential-reference store="mystore" alias="the-alias"/>
+        </credential-store>
+    </credential-stores>
+</subsystem>
diff --git a/testsuite/integration/elytron-tls/pom.xml b/testsuite/integration/elytron-tls/pom.xml
new file mode 100644
index 0000000..2ea23a1
--- /dev/null
+++ b/testsuite/integration/elytron-tls/pom.xml
@@ -0,0 +1,113 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>elytron-tls-testsuite-integration</artifactId>
+        <groupId>org.wildfly.extras.elytron-tls</groupId>
+        <version>1.0.0.Alpha-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>elytron-tls-testsuite-integration-elytron-tls</artifactId>
+    <name>Elytron TLS: Testsuite - Elytron TLS Integration</name>
+
+    <dependencies>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>elytron-tls-galleon-pack</artifactId>
+            <type>pom</type>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>elytron-tls-subsystem</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.core</groupId>
+            <artifactId>wildfly-core-test-runner</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.security</groupId>
+            <artifactId>wildfly-elytron-tests-common</artifactId>
+            <type>test-jar</type>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.openssl</groupId>
+            <artifactId>wildfly-openssl-java</artifactId>
+        </dependency>
+    </dependencies>
+
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.wildfly.plugins</groupId>
+                <artifactId>wildfly-maven-plugin</artifactId>
+                <configuration>
+                    <feature-packs>
+                        <feature-pack>
+                            <groupId>org.wildfly</groupId>
+                            <artifactId>wildfly-galleon-pack</artifactId>
+                            <version>${version.org.wildfly}</version>
+                        </feature-pack>
+                        <feature-pack>
+                            <groupId>${project.groupId}</groupId>
+                            <artifactId>elytron-tls-galleon-pack</artifactId>
+                            <version>${project.version}</version>
+                        </feature-pack>
+                    </feature-packs>
+                    <layers>
+                        <layer>web-server</layer>
+                        <layer>jmx-remoting</layer>
+                        <!-- Layers from this FP  -->
+                        <layer>elytron-tls</layer>
+                    </layers>
+                    <galleon-options>
+                        <jboss-maven-dist/>
+                        <jboss-fork-embedded>${galleon.fork.embedded}</jboss-fork-embedded>
+                    </galleon-options>
+                    <provisioning-dir>wildfly</provisioning-dir>
+                    <log-provisioning-time>${galleon.log.time}</log-provisioning-time>
+                    <offline>true</offline>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>server-provisioning</id>
+                        <goals>
+                            <goal>provision</goal>
+                        </goals>
+                        <phase>compile</phase>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <systemPropertyVariables combine.children="append">
+                        <jboss.install.dir>${jboss.dist}</jboss.install.dir>
+                        <server.jvm.args>${server.jvm.args}</server.jvm.args>
+                    </systemPropertyVariables>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
\ No newline at end of file
diff --git a/testsuite/integration/elytron-tls/src/test/config/arq/arquillian.xml b/testsuite/integration/elytron-tls/src/test/config/arq/arquillian.xml
new file mode 100644
index 0000000..479926b
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/config/arq/arquillian.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<arquillian xmlns="http://jboss.org/schema/arquillian" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://jboss.org/schema/arquillian http://jboss.org/schema/arquillian/arquillian_1_0.xsd">
+
+    <defaultProtocol type="jmx-as7"/>
+
+    <container qualifier="jboss" default="true">
+        <configuration>
+            <property name="jbossHome">${jboss.install.dir}</property>
+            <property name="javaVmArguments">${server.jvm.args}</property>
+            <property name="serverConfig">${jboss.server.config.file.name:standalone.xml}</property>
+            <property name="jbossArguments">${jboss.args}</property>
+            <property name="allowConnectingToRunningServer">true</property>
+            <property name="managementAddress">${node0:127.0.0.1}</property>
+            <property name="managementPort">${as.managementPort:9990}</property>
+            <property name="waitForPorts">${as.debug.port:8787} ${as.managementPort:9990}</property>
+            <property name="waitForPortsTimeoutInSeconds">8</property>
+        </configuration>
+    </container>
+</arquillian>
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/jboss/as/test/shared/CliUtils.java b/testsuite/integration/elytron-tls/src/test/java/org/jboss/as/test/shared/CliUtils.java
new file mode 100644
index 0000000..3690729
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/jboss/as/test/shared/CliUtils.java
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2016 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.jboss.as.test.shared;
+
+import static org.wildfly.common.Assert.checkNotNullParamWithNullPointerException;
+
+/**
+ * CLI helper methods.
+ *
+ * @author Josef Cacek
+ */
+public class CliUtils {
+
+    /**
+     * Escapes given path String for CLI.
+     *
+     * @param path path string to escape (must be not-<code>null</code>)
+     * @return escaped path
+     */
+    public static String escapePath(String path) {
+        return checkNotNullParamWithNullPointerException("path", path).replace("\\", "\\\\");
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/OpenSslTlsTestCase.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/OpenSslTlsTestCase.java
new file mode 100644
index 0000000..81e8db9
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/OpenSslTlsTestCase.java
@@ -0,0 +1,427 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2021 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @authors tag. All rights reserved.
+ * See the copyright.txt in the distribution for a
+ * full listing of individual contributors.
+ * This copyrighted material is made available to anyone wishing to use,
+ * modify, copy, or redistribute it subject to the terms and conditions
+ * of the GNU Lesser General Public License, v. 2.1.
+ * This program is distributed in the hope that it will be useful, but WITHOUT A
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ * You should have received a copy of the GNU Lesser General Public License,
+ * v.2.1 along with this distribution; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+ * MA  02110-1301, USA.
+ */
+package org.wildfly.test.integration.extension.elytron.tls;
+
+import static org.jboss.as.controller.client.helpers.ClientConstants.CONTENT;
+import static org.jboss.as.controller.client.helpers.ClientConstants.DEPLOYMENT;
+import static org.jboss.as.controller.client.helpers.ClientConstants.WRITE_ATTRIBUTE_OPERATION;
+import static org.jboss.as.controller.client.helpers.Operations.createAddOperation;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUBSYSTEM;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.UNDEFINE_ATTRIBUTE_OPERATION;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FilePermission;
+import java.io.IOException;
+import java.lang.reflect.ReflectPermission;
+import java.nio.file.Files;
+import java.security.KeyStore;
+import java.security.Provider;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.regex.Pattern;
+
+import javax.inject.Inject;
+import javax.net.ssl.KeyManager;
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509ExtendedKeyManager;
+import javax.net.ssl.X509TrustManager;
+
+import org.apache.commons.io.FileUtils;
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.client.OperationBuilder;
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.client.helpers.Operations;
+import org.jboss.as.controller.client.helpers.standalone.ServerDeploymentHelper;
+import org.jboss.as.controller.operations.common.Util;
+import org.jboss.as.test.integration.management.util.ServerReload;
+import org.jboss.as.test.shared.PermissionUtils;
+import org.jboss.as.test.shared.TestSuiteEnvironment;
+import org.jboss.dmr.ModelNode;
+import org.jboss.msc.service.ServiceActivator;
+import org.jboss.shrinkwrap.api.Archive;
+import org.jboss.shrinkwrap.api.ShrinkWrap;
+import org.jboss.shrinkwrap.api.asset.StringAsset;
+import org.jboss.shrinkwrap.api.exporter.ZipExporter;
