Bug in JBossJSSESecurityDomain.java - attempting to use wrong provider ---------------------------------------------------------------------- Key: SECURITY-762 URL: https://issues.jboss.org/browse/SECURITY-762 Project: PicketBox Issue Type: Bug Security Level: Public(Everyone can see) Components: JBossSX Affects Versions: PicketBox_4_0_19.Final Reporter: Derek Horton Assignee: Anil Saldhana There is a bug in JBossJSSESecurityDomain.java where it attempts to use the keystore/truststore provider to get instances of the trust manager. The code reads: if (trustManagerFactoryProvider != null) trustManagerFactory = TrustManagerFactory.getInstance(algorithm, trustStoreProvider); else trustManagerFactory = TrustManagerFactory.getInstance(algorithm); I think it should read: if (trustManagerFactoryProvider != null) trustManagerFactory = TrustManagerFactory.getInstance(algorithm, trustManagerFactoryProvider); else trustManagerFactory = TrustManagerFactory.getInstance(algorithm);