[ https://issues.jboss.org/browse/ELY-1639?page=com.atlassian.jira.plugin.s... ] Martin Choma commented on ELY-1639: ----------------------------------- I can confirm I am able to perform 2-way SSL handshake in FIPS mode using PKCS11 with <key-store-ssl-certificate algorithm="SunX509" key-store-name="keystore" alias="alias"/> But when I try without alias attribute I get {code} 06:51:53,993 ERROR [org.jboss.as.cli.impl.CliLauncher] Error processing CLI: java.lang.ExceptionInInitializerError at org.wildfly.security.auth.client.AuthenticationContext.lambda$static$0(AuthenticationContext.java:54) at org.wildfly.common.context.ContextManager.getPrivileged(ContextManager.java:286) at org.wildfly.security.auth.client.AuthenticationContext.captureCurrent(AuthenticationContext.java:86) at org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:146) at org.jboss.as.cli.impl.ModelControllerClientFactory$2.getClient(ModelControllerClientFactory.java:85) at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1222) at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1203) at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1198) at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:328) at org.jboss.as.cli.impl.CliLauncher.main(CliLauncher.java:291) at org.jboss.as.cli.CommandLineMain.main(CommandLineMain.java:45) at org.jboss.modules.Module.run(Module.java:352) at org.jboss.modules.Module.run(Module.java:320) at org.jboss.modules.Main.main(Main.java:593) Caused by: org.wildfly.security.auth.client.InvalidAuthenticationConfigurationException: org.wildfly.client.config.ConfigXMLParseException: ELY02034: Alias must be specified if more than one entry exist in keystore at file:///home/mchoma/git-repo/tests-security/fips/target/CliClientTestCase/cli-test-wildfly-config-1967146079974109944.xml:13:17 at org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.lambda$static$0(DefaultAuthenticationContextProvider.java:40) at java.security.AccessController.doPrivileged(Native Method) at org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.<clinit>(DefaultAuthenticationContextProvider.java:36) ... 14 more Caused by: org.wildfly.client.config.ConfigXMLParseException: ELY02034: Alias must be specified if more than one entry exist in keystore at file:///home/mchoma/git-repo/tests-security/fips/target/CliClientTestCase/cli-test-wildfly-config-1967146079974109944.xml:13:17 at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseKeyStoreSslCertificate$13(ElytronXmlParser.java:817) at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextType$10(ElytronXmlParser.java:520) at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextRuleType$14(ElytronXmlParser.java:900) at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseRulesType$16(ElytronXmlParser.java:938) at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientType(ElytronXmlParser.java:364) at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:239) at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:200) at org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.lambda$static$0(DefaultAuthenticationContextProvider.java:38) ... 16 more {code} My PKCS11 keystore contains one private key and one secret key for external credential store. During previous precheck it was working ok. So was new check added? AFAICT it wasnt in ConfigurationKeyManager neither. So it is breaking backward compatibility. Could alias be optional and choosing key is left on impelementation? {code} if (keyStore.size() > 1) { throw xmlLog.missingAlias(location); } {code} -- This message was sent by Atlassian JIRA (v7.5.0#75005)