+import org.jboss.shrinkwrap.api.spec.JavaArchive;
+import org.junit.Assert;
+import org.junit.Assume;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.wildfly.core.testrunner.ManagementClient;
+import org.wildfly.core.testrunner.ServerSetupTask;
+import org.wildfly.core.testrunner.WildflyTestRunner;
+import org.wildfly.extension.elytron.tls.ElytronTlsExtension;
+import org.wildfly.openssl.OpenSSLProvider;
+import org.wildfly.security.ssl.CipherSuiteSelector;
+import org.wildfly.security.ssl.ProtocolSelector;
+import org.wildfly.security.ssl.SSLContextBuilder;
+import org.wildfly.security.ssl.test.util.CAGenerationTool;
+import org.wildfly.security.ssl.test.util.CAGenerationTool.Identity;
+import org.wildfly.test.security.common.TestRunnerConfigSetupTask;
+import org.wildfly.test.security.common.elytron.ConfigurableElement;
+import org.wildfly.test.security.common.elytron.CredentialReference;
+import org.wildfly.test.security.common.elytron.tls.subsystem.SimpleTlsKeyManager;
+import org.wildfly.test.security.common.elytron.tls.subsystem.SimpleTlsKeyStore;
+import org.wildfly.test.security.common.elytron.tls.subsystem.SimpleTlsServerSslContext;
+import org.wildfly.test.security.common.elytron.tls.subsystem.SimpleTlsTrustManager;
+import org.wildfly.test.security.common.elytron.tls.subsystem.CliPath;
+import org.wildfly.test.undertow.UndertowSSLService;
+import org.wildfly.test.undertow.UndertowSSLServiceActivator;
+import org.wildfly.test.undertow.UndertowServiceActivator;
+import org.xnio.OptionMap;
+import org.xnio.Xnio;
+
+import io.undertow.protocols.ssl.UndertowXnioSsl;
+
+@RunWith(WildflyTestRunner.class)
+@org.wildfly.core.testrunner.ServerSetup({ OpenSslTlsTestCase.KeyMaterialSetup.class, OpenSslTlsTestCase.ServerSetup.class })
+public class OpenSslTlsTestCase {
+
+    @Inject
+    protected ManagementClient managementClient;
+
+    private static final String javaSpecVersion = System.getProperty("java.specification.version");
+    private static final String PASSWORD = "Elytron";
+
+    private static final String SERVER_KEY_STORE_NAME = "serverKS";
+    private static final String SERVER_TRUST_STORE_NAME = "serverTS";
+    private static final String SERVER_KEY_MANAGER_NAME = "serverKM";
+    private static final String SERVER_TRUST_MANAGER_NAME = "serverTM";
+    private static final String SERVER_SSL_CONTEXT_NAME = "test-context";
+
+    private static final PathAddress ROOT_ADDRESS = PathAddress.pathAddress(SUBSYSTEM, ElytronTlsExtension.SUBSYSTEM_NAME);
+    private static final PathAddress SERVER_SSL_CONTEXT_ADDRESS = ROOT_ADDRESS.append("server-ssl-context", SERVER_SSL_CONTEXT_NAME);
+    private static final Pattern OPENSSL_TLSv13_PATTERN = Pattern.compile("^(TLS_AES_128_GCM_SHA256|TLS_AES_256_GCM_SHA384|TLS_CHACHA20_POLY1305_SHA256|TLS_AES_128_CCM_SHA256|TLS_AES_128_CCM_8_SHA256)$");
+
+    private static CAGenerationTool caGenerationTool;
+    private static final File WORK_DIR;
+    private static final OpenSSLProvider openSslProvider = new OpenSSLProvider();
+
+    static {
+        try {
+            WORK_DIR = Files.createTempDirectory("jks-").toFile();
+        } catch (IOException e) {
+            throw new RuntimeException("Unable to create temporary folder", e);
+        }
+    }
+    private static final File SERVER_KEY_STORE_FILE = new File(WORK_DIR, "scarab.keystore");
+    private static final File CLIENT_KEY_STORE_FILE = new File(WORK_DIR, "ladybird.keystore");
+    private static final File TRUST_STORE_FILE = new File(WORK_DIR, "ca.truststore");
+    private static final String TEST_JAR = "test.jar";
+
+    @BeforeClass
+    public static void noJDK14Plus() {
+        Assume.assumeFalse("Avoiding JDK 14+ due to https://issues.jboss.org/browse/WFCORE-4532", getJavaSpecVersion() >= 14);
+    }
+
+    @BeforeClass
+    public static void isJDK11Plus() {
+        Assume.assumeTrue("OpenSSL only supports TLSv1.3 with JDK 11+", getJavaSpecVersion() >= 11);
+    }
+
+    @BeforeClass
+    public static void isOpenSSL111OrHigher() {
+        Assume.assumeTrue("OpenSSL version in use does not support TLS 1.3", isOpenSslTls13Enabled());
+    }
+
+    private static boolean isOpenSslTls13Enabled() {
+        SSLContext sslContext;
+        try {
+            sslContext = SSLContext.getInstance("TLSv1.3", openSslProvider);
+            String[] OPENSSL_AVAILABLE_CIPHERSUITES = sslContext.getSupportedSSLParameters().getCipherSuites();
+            for (String cipherSuite : OPENSSL_AVAILABLE_CIPHERSUITES) {
+                if (OPENSSL_TLSv13_PATTERN.matcher(cipherSuite).matches()) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            return false;
+        }
+        return false;
+    }
+
+    private static int getJavaSpecVersion() {
+        if ("1.8".equals(javaSpecVersion)) return 8;
+        return Integer.parseInt(javaSpecVersion);
+    }
+
+    static class ServerSetup extends TestRunnerConfigSetupTask {
+
+        @Override
+        public void setup(final ManagementClient managementClient) throws Exception {
+            if (isOpenSslTls13Enabled()) {
+                super.setup(managementClient);
+
+                JavaArchive jar = ShrinkWrap.create(JavaArchive.class, TEST_JAR)
+                        .addClasses(UndertowServiceActivator.DEPENDENCIES)
+                        .addClasses(UndertowSSLService.class)
+                        .addAsResource(new StringAsset("Dependencies: io.undertow.core"), "META-INF/MANIFEST.MF")
+                        .addAsManifestResource(PermissionUtils.createPermissionsXmlAsset(UndertowServiceActivator.appendPermissions(new FilePermission("<<ALL FILES>>", "read"),
+                                new RuntimePermission("getClassLoader"),
+                                new RuntimePermission("accessDeclaredMembers"),
+                                new RuntimePermission("accessClassInPackage.sun.security.ssl"),
+                                new ReflectPermission("suppressAccessChecks"))), "permissions.xml")
+                        .addAsServiceProviderAndClasses(ServiceActivator.class, UndertowSSLServiceActivator.class);
+                deploy(jar, managementClient);
+                ServerReload.executeReloadAndWaitForCompletion(managementClient.getControllerClient());
+            }
+        }
+
+        @Override
+        protected ConfigurableElement[] getConfigurableElements() {
+            List<ConfigurableElement> elements = new ArrayList<>();
+
+            final CredentialReference credentialReference = CredentialReference.builder().withClearText(PASSWORD)
+                    .build();
+
+            // KeyStores
+            final SimpleTlsKeyStore.Builder ksCommon = SimpleTlsKeyStore.builder()
+                    .withType("JKS")
+                    .withCredentialReference(credentialReference);
+            elements.add(ksCommon.withName(SERVER_KEY_STORE_NAME)
+                    .withPath(CliPath.builder()
+                            .withPath(SERVER_KEY_STORE_FILE.getAbsolutePath())
+                            .build())
+                    .build());
+            elements.add(ksCommon.withName(SERVER_TRUST_STORE_NAME)
+                    .withPath(CliPath.builder()
+                            .withPath(TRUST_STORE_FILE.getAbsolutePath())
+                            .build())
+                    .build());
+
+            // Key and Trust Managers
+            elements.add(SimpleTlsKeyManager.builder()
+                    .withName(SERVER_KEY_MANAGER_NAME)
+                    .withCredentialReference(credentialReference)
+                    .withKeyStore(SERVER_KEY_STORE_NAME)
+                    .build());
+            elements.add(
+                    SimpleTlsTrustManager.builder()
+                            .withName(SERVER_TRUST_MANAGER_NAME)
+                            .withKeyStore(SERVER_TRUST_STORE_NAME)
+                            .build());
+
+            // SSLContext with OpenSSL provider
+            elements.add(SimpleTlsServerSslContext.builder()
+                    .withName(SERVER_SSL_CONTEXT_NAME)
+                    .withKeyManagers(SERVER_KEY_MANAGER_NAME)
+                    .withTrustManagers(SERVER_TRUST_MANAGER_NAME)
+                    .withProviders("openssl")
+                    .withProtocols("TLSv1.3", "TLSv1.2", "TLSv1.1")
+                    .withCipherSuiteNames("TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256")
+                    .build());
+
+            return elements.toArray(new ConfigurableElement[0]);
+        }
+
+        @Override
+        public void tearDown(final ManagementClient managementClient) throws Exception {
+            undeploy(managementClient, TEST_JAR);
+            super.tearDown(managementClient);
+        }
+
+        /**
+         * Deploys the archive to the running server.
