QPID-4739: complete support for defining multiple key/trust stores and assigning them on a port-specific basis

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1467334 13f79535-47bb-0310-9956-ffa450edef68

14 files changed, 663 insertions, 87 deletions

diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/client/ssl/SSLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/client/ssl/SSLTest.java
index 884e89fb65..e2cd3e254e 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/client/ssl/SSLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/client/ssl/SSLTest.java
@@ -365,6 +365,8 @@ public class SSLTest extends QpidBrokerTestCase
             sslPortAttributes.put(Port.NEED_CLIENT_AUTH, needClientAuth);
             sslPortAttributes.put(Port.WANT_CLIENT_AUTH, wantClientAuth);
             sslPortAttributes.put(Port.NAME, TestBrokerConfiguration.ENTRY_NAME_SSL_PORT);
+            sslPortAttributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
+            sslPortAttributes.put(Port.TRUST_STORES, Collections.singleton(TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE));
             getBrokerConfiguration().addPortConfiguration(sslPortAttributes);
         }
     }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/ExternalAuthenticationTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/ExternalAuthenticationTest.java
index 2e051d93dd..90c6b12779 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/ExternalAuthenticationTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/ExternalAuthenticationTest.java
@@ -20,12 +20,16 @@
  */
 package org.apache.qpid.server.security.auth.manager;
 
+import static org.apache.qpid.test.utils.TestSSLConstants.BROKER_PEERSTORE;
+import static org.apache.qpid.test.utils.TestSSLConstants.BROKER_PEERSTORE_PASSWORD;
 import static org.apache.qpid.test.utils.TestSSLConstants.KEYSTORE;
 import static org.apache.qpid.test.utils.TestSSLConstants.KEYSTORE_PASSWORD;
 import static org.apache.qpid.test.utils.TestSSLConstants.TRUSTSTORE;
 import static org.apache.qpid.test.utils.TestSSLConstants.TRUSTSTORE_PASSWORD;
 import static org.apache.qpid.test.utils.TestSSLConstants.UNTRUSTED_KEYSTORE;
 
+import java.util.Arrays;
+import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -41,6 +45,7 @@ import org.apache.qpid.server.model.AuthenticationProvider;
 import org.apache.qpid.server.model.Broker;
 import org.apache.qpid.server.model.Port;
 import org.apache.qpid.server.model.Transport;
+import org.apache.qpid.server.model.TrustStore;
 import org.apache.qpid.server.plugin.AuthenticationManagerFactory;
 import org.apache.qpid.test.utils.JMXTestUtils;
 import org.apache.qpid.test.utils.QpidBrokerTestCase;
@@ -52,6 +57,7 @@ public class ExternalAuthenticationTest extends QpidBrokerTestCase
     protected void setUp() throws Exception
     {
         // not calling super.setUp() to avoid broker start-up
+        setSystemProperty("javax.net.debug", "ssl");
     }
 
     /**
@@ -168,31 +174,87 @@ public class ExternalAuthenticationTest extends QpidBrokerTestCase
     }
 
