It is impossible configure KeyStore ValidatingAlias in picketlink-federation subsystem same as in picketlink.xml ---------------------------------------------------------------------------------------------------------------- Key: WFLY-6839 URL: https://issues.jboss.org/browse/WFLY-6839 Project: WildFly Issue Type: Bug Components: Security Reporter: Hynek Švábek Assignee: Pedro Igor Priority: Major In picketlink.xml configuration file I can define multiple ValidatingAlias for same certificate alias. {code} <KeyProvider ClassName="org.picketlink.identity.federation.core.impl.KeyStoreKeyManager"> ... ... <ValidatingAlias Key="localhost" Value="servercert" /> <ValidatingAlias Key="127.0.0.1" Value="servercert" /> </KeyProvider> {code} But in subsystem configuration I cannot do this. *Workaround* You can clone your certificate in keystore under different alias and then add new validating alias with this value.