+         *
+         * @param archive the archive to deploy
+         * @throws IOException if an error occurs deploying the archive
+         */
+        private static void deploy(final Archive<?> archive, ManagementClient managementClient) throws IOException {
+            // Use an operation to allow overriding the runtime name
+            final ModelNode address = Operations.createAddress(DEPLOYMENT, archive.getName());
+            final ModelNode addOp = createAddOperation(address);
+            addOp.get("enabled").set(true);
+            // Create the content for the add operation
+            final ModelNode contentNode = addOp.get(CONTENT);
+            final ModelNode contentItem = contentNode.get(0);
+            contentItem.get(ClientConstants.INPUT_STREAM_INDEX).set(0);
+
+            // Create an operation and add the input archive
+            final OperationBuilder builder = OperationBuilder.create(addOp);
+            builder.addInputStream(archive.as(ZipExporter.class).exportAsInputStream());
+
+            // Deploy the content and check the results
+            final ModelNode result = managementClient.getControllerClient().execute(builder.build());
+            if (!Operations.isSuccessfulOutcome(result)) {
+                Assert.fail(String.format("Failed to deploy %s: %s", archive, Operations.getFailureDescription(result).asString()));
+            }
+        }
+
+        private static void undeploy(ManagementClient client, final String runtimeName) throws ServerDeploymentHelper.ServerDeploymentException {
+            final ServerDeploymentHelper helper = new ServerDeploymentHelper(client.getControllerClient());
+            final Collection<Throwable> errors = new ArrayList<>();
+            try {
+                final ModelNode op = Operations.createReadResourceOperation(Operations.createAddress("deployment", runtimeName));
+                final ModelNode result = client.getControllerClient().execute(op);
+                if (Operations.isSuccessfulOutcome(result))
+                    helper.undeploy(runtimeName);
+            } catch (Exception e) {
+                errors.add(e);
+            }
+            if (!errors.isEmpty()) {
+                final RuntimeException e = new RuntimeException("Error undeploying: " + runtimeName);
+                for (Throwable error : errors) {
+                    e.addSuppressed(error);
+                }
+                throw e;
+            }
+        }
+    }
+
+    public static class KeyMaterialSetup implements ServerSetupTask {
+
+        @Override
+        public void setup(ManagementClient managementClient) throws Exception {
+            if (WORK_DIR.exists()) {
+                FileUtils.deleteQuietly(WORK_DIR);
+            }
+            caGenerationTool = CAGenerationTool.builder()
+                    .setBaseDir(WORK_DIR.getAbsolutePath())
+                    .setRequestIdentities(Identity.LADYBIRD, Identity.SCARAB)
+                    .build();
+        }
+
+        @Override
+        public void tearDown(ManagementClient managementClient) throws Exception {
+            FileUtils.deleteQuietly(WORK_DIR);
+        }
+
+    }
+
+    @Test
+    public void testTLS13OpenSsl() throws Throwable {
+        configureServerCipherSuitesAndProtocols("TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256", "TLSv1.3", "TLSv1.2", "TLSv1.1");
+        UndertowXnioSsl ssl = createClientSSL("TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256", "TLSv1.3", "TLSv1.2", "TLSv1.1");
+        performSimpleTest(ssl, "TLS_AES_256_GCM_SHA384", "TLSv1.3");
+    }
+
+    @Test
+    public void testNoExplicitTLS13CipherSuitesOpenSsl() throws Throwable {
+        // WFCORE-5122: Update this test once we are ready to enable TLS 1.3 by default for the WildFly OpenSSL provider
+        // For now, TLS 1.2 should be used by default in this test case since no TLS 1.3 cipher suites have been explicitly
+        // configured on the server side
+        configureServerCipherSuitesAndProtocols(null, "TLSv1.3", "TLSv1.2", "TLSv1.1");
+        UndertowXnioSsl ssl = createClientSSL("TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256", "TLSv1.3", "TLSv1.2", "TLSv1.1");
+        performSimpleTest(ssl, null, "TLSv1.2");
+    }
+
+    @Test(expected = SSLException.class)
+    public void testProtocolMismatchOpenSsl() throws Throwable {
+        configureServerCipherSuitesAndProtocols(null, "TLSv1.2");
+        UndertowXnioSsl ssl = createClientSSL("TLS_AES_256_GCM_SHA384:TLS_AES_128_CCM_8_SHA256", "TLSv1.3");
+        performSimpleTest(ssl, null, "");
+    }
+
+    @Test(expected = SSLException.class)
+    public void testCipherSuiteMismatchOpenSsl() throws Throwable {
+        configureServerCipherSuitesAndProtocols("TLS_AES_128_CCM_8_SHA256:TLS_AES_256_GCM_SHA384", "TLSv1.3");
+        UndertowXnioSsl ssl = createClientSSL("TLS_AES_128_GCM_SHA256", "TLSv1.3");
+        performSimpleTest(ssl, null, "");
+    }
+
+    private UndertowXnioSsl createClientSSL(String cipherSuiteNames, String... protocols) throws Exception {
+        SSLContextBuilder clientContextBuilder = new SSLContextBuilder();
+        clientContextBuilder.setProviderSupplier(() -> new Provider[] {new OpenSSLProvider()});
+        if (cipherSuiteNames != null) {
+            clientContextBuilder.setCipherSuiteSelector(CipherSuiteSelector.fromNamesString(cipherSuiteNames));
+        }
+        if (protocols != null) {
+            ProtocolSelector protocolSelector = ProtocolSelector.empty();
+            for (String protocol : protocols) {
+                protocolSelector = protocolSelector.add(protocol);
+            }
+            clientContextBuilder.setProtocolSelector(protocolSelector);
+        }
+        clientContextBuilder.setKeyManager(getKeyManager(CLIENT_KEY_STORE_FILE));
+        clientContextBuilder.setTrustManager(getTrustManager(TRUST_STORE_FILE));
+        clientContextBuilder.setClientMode(true);
+        SSLContext clientContext = clientContextBuilder.build().create();
+        return new UndertowXnioSsl(Xnio.getInstance(), OptionMap.EMPTY, clientContext);
+    }
+
+    private static X509ExtendedKeyManager getKeyManager(final File ksFile) throws Exception {
+        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
+        keyManagerFactory.init(loadKeyStore(ksFile), PASSWORD.toCharArray());
+        for (KeyManager current : keyManagerFactory.getKeyManagers()) {
+            if (current instanceof X509ExtendedKeyManager) {
+                return (X509ExtendedKeyManager) current;
+            }
+        }
+        throw new IllegalStateException("Unable to obtain X509ExtendedKeyManager.");
+    }
+
+    private static X509TrustManager getTrustManager(File trustStoreFile) throws Exception {
+        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+        trustManagerFactory.init(loadKeyStore(trustStoreFile));
+        for (TrustManager current : trustManagerFactory.getTrustManagers()) {
+            if (current instanceof X509TrustManager) {
+                return (X509TrustManager) current;
+            }
+        }
+        throw new IllegalStateException("Unable to obtain X509TrustManager.");
+    }
+
+    private static KeyStore loadKeyStore(final File ksFile) throws Exception {
+        KeyStore ks = KeyStore.getInstance("JKS");
+        try (FileInputStream fis = new FileInputStream(ksFile)) {
+            ks.load(fis, PASSWORD.toCharArray());
+        }
+        return ks;
+    }
+
+    private void performSimpleTest(UndertowXnioSsl ssl, String expectedCipherSuite, String expectedProtocol) throws Exception {
+        SSLSocket clientSocket = ((SSLSocket)(ssl.getSslContext().getSocketFactory().createSocket("localhost", TestSuiteEnvironment.getHttpPort())));
+        clientSocket.getOutputStream().write(new byte[]{0x12, 0x34});
+        SSLSession clientSession = clientSocket.getSession();
+        if (expectedCipherSuite != null) {
+            Assert.assertEquals(expectedCipherSuite, clientSession.getCipherSuite());
+        }
+        Assert.assertEquals(expectedProtocol, clientSession.getProtocol());
+        Assert.assertEquals(Identity.SCARAB.getPrincipal().getName(), clientSession.getPeerPrincipal().getName());
+    }
+
+    private void configureServerCipherSuitesAndProtocols(String cipherSuiteNames, String... protocols) throws Exception {
+        ModelNode writeOp = Util.createEmptyOperation(WRITE_ATTRIBUTE_OPERATION, SERVER_SSL_CONTEXT_ADDRESS);
+        if (cipherSuiteNames != null) {
+            writeOp.get("name").set("cipher-suite-names");
+            writeOp.get("value").set(cipherSuiteNames);
+            managementClient.executeForResult(writeOp);
+        } else {
+            ModelNode undefineOp = Util.createEmptyOperation(UNDEFINE_ATTRIBUTE_OPERATION, SERVER_SSL_CONTEXT_ADDRESS);
+            undefineOp.get("name").set("cipher-suite-names");
+            managementClient.executeForResult(undefineOp);
+        }
+        writeOp.get("name").set("protocols");
+        ModelNode protocolsList = new ModelNode();
+        for (String protocol : protocols) {
+            protocolsList.add(protocol);
+        }
+        writeOp.get("value").set(protocolsList);
+        managementClient.executeForResult(writeOp);
+        ServerReload.executeReloadAndWaitForCompletion(managementClient.getControllerClient());
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/ServerSslSniContextTestCase.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/ServerSslSniContextTestCase.java
new file mode 100644
index 0000000..199783c
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/ServerSslSniContextTestCase.java
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2019 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.test.integration.extension.elytron.tls;
+
+import static org.hamcrest.CoreMatchers.containsString;
+
+import org.hamcrest.MatcherAssert;
+import org.jboss.as.test.integration.management.util.CLIWrapper;
+import org.jboss.as.test.integration.management.util.ServerReload;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Ignore;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.wildfly.core.testrunner.ServerSetup;
+import org.wildfly.core.testrunner.WildflyTestRunner;
+
+@Ignore("SNI is not implemented yet")
+@ServerSetup(ServerReload.SetupTask.class)
+@RunWith(WildflyTestRunner.class)
+public class ServerSslSniContextTestCase {
+    CLIWrapper cli;
+
+    @Before
+    public void setup() throws Exception {
+        cli = new CLIWrapper(true);
+        // add server-ssl-sni-context
+        cli.sendLine("/subsystem=elytron-tls/key-store=exampleKeyStore:add(path=server.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text=\"keystore_password\"},type=JKS)");
+        cli.sendLine("/subsystem=elytron-tls/key-manager=exampleKeyManager:add(key-store=exampleKeyStore,alias-filter=server,credential-reference={clear-text=\"key_password\"})");
+        cli.sendLine("/subsystem=elytron-tls/server-ssl-context=exampleSslContext:add(key-manager=exampleKeyManager)");
+        cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:add(default-ssl-context=exampleSslContext");
+    }
+
+    @After
+    public void cleanup() throws Exception {
+        removeTestResources();
+        cli.close();
+    }
+
+    @Test
+    public void testInvalidHostContextMapValue() {
+        boolean success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"\\\\?.invalid.com\"=exampleSslContext})", true);
+        Assert.assertFalse(success);
+        MatcherAssert.assertThat("Wrong error message", cli.readOutput(), containsString("Invalid value of host context map"));
+        success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"invalid\\\\.\\\\.example.com\"=exampleSslContext})", true);
+        Assert.assertFalse(success);
+        MatcherAssert.assertThat("Wrong error message", cli.readOutput(), containsString("Invalid value of host context map"));
+        success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"*\\.invalid.com\"=exampleSslContext})", true);
+        Assert.assertFalse(success);
+        MatcherAssert.assertThat("Wrong error message", cli.readOutput(), containsString("Invalid value of host context map"));
+        success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"invalid.com-\"=exampleSslContext})", true);
+        Assert.assertFalse(success);
+        MatcherAssert.assertThat("Wrong error message", cli.readOutput(), containsString("Invalid value of host context map"));
+        success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"invalid.com\\\\.\"=exampleSslContext})", true);
+        Assert.assertFalse(success);
+        MatcherAssert.assertThat("Wrong error message", cli.readOutput(), containsString("Invalid value of host context map"));
+    }
+
+    @Test
+    public void testValidHostContextMapValue() {
+        boolean success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"..valid\\\\.example\\\\.com\"=exampleSslContext})", true);
+        Assert.assertTrue(success);
+        success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"valid\\\\.example\\\\.com\"=exampleSslContext})", true);
+        Assert.assertTrue(success);
+        success = cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:write-attribute(name=host-context-map,value={\"[^.]*\\\\.example\\\\.com\"=exampleSslContext})", true);
+        Assert.assertTrue(success);
+    }
+
+    private void removeTestResources() {
+        cli.sendLine("/subsystem=elytron-tls/server-ssl-sni-context=exampleSslSniContext:remove");
+        cli.sendLine("/subsystem=elytron-tls/server-ssl-context=exampleSslContext:remove");
+        cli.sendLine("/subsystem=elytron-tls/key-manager=exampleKeyManager:remove");
+        cli.sendLine("/subsystem=elytron-tls/key-store=exampleKeyStore:remove");
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/expression/SystemPropertyExpressionTestCase.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/expression/SystemPropertyExpressionTestCase.java
new file mode 100644
index 0000000..bda6211
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/integration/extension/elytron/tls/expression/SystemPropertyExpressionTestCase.java
@@ -0,0 +1,247 @@
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2021 Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.test.integration.extension.elytron.tls.expression;
+
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.ALLOW_RESOURCE_SERVICE_RESTART;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.COMPOSITE;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.CORE_SERVICE;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OPERATION_HEADERS;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.OUTCOME;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.PLATFORM_MBEAN;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.RESULT;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.STEPS;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUBSYSTEM;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SUCCESS;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.SYSTEM_PROPERTY;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.TYPE;
+import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.VALUE;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.jboss.as.controller.PathAddress;
+import org.jboss.as.controller.client.ModelControllerClient;
+import org.jboss.as.controller.client.helpers.ClientConstants;
+import org.jboss.as.controller.operations.common.Util;
+import org.jboss.as.test.integration.management.util.ServerReload;
+import org.jboss.as.test.shared.TestSuiteEnvironment;
+import org.jboss.dmr.ModelNode;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.wildfly.core.testrunner.ManagementClient;
+import org.wildfly.core.testrunner.ServerSetup;
+import org.wildfly.core.testrunner.ServerSetupTask;
+import org.wildfly.core.testrunner.UnsuccessfulOperationException;
+import org.wildfly.core.testrunner.WildflyTestRunner;
+import org.wildfly.security.auth.server.IdentityCredentials;
+import org.wildfly.security.credential.PasswordCredential;
+import org.wildfly.security.credential.SecretKeyCredential;
+import org.wildfly.security.credential.store.CredentialStore;
+import org.wildfly.security.credential.store.impl.KeyStoreCredentialStore;
+import org.wildfly.security.encryption.SecretKeyUtil;
+import org.wildfly.security.password.interfaces.ClearPassword;
+
+@RunWith(WildflyTestRunner.class)
+@ServerSetup(SystemPropertyExpressionTestCase.ServerSetup.class)
+public class SystemPropertyExpressionTestCase {
+
+    private static final String CNAME = SystemPropertyExpressionTestCase.class.getSimpleName();
+    private static final String CS_PATH = "target/" + CNAME + ".cs";
+    private static final PathAddress SUBSYSTEM_ADDRESS = PathAddress.pathAddress(SUBSYSTEM, "elytron-tls");
+    private static final PathAddress ENCRYPTION_ADDRESS = SUBSYSTEM_ADDRESS.append("expression", "encryption");
+    private static final String CREDENTIAL_STORE = "credential-store";
+    private static final PathAddress CREDENTIAL_STORE_ADDRESS = SUBSYSTEM_ADDRESS.append(CREDENTIAL_STORE, CNAME);
+    private static final String SECURE_KEY = "RUxZAUsXHVcDh99zAdxGEzTBK1h2qjW+sZg2+37w7ijhDEiJEw==";
+    private static final PathAddress RUNTIME_ADDRESS = PathAddress.pathAddress(CORE_SERVICE, PLATFORM_MBEAN).append(TYPE, "runtime");
+    private static final String PROP = CNAME;
+    private static final String MISSING_PROP = PROP + "-missing";
+
+    private static final String CLEAR_TEXT = "Lorem ipsum dolor sit amet";
+
+    public static final class ServerSetup implements ServerSetupTask {
+        @Override
+        public void setup(ManagementClient managementClient) throws Exception {
+            addCredentialStore(managementClient);
+            managementClient.executeForResult(getAddExpressionEncyryptionOp());
+        }
+
+        @Override
+        public void tearDown(ManagementClient managementClient) throws Exception {
+            try {
+                safeRemoveSystemProperty(managementClient, PROP);
+                safeRemoveSystemProperty(managementClient, MISSING_PROP);
+                removeExpressionEncryption(managementClient.getControllerClient());
+            } finally {
+                removeCredentialStore(managementClient);
+            }
+        }
+
+        private static void  addCredentialStore(ManagementClient managementClient) throws GeneralSecurityException, IOException, UnsuccessfulOperationException {
+            cleanCredentialStoreFile();
+            KeyStore ks = KeyStore.getInstance("JCEKS");
+            ks.load(null, null);
+            ks.store(Files.newOutputStream(Paths.get(CS_PATH)), CNAME.toCharArray());
+
+            Map<String, String> attributes = new HashMap<>();
+            attributes.put("location", CS_PATH);
+            attributes.put("keyStoreType", "JCEKS");
+            attributes.put("modifiable", "true");
+
+            PasswordCredential credential = new PasswordCredential(ClearPassword.createRaw(ClearPassword.ALGORITHM_CLEAR, CNAME.toCharArray()));
+            CredentialStore credentialStore = CredentialStore.getInstance(KeyStoreCredentialStore.KEY_STORE_CREDENTIAL_STORE);
+
+            credentialStore.initialize(attributes,
+                    new CredentialStore.CredentialSourceProtectionParameter(IdentityCredentials.NONE.withCredential(credential)));
+            credentialStore.store("securekey", new SecretKeyCredential(SecretKeyUtil.importSecretKey(SECURE_KEY)));
+            credentialStore.flush();
+
+            ModelNode addOp = Util.createAddOperation(CREDENTIAL_STORE_ADDRESS);
+            addOp.get("location").set(CS_PATH);
+            addOp.get("credential-reference", "clear-text").set(CNAME);
+            addOp.get("providers").set("combined-providers");
+            managementClient.executeForResult(addOp);
+        }
+
+        private static void safeRemoveSystemProperty(ManagementClient managementClient, String prop) {
+            try {
+                managementClient.getControllerClient().execute(Util.createRemoveOperation(PathAddress.pathAddress(SYSTEM_PROPERTY, prop)));
+            } catch (Exception e) {
+                e.printStackTrace(System.out);
+            }
+        }
+
+        private static void removeCredentialStore(ManagementClient managementClient) throws UnsuccessfulOperationException {
+            try {
+                ModelNode removeOp = Util.createRemoveOperation(CREDENTIAL_STORE_ADDRESS);
+                managementClient.executeForResult(removeOp);
+                ServerReload.executeReloadAndWaitForCompletion(managementClient.getControllerClient());
+            } finally {
+                cleanCredentialStoreFile();
+            }
+        }
+
+        private static void cleanCredentialStoreFile() {
+            File f = new File(CS_PATH);
+            assert !f.exists() || f.delete();
+        }
+    }
+
+    private static ModelNode getAddExpressionEncyryptionOp() {
+        ModelNode encAdd = Util.createAddOperation(ENCRYPTION_ADDRESS);
+        encAdd.get("default-resolver").set("Default");
+        ModelNode resolvers = encAdd.get("resolvers");
+        ModelNode resolver = new ModelNode();
+        resolver.get("name").set("Default");
+        resolver.get(CREDENTIAL_STORE).set(CNAME);
+        resolver.get("secret-key").set("securekey");
+        resolvers.add(resolver);
+        return  encAdd;
+    }
+
+    private static void removeExpressionEncryption(ModelControllerClient modelControllerClient) throws IOException {
+        ModelNode removeOp = Util.createRemoveOperation(ENCRYPTION_ADDRESS);
+        removeOp.get(OPERATION_HEADERS, ALLOW_RESOURCE_SERVICE_RESTART).set(true);
+        assertSuccess(modelControllerClient.execute(removeOp));
+    }
+
+    @Test
+    public void testEncryptedSystemProperties() throws Exception {
+
+        PathAddress propAddress = PathAddress.pathAddress(SYSTEM_PROPERTY, PROP);
+        try (ModelControllerClient client = TestSuiteEnvironment.getModelControllerClient()) {
+
+            assertNull(getSystemProperty(client, PROP));
+            assertNull(getSystemProperty(client, MISSING_PROP));
+
+            ModelNode response = createExpression(client);
+            assertSuccess(response);
+            String expression = response.get(ClientConstants.RESULT).get("expression").asString();
+
+            ModelNode addOp = Util.createAddOperation(propAddress);
+            addOp.get(VALUE).set(expression);
+
+            response = client.execute(addOp);
+            assertSuccess(response);
+
+            assertEquals(CLEAR_TEXT, getSystemProperty(client, PROP));
+
+            removeExpressionEncryption(client);
+
+            // Removing the resolver doesn't affect the system property
+            assertEquals(CLEAR_TEXT, getSystemProperty(client, PROP));
+
+            ModelNode missingAddOp = Util.createAddOperation(PathAddress.pathAddress(SYSTEM_PROPERTY, MISSING_PROP));
+            missingAddOp.get(VALUE).set(expression);
+            // The add should succeed, but the expression would be resolved as if it were a standard expression with a default
+            assertSuccess(client.execute(missingAddOp));
+            assertEquals(expression.substring(expression.indexOf(":Default:"), expression.length() - 1), getSystemProperty(client, MISSING_PROP));
+
+            // Clean up
+            assertSuccess(client.execute(Util.createRemoveOperation(PathAddress.pathAddress(SYSTEM_PROPERTY, MISSING_PROP))));
+            assertNull(getSystemProperty(client, MISSING_PROP));
+
+            // If the prop and the resolver are added in a composite, then proper resolution can occur during op execution
+            ModelNode composite = Util.createEmptyOperation(COMPOSITE, PathAddress.EMPTY_ADDRESS);
+            ModelNode steps = composite.get(STEPS);
+            steps.add(missingAddOp);
+
+            steps.add(getAddExpressionEncyryptionOp());
+
+            assertSuccess(client.execute(composite));
+
+            assertEquals(CLEAR_TEXT, getSystemProperty(client, MISSING_PROP));
+
+            // Test boot behavior. Reload and confirm the property is set.
+            ServerReload.executeReloadAndWaitForCompletion(client);
+
+            assertEquals(CLEAR_TEXT, getSystemProperty(client, PROP));
+
+        }
+    }
+
+    private static ModelNode createExpression(ModelControllerClient client) throws IOException {
+        ModelNode createExpression = Util.createEmptyOperation("create-expression", ENCRYPTION_ADDRESS);
+        createExpression.get("resolver").set("Default");
+        createExpression.get("clear-text").set(CLEAR_TEXT);
+
+        return client.execute(createExpression);
+    }
+
+    private static void assertSuccess(ModelNode response) {
+        if (!response.get(OUTCOME).asString().equals(SUCCESS)) {
+            Assert.fail(response.toJSONString(false));
+        }
+    }
+
+    private static String getSystemProperty(ModelControllerClient client, String property) throws IOException {
+        ModelNode response = client.execute(Util.getReadAttributeOperation(RUNTIME_ADDRESS, "system-properties"));
+        assertSuccess(response);
+        ModelNode val = response.get(RESULT, property);
+        return val.isDefined() ? val.asString() : null;
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/TestRunnerConfigSetupTask.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/TestRunnerConfigSetupTask.java
new file mode 100644
index 0000000..92cb327
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/TestRunnerConfigSetupTask.java
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.test.security.common;
+
+import java.util.Arrays;
+import java.util.ListIterator;
+
+import org.jboss.as.controller.client.ModelControllerClient;
+import org.jboss.as.test.integration.management.util.CLIWrapper;
+import org.jboss.as.test.integration.management.util.ServerReload;
+import org.jboss.logging.Logger;
+import org.wildfly.core.testrunner.ManagementClient;
+import org.wildfly.core.testrunner.ServerSetupTask;
+import org.wildfly.test.security.common.elytron.ConfigurableElement;
+
+/**
+ * WildFly TestRunner ServerSetupTask version of AbstractConfigSetupTask.
+ *
+ * @author Josef Cacek
+ */
+public abstract class TestRunnerConfigSetupTask implements ServerSetupTask {
+
+    private static final Logger LOGGER = Logger.getLogger(TestRunnerConfigSetupTask.class);
+
+    private ConfigurableElement[] configurableElements;
+
+    @Override
+    public void setup(final ManagementClient managementClient) throws Exception {
+        setup(managementClient.getControllerClient());
+    }
+
+    @Override
+    public void tearDown(final ManagementClient managementClient) throws Exception {
+        tearDown(managementClient.getControllerClient());
+    }
+
+    /**
+     * Creates configuration elements (provided by implementation of {@link #getConfigurableElements()} method) and calls
+     * {@link ConfigurableElement#create(CLIWrapper)} for them.
+     */
+    protected void setup(final ModelControllerClient modelControllerClient) throws Exception {
+        configurableElements = getConfigurableElements();
+
+        if (configurableElements == null || configurableElements.length == 0) {
+            LOGGER.warn("Empty Elytron configuration.");
+            return;
+        }
+
+        try (CLIWrapper cli = new CLIWrapper(true)) {
+            for (final ConfigurableElement configurableElement : configurableElements) {
+                LOGGER.infov("Adding element {0} ({1})", configurableElement.getName(),
+                        configurableElement.getClass().getSimpleName());
+                configurableElement.create(modelControllerClient, cli);
+            }
+        }
+        ServerReload.reloadIfRequired(modelControllerClient);
+    }
+
+    /**
+     * Reverts configuration changes done by {@link #setup(ModelControllerClient)} method - i.e. calls {@link ConfigurableElement#remove(CLIWrapper)} method
+     * on instances provided by {@link #getConfigurableElements()} (in reverse order).
+     */
+    protected void tearDown(ModelControllerClient modelControllerClient) throws Exception {
+        if (configurableElements == null || configurableElements.length == 0) {
+            LOGGER.warn("Empty Elytron configuration.");
+            return;
+        }
+
+        try (CLIWrapper cli = new CLIWrapper(true)) {
+            final ListIterator<ConfigurableElement> reverseConfigIt = Arrays.asList(configurableElements)
+                    .listIterator(configurableElements.length);
+            while (reverseConfigIt.hasPrevious()) {
+                final ConfigurableElement configurableElement = reverseConfigIt.previous();
+                LOGGER.infov("Removing element {0} ({1})", configurableElement.getName(),
+                        configurableElement.getClass().getSimpleName());
+                configurableElement.remove(modelControllerClient, cli);
+            }
+        }
+        this.configurableElements = null;
+        ServerReload.reloadIfRequired(modelControllerClient);
+    }
+
+    /**
+     * Returns not-{@code null} array of configurations to be created by this server setup task.
+     *
+     * @return not-{@code null} array of instances to be created
+     */
+    protected abstract ConfigurableElement[] getConfigurableElements();
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/CliPath.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/CliPath.java
new file mode 100644
index 0000000..e2af5ca
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/CliPath.java
@@ -0,0 +1,98 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.test.security.common.elytron.tls.subsystem;
+
+import static org.apache.commons.lang3.StringUtils.isNotBlank;
+import static org.jboss.as.test.shared.CliUtils.escapePath;
+
+import org.wildfly.test.security.common.elytron.CliFragment;
+
+/**
+ * Helper class for adding "path" and "relative-to" attributes into CLI commands.
+ *
+ * @author Josef Cacek
+ */
+public class CliPath implements CliFragment {
+
+    public static final CliPath EMPTY = CliPath.builder().build();
+
+    private final String path;
+    private final String relativeTo;
+
+    private CliPath(Builder builder) {
+        this.path = builder.path;
+        this.relativeTo = builder.relativeTo;
+    }
+
+    public String getPath() {
+        return path;
+    }
+
+    public String getRelativeTo() {
+        return relativeTo;
+    }
+
+    /**
+     * Generates part of CLI string in form "[path=..., [relative-to=..., ]"
+     */
+    @Override
+    public String asString() {
+        StringBuilder sb = new StringBuilder();
+        if (isNotBlank(path)) {
+            sb.append(String.format("path=\"%s\", ", escapePath(path)));
+            if (isNotBlank(relativeTo)) {
+                sb.append(String.format("relative-to=\"%s\"", relativeTo));
+            }
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Creates builder to build {@link CliPath}.
+     *
+     * @return created builder
+     */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    /**
+     * Builder to build {@link CliPath}.
+     */
+    public static final class Builder {
+        private String path;
+        private String relativeTo;
+
+        private Builder() {
+        }
+
+        public Builder withPath(String path) {
+            this.path = path;
+            return this;
+        }
+
+        public Builder withRelativeTo(String relativeTo) {
+            this.relativeTo = relativeTo;
+            return this;
+        }
+
+        public CliPath build() {
+            return new CliPath(this);
+        }
+    }
+
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsKeyManager.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsKeyManager.java
new file mode 100644
index 0000000..7d29d52
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsKeyManager.java
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.test.security.common.elytron.tls.subsystem;
+
+import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
+import static org.wildfly.common.Assert.checkNotNullParamWithNullPointerException;
+
+import javax.net.ssl.KeyManagerFactory;
+
+import org.jboss.as.controller.client.ModelControllerClient;
+import org.jboss.as.test.integration.management.util.CLIWrapper;
+import org.wildfly.test.security.common.elytron.AbstractConfigurableElement;
+import org.wildfly.test.security.common.elytron.CredentialReference;
+
+/**
+ * Elytron TLS key-manager configuration implementation.
+ *
+ * @author Josef Cacek
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class SimpleTlsKeyManager extends AbstractConfigurableElement {
+
+    private final String keyStore;
+    private final CredentialReference credentialReference;
+
+    private SimpleTlsKeyManager(Builder builder) {
+        super(builder);
+        this.keyStore = checkNotNullParamWithNullPointerException("builder.keyStore", builder.keyStore);
+        this.credentialReference = defaultIfNull(builder.credentialReference, CredentialReference.EMPTY);
+    }
+
+    @Override
+    public void create(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        // /subsystem=elytron-tls/key-manager=httpsKM:add(key-store=httpsKS,algorithm="SunX509",credential-reference={clear-text=secret})
+
+        cli.sendLine(String.format("/subsystem=elytron-tls/key-manager=%s:add(key-store=\"%s\",algorithm=\"%s\", %s)", name,
+                keyStore, KeyManagerFactory.getDefaultAlgorithm(), credentialReference.asString()));
+    }
+
+    @Override
+    public void remove(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        cli.sendLine(String.format("/subsystem=elytron-tls/key-manager=%s:remove()", name));
+    }
+
+    /**
+     * Creates builder to build {@link SimpleTlsKeyManager}.
+     *
+     * @return created builder
+     */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    /**
+     * Builder to build {@link SimpleTlsKeyManager}.
+     */
+    public static final class Builder extends AbstractConfigurableElement.Builder<Builder> {
+        private String keyStore;
+        private CredentialReference credentialReference;
+
+        private Builder() {
+        }
+
+        public Builder withKeyStore(String keyStore) {
+            this.keyStore = keyStore;
+            return this;
+        }
+
+        public Builder withCredentialReference(CredentialReference credentialReference) {
+            this.credentialReference = credentialReference;
+            return this;
+        }
+
+        public SimpleTlsKeyManager build() {
+            return new SimpleTlsKeyManager(this);
+        }
+
+        @Override
+        protected Builder self() {
+            return this;
+        }
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsKeyStore.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsKeyStore.java
new file mode 100644
index 0000000..a002974
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsKeyStore.java
@@ -0,0 +1,109 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.test.security.common.elytron.tls.subsystem;
+
+import static org.apache.commons.lang3.ObjectUtils.defaultIfNull;
+
+import org.jboss.as.controller.client.ModelControllerClient;
+import org.jboss.as.test.integration.management.util.CLIWrapper;
+import org.wildfly.test.security.common.elytron.AbstractConfigurableElement;
+import org.wildfly.test.security.common.elytron.CredentialReference;
+
+/**
+ * Elytron TLS key-store configuration implementation.
+ *
+ * @author Josef Cacek
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class SimpleTlsKeyStore extends AbstractConfigurableElement {
+
+    private final CliPath path;
+    private final CredentialReference credentialReference;
+    private final String type;
+    private final boolean required;
+
+    private SimpleTlsKeyStore(Builder builder) {
+        super(builder);
+        this.path = defaultIfNull(builder.path, CliPath.EMPTY);
+        this.credentialReference = defaultIfNull(builder.credentialReference, CredentialReference.EMPTY);
+        this.type = defaultIfNull(builder.type, "JKS");
+        this.required = builder.required;
+    }
+
+    @Override
+    public void create(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        // /subsystem=elytron-tls/key-store=httpsKS:add(path=keystore.jks,relative-to=jboss.server.config.dir,
+        // credential-reference={clear-text=secret},type=JKS,required=false)
+        cli.sendLine(String.format("/subsystem=elytron-tls/key-store=%s:add(%s%stype=\"%s\",required=%s)", name, path.asString(),
+                credentialReference.asString(), type, required));
+    }
+
+    @Override
+    public void remove(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        cli.sendLine(String.format("/subsystem=elytron-tls/key-store=%s:remove()", name));
+    }
+
+    /**
+     * Creates builder to build {@link SimpleTlsKeyStore}.
+     *
+     * @return created builder
+     */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    /**
+     * Builder to build {@link SimpleTlsKeyStore}.
+     */
+    public static final class Builder extends AbstractConfigurableElement.Builder<Builder> {
+        private CliPath path;
+        private CredentialReference credentialReference;
+        private String type;
+        private boolean required;
+
+        private Builder() {
+        }
+
+        public Builder withPath(CliPath path) {
+            this.path = path;
+            return this;
+        }
+
+        public Builder withCredentialReference(CredentialReference credentialReference) {
+            this.credentialReference = credentialReference;
+            return this;
+        }
+
+        public Builder withType(String type) {
+            this.type = type;
+            return this;
+        }
+
+        public Builder withRequired(boolean required) {
+            this.required = required;
+            return this;
+        }
+
+        public SimpleTlsKeyStore build() {
+            return new SimpleTlsKeyStore(this);
+        }
+
+        @Override
+        protected Builder self() {
+            return this;
+        }
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsServerSslContext.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsServerSslContext.java
new file mode 100644
index 0000000..def7934
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsServerSslContext.java
@@ -0,0 +1,158 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.test.security.common.elytron.tls.subsystem;
+
+import java.util.StringJoiner;
+
+import org.apache.commons.lang3.StringUtils;
+import org.jboss.as.controller.client.ModelControllerClient;
+import org.jboss.as.test.integration.management.util.CLIWrapper;
+import org.wildfly.test.security.common.elytron.AbstractConfigurableElement;
+
+/**
+ * Elytron TLS server-ssl-context configuration implementation.
+ *
+ * @author Josef Cacek
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class SimpleTlsServerSslContext extends AbstractConfigurableElement {
+
+    private final String keyManager;
+    private final String trustManager;
+    private final String[] protocols;
+    private final boolean needClientAuth;
+    private final Boolean authenticationOptional;
+    private final String providers;
+    private final String cipherSuiteNames;
+
+    private SimpleTlsServerSslContext(Builder builder) {
+        super(builder);
+        this.keyManager = builder.keyManager;
+        this.trustManager = builder.trustManager;
+        this.protocols = builder.protocols;
+        this.needClientAuth = builder.needClientAuth;
+        this.authenticationOptional = builder.authenticationOptional;
+        this.providers = builder.providers;
+        this.cipherSuiteNames = builder.cipherSuiteNames;
+    }
+
+    @Override
+    public void create(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        // /subsystem=elytron-tls/server-ssl-context=twoWaySSC:add(key-manager=twoWayKM,protocols=["TLSv1.2"],
+        // trust-manager=twoWayTM,security-domain=test,need-client-auth=true)
+        StringBuilder sb = new StringBuilder("/subsystem=elytron-tls/server-ssl-context=").append(name).append(":add(");
+        if (StringUtils.isNotBlank(keyManager)) {
+            sb.append("key-manager=\"").append(keyManager).append("\", ");
+        }
+        if (protocols != null) {
+            StringJoiner joiner = new StringJoiner(", ");
+            for (String s : protocols) {
+                String s1 = "\"" + s + "\"";
+                joiner.add(s1);
+            }
+            sb.append("protocols=[")
+                    .append(joiner).append("], ");
+        }
+        if (StringUtils.isNotBlank(trustManager)) {
+            sb.append("trust-manager=\"").append(trustManager).append("\", ");
+        }
+        if (authenticationOptional != null) {
+            sb.append("authentication-optional=").append(authenticationOptional).append(", ");
+        }
+        if (StringUtils.isNotBlank(providers)) {
+            sb.append("providers=\"").append(providers).append("\", ");
+        }
+        if (StringUtils.isNotBlank(cipherSuiteNames)) {
+            sb.append("cipher-suite-names=\"").append(cipherSuiteNames).append("\", ");
+        }
+        sb.append("need-client-auth=").append(needClientAuth).append(")");
+        cli.sendLine(sb.toString());
+    }
+
+    @Override
+    public void remove(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        cli.sendLine(String.format("/subsystem=elytron-tls/server-ssl-context=%s:remove()", name));
+    }
+
+    /**
+     * Creates builder to build {@link SimpleTlsServerSslContext}.
+     *
+     * @return created builder
+     */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    /**
+     * Builder to build {@link SimpleTlsServerSslContext}.
+     */
+    public static final class Builder extends AbstractConfigurableElement.Builder<Builder> {
+        private String keyManager;
+        private String trustManager;
+        private String[] protocols;
+        private boolean needClientAuth;
+        private Boolean authenticationOptional;
+        private String providers;
+        private String cipherSuiteNames;
+
+        private Builder() {
+        }
+
+        public Builder withKeyManagers(String keyManagers) {
+            this.keyManager = keyManagers;
+            return this;
+        }
+
+        public Builder withTrustManagers(String trustManagers) {
+            this.trustManager = trustManagers;
+            return this;
+        }
+
+        public Builder withProtocols(String... protocols) {
+            this.protocols = protocols;
+            return this;
+        }
+
+        public Builder withNeedClientAuth(boolean needClientAuth) {
+            this.needClientAuth = needClientAuth;
+            return this;
+        }
+
+        public Builder withAuthenticationOptional(boolean authenticationOptional) {
+            this.authenticationOptional = authenticationOptional;
+            return this;
+        }
+
+        public Builder withProviders(String providers) {
+            this.providers = providers;
+            return this;
+        }
+
+        public Builder withCipherSuiteNames(String cipherSuiteNames) {
+            this.cipherSuiteNames = cipherSuiteNames;
+            return this;
+        }
+
+        public SimpleTlsServerSslContext build() {
+            return new SimpleTlsServerSslContext(this);
+        }
+
+        @Override
+        protected Builder self() {
+            return this;
+        }
+    }
+}
diff --git a/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsTrustManager.java b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsTrustManager.java
new file mode 100644
index 0000000..18e6a99
--- /dev/null
+++ b/testsuite/integration/elytron-tls/src/test/java/org/wildfly/test/security/common/elytron/tls/subsystem/SimpleTlsTrustManager.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2017 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.wildfly.test.security.common.elytron.tls.subsystem;
+
+import static org.wildfly.common.Assert.checkNotNullParamWithNullPointerException;
+
+import javax.net.ssl.KeyManagerFactory;
+
+import org.jboss.as.controller.client.ModelControllerClient;
+import org.jboss.as.test.integration.management.util.CLIWrapper;
+import org.wildfly.test.security.common.elytron.AbstractConfigurableElement;
+
+/**
+ * Elytron TLS trust-managers configuration implementation.
+ *
+ * @author Josef Cacek
+ * @author <a href="mailto:carodrig@redhat.com">Cameron Rodriguez</a>
+ */
+public class SimpleTlsTrustManager extends AbstractConfigurableElement {
+
+    private final String keyStore;
+
+    private SimpleTlsTrustManager(Builder builder) {
+        super(builder);
+        this.keyStore = checkNotNullParamWithNullPointerException("builder.keyStore", builder.keyStore);
+    }
+
+    @Override
+    public void create(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        // /subsystem=elytron-tls/trust-manager=twoWayTM:add(key-store=twoWayTS,algorithm="SunX509")
+
+        cli.sendLine(String.format("/subsystem=elytron-tls/trust-manager=%s:add(key-store=\"%s\",algorithm=\"%s\")", name,
+                keyStore, KeyManagerFactory.getDefaultAlgorithm()));
+    }
+
+    @Override
+    public void remove(ModelControllerClient client, CLIWrapper cli) throws Exception {
+        cli.sendLine(String.format("/subsystem=elytron-tls/trust-manager=%s:remove()", name));
+    }
+
+    /**
+     * Creates builder to build {@link SimpleTlsTrustManager}.
+     *
+     * @return created builder
+     */
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    /**
+     * Builder to build {@link SimpleTlsTrustManager}.
+     */
+    public static final class Builder extends AbstractConfigurableElement.Builder<Builder> {
+        private String keyStore;
+
+        private Builder() {
+        }
+
+        public Builder withKeyStore(String keyStore) {
+            this.keyStore = keyStore;
+            return this;
+        }
+
+        public SimpleTlsTrustManager build() {
+            return new SimpleTlsTrustManager(this);
+        }
+
+        @Override
+        protected Builder self() {
+            return this;
+        }
+    }
+}
diff --git a/testsuite/integration/pom.xml b/testsuite/integration/pom.xml
new file mode 100644
index 0000000..c9681cc
--- /dev/null
+++ b/testsuite/integration/pom.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2019 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>elytron-tls-testsuite</artifactId>
+        <groupId>org.wildfly.extras.elytron-tls</groupId>
+        <version>1.0.0.Alpha-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>elytron-tls-testsuite-integration</artifactId>
+    <name>Elytron TLS: Testsuite - Integration</name>
+    <packaging>pom</packaging>
+    <modules>
+        <module>elytron-tls</module>
+    </modules>
+
+    <dependencies>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.arquillian.junit</groupId>
+            <artifactId>arquillian-junit-container</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.arquillian.junit</groupId>
+            <artifactId>arquillian-junit-core</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.shrinkwrap</groupId>
+            <artifactId>shrinkwrap-api</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.shrinkwrap</groupId>
+            <artifactId>shrinkwrap-impl-base</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.spec.javax.ws.rs</groupId>
+            <artifactId>jboss-jaxrs-api_2.1_spec</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-client</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly</groupId>
+            <artifactId>wildfly-testsuite-shared</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.arquillian</groupId>
+            <artifactId>wildfly-arquillian-container-managed</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wildfly.arquillian</groupId>
+            <artifactId>wildfly-arquillian-protocol-jmx</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+</project>
\ No newline at end of file
diff --git a/testsuite/pom.xml b/testsuite/pom.xml
new file mode 100644
index 0000000..b500b0d
--- /dev/null
+++ b/testsuite/pom.xml
@@ -0,0 +1,227 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2022 Red Hat, Inc.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>elytron-tls-parent</artifactId>
+        <groupId>org.wildfly.extras.elytron-tls</groupId>
+        <version>1.0.0.Alpha-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>elytron-tls-testsuite</artifactId>
+    <name>Elytron TLS: Testsuite</name>
+    <packaging>pom</packaging>
+    <modules>
+        <module>integration</module>
+    </modules>
+
+    <properties>
+        <debug.jvm.args></debug.jvm.args>
+
+        <!-- Used to provide an absolute location for the distribution under test. -->
+        <jboss.dist>${project.basedir}/target/wildfly</jboss.dist>
+        <jboss.home>${jboss.dist}</jboss.home>
+
+
+        <!-- IP address defaults. -->
+        <node0>127.0.0.1</node0>
+        <node1>127.0.0.1</node1>
+        <mcast>230.0.0.4</mcast> <!-- Default multicast address. -->
+        <mcast.ttl>0</mcast.ttl> <!-- Multicast TTL. -->
+        <port-offset>0</port-offset>
+
+        <!-- IP stack configs. -->
+        <jvm.args.ip>-Djava.net.preferIPv4Stack=true -Djava.net.preferIPv6Addresses=false</jvm.args.ip>
+        <jvm.args.ip.server>${jvm.args.ip}
+            -Djboss.bind.address=${node0}
+            -Djboss.bind.address.unsecure=${node0}
+            -Djboss.bind.address.private=${node0}
+            -Djboss.bind.address.management=${node0}
+            -Djboss.default.multicast.address=${mcast}
+        </jvm.args.ip.server>
+        <jvm.args.ip.client>${jvm.args.ip}</jvm.args.ip.client>
+
+
+        <!-- Server arguments. Cannot have a null server argument in ARQ, set a dummy system property -->
+        <jboss.args>-Dkabir.surname=khan</jboss.args>
+        <!-- =================== -->
+
+        <!-- Additional JVM args, like those for EC2. -->
+        <jvm.args.other>-server</jvm.args.other>
+
+        <!-- Logging config -->
+        <testLogToFile>true</testLogToFile>
+
+        <!-- Timeout ratios. 100 will leave the timeout as it was coded. -->
+        <timeout.factor>100</timeout.factor>
+        <jvm.args.timeouts>-Dts.timeout.factor=${timeout.factor}</jvm.args.timeouts>
+
+        <!-- Common surefire arguments -->
+        <surefire.memory.args>-Xmx512m -XX:MetaspaceSize=128m</surefire.memory.args>
+        <surefire.jpda.args></surefire.jpda.args>
+        <as.debug.port>8787</as.debug.port>
+        <modular.jdk.testsuite.args />
+        <surefire.system.args>${modular.jdk.testsuite.args} ${surefire.memory.args} ${surefire.jpda.args} -Djboss.dist=${jboss.dist} -Dmaven.repo.local=${settings.localRepository}</surefire.system.args>
+        <extra.server.jvm.args />
+        <!-- Hook to control forked process timeout via -D. Default value of 0 means no timeout -->
+        <surefire.forked.process.timeout>0</surefire.forked.process.timeout>
+
+        <!-- If servers should be killed before the test suite is run-->
+        <org.wildfly.test.kill-servers-before-test>false</org.wildfly.test.kill-servers-before-test>
+
+        <!-- Arquillian dependency versions -->
+        <version.arquillian_wildfly>${version.org.wildfly}</version.arquillian_wildfly>
+
+        <!-- Don't try to deploy the testsuite modules because they don't build jars -->
+        <maven.deploy.skip>true</maven.deploy.skip>
+
+        <!-- used to enable trace logging for test suite runs -->
+        <trace>none</trace>
+
+        <jvm.args.dirs>
+            -Djava.io.tmpdir=${basedir}/target
+        </jvm.args.dirs>
+
+        <!--
+            Used in arquillian.xml - arguments for all JBoss AS instances.
+            System properties are duplicated here until ARQ-647 is implemented.
+        -->
+        <server.jvm.args>${surefire.system.args} ${jvm.args.ip.server} ${jvm.args.other} ${jvm.args.timeouts} -Dnode0=${node0} -Dnode1=${node1} -Dmcast=${mcast} -Dmcast.ttl=${mcast.ttl} ${jvm.args.dirs} ${extra.server.jvm.args} ${debug.jvm.args}</server.jvm.args>
+        <cli.jvm.args>${modular.jdk.args} -Dmaven.repo.local=${settings.localRepository}</cli.jvm.args>
+    </properties>
+    <build>
+        <pluginManagement>
+            <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-compiler-plugin</artifactId>
+                    <!-- Don't compile src/main/java - nothing to do. -->
+                    <executions><execution><id>default-compile</id><phase>none</phase></execution></executions>
+                </plugin>
+
+                <!--
+                   Sets general surefire system properties.
+                   These can be overridden by inheriting plugin configurations.
+                -->
+
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-surefire-plugin</artifactId>
+                    <configuration>
+                        <failIfNoTests>false</failIfNoTests>
+                        <redirectTestOutputToFile>${testLogToFile}</redirectTestOutputToFile>
+                        <systemPropertyVariables>
+                            <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
+                            <jboss.dist>${jboss.dist}</jboss.dist>
+                            <jboss.home>${basedir}/target/wildfly</jboss.home>
+                            <jboss.args>${jboss.args}</jboss.args>
+                            <module.path>${jboss.dist}/modules${path.separator}${basedir}/target/modules</module.path>
+                            <org.wildfly.test.kill-servers-before-test>${org.wildfly.test.kill-servers-before-test}</org.wildfly.test.kill-servers-before-test>
+                        </systemPropertyVariables>
+                        <!-- Arquillian's config files. -->
+                        <additionalClasspathElements combine.children="append">
+                            <additionalClasspathElement>${basedir}/src/test/config/arq</additionalClasspathElement>
+                        </additionalClasspathElements>
+                        <argLine>${surefire.system.args}</argLine>
+                        <trimStackTrace>false</trimStackTrace>
+                    </configuration>
+                </plugin>
+
+                <!-- Disable default site run. -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-site-plugin</artifactId>
+                    <executions>
+                        <execution><id>default-site</id><phase>none</phase></execution></executions>
+                </plugin>
+
+                <!-- Don't create jars - nothing to do. -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-jar-plugin</artifactId>
+                    <executions><execution><id>default-jar</id><phase>none</phase></execution></executions>
+                </plugin>
+
+                <!-- Don't create source jars - nothing to do. -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-source-plugin</artifactId>
+                    <executions><execution><id>attach-sources</id><phase>none</phase></execution></executions>
+                </plugin>
+
+                <!-- Don't install - nothing to do. -->
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-install-plugin</artifactId>
+                    <executions><execution><id>default-install</id><phase>none</phase></execution></executions>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+
+    </build>
+    <profiles>
+        <profile>
+            <id>jdk9</id>
+            <activation>
+                <jdk>[9,)</jdk>
+            </activation>
+            <properties>
+                <modular.jdk.testsuite.args>${modular.jdk.args}
+                    --add-exports=java.base/sun.security.validator=ALL-UNNAMED
+                    --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED
+                    --add-exports=java.base/com.sun.crypto.provider=ALL-UNNAMED
+                </modular.jdk.testsuite.args>
+            </properties>
+        </profile>
+        <profile>
+            <id>jdk-target</id>
+            <activation>
+                <jdk>[9,)</jdk>
+                <property>
+                    <name>jdk-release</name>
+                </property>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-compiler-plugin</artifactId>
+                        <version>${version.compiler.plugin}</version>
+                        <configuration>
+                            <release>${jdk-release}</release>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+        <profile>
+            <!-- Debug server profile -->
+            <id>debug.profile</id>
+            <activation>
+                <property>
+                    <name>debug</name>
+                </property>
+            </activation>
+            <properties>
+                <debug.jvm.args>-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=8787</debug.jvm.args>
+            </properties>
+        </profile>
+    </profiles>
+</project>
\ No newline at end of file