     /**
-     * Tests that when using the EXTERNAL auth provide and the broker 'peerstore' is configured to contain a certificate that is
-     * otherwise untrusted by the broker [truststore], clients using that certificate will then be able to connect.
+     * Tests that when using the EXTERNAL auth provider and a 'peersOnly' truststore, clients using certs directly in
+     * in the store will be able to connect and clients using certs signed by the same CA but not in the store will not.
      */
-    public void testExternalAuthenticationWithPeerStoreAllowsOtherwiseUntrustedClientCert() throws Exception
+    public void testExternalAuthenticationWithPeersOnlyTrustStore() throws Exception
     {
-        setCommonBrokerSSLProperties(true);
-        getBrokerConfiguration().setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_SSL_PORT, Port.AUTHENTICATION_PROVIDER, TestBrokerConfiguration.ENTRY_NAME_EXTERNAL_PROVIDER);
+        externalAuthenticationWithPeersOnlyTrustStoreTestImpl(false);
+    }
+
+    /**
+     * Tests that when using the EXTERNAL auth provider, with both the regular trust store and a 'peersOnly' truststore, clients
+     * using certs signed by the CA in the trust store are allowed even if they are not present in the 'peersOnly' store.
+     */
+    public void testExternalAuthenticationWithRegularAndPeersOnlyTrustStores() throws Exception
+    {
+        externalAuthenticationWithPeersOnlyTrustStoreTestImpl(true);
+    }
+
+    private void externalAuthenticationWithPeersOnlyTrustStoreTestImpl(boolean useTrustAndPeerStore) throws Exception
+    {
+        String peerStoreName = "myPeerStore";
+
+        List<String> storeNames = null;
+        if(useTrustAndPeerStore)
+        {
+            //Use the regular trust store AND the 'peersOnly' store. The regular trust store trusts the CA that
+            //signed both the app1 and app2 certs. The peersOnly store contains only app1 and so does not trust app2
+            storeNames = Arrays.asList(TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE, peerStoreName);
+        }
+        else
+        {
+            //use only the 'peersOnly' store, which contains only app1 and so does not trust app2
+            storeNames = Arrays.asList(peerStoreName);
+        }
+
+        //set the brokers SSL config, inc which SSL stores to use
+        setCommonBrokerSSLProperties(true, storeNames);
 
-        //Use the untrusted client keystore as the brokers peerstore to make the broker trust the cert.
-        getBrokerConfiguration().setBrokerAttribute(Broker.PEER_STORE_PATH, UNTRUSTED_KEYSTORE);
-        getBrokerConfiguration().setBrokerAttribute(Broker.PEER_STORE_PASSWORD, KEYSTORE_PASSWORD);
+        //add the peersOnly store to the config
+        Map<String, Object> sslTrustStoreAttributes = new HashMap<String, Object>();
+        sslTrustStoreAttributes.put(TrustStore.NAME, peerStoreName);
+        sslTrustStoreAttributes.put(TrustStore.PATH, BROKER_PEERSTORE);
+        sslTrustStoreAttributes.put(TrustStore.PASSWORD, BROKER_PEERSTORE_PASSWORD);
+        sslTrustStoreAttributes.put(TrustStore.PEERS_ONLY, true);
+        getBrokerConfiguration().addTrustStoreConfiguration(sslTrustStoreAttributes);
+
+        getBrokerConfiguration().setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_SSL_PORT, Port.AUTHENTICATION_PROVIDER, TestBrokerConfiguration.ENTRY_NAME_EXTERNAL_PROVIDER);
 
         super.setUp();
 
-        setUntrustedClientKeystoreProperties();
+        setClientKeystoreProperties();
         setClientTrustoreProperties();
 
         try
         {
-            getExternalSSLConnection(false);
-            fail("Untrusted client's validation against the broker's multi store manager unexpectedly passed.");
+            //use the app1 cert, which IS in the peerstore (and has CA in the trustStore)
+            getExternalSSLConnection(false, "&ssl_cert_alias='app1'");
+        }
+        catch (JMSException e)
+        {
+            fail("Client's validation against the broker's multi store manager unexpectedly failed, when configured store was expected to allow.");
+        }
+
+        try
+        {
+            //use the app2 cert, which is NOT in the peerstore (but is signed by the same CA as app1)
+            getExternalSSLConnection(false, "&ssl_cert_alias='app2'");
+            if(!useTrustAndPeerStore)
+            {
+                fail("Client's validation against the broker's multi store manager unexpectedly passed, when configured store was expected to deny.");
+            }
         }
         catch (JMSException e)
         {
-            // expected
+            if(useTrustAndPeerStore)
+            {
+                fail("Client's validation against the broker's multi store manager unexpectedly failed, when configured store was expected to allow.");
+            }
+            else
+            {
+                //expected, the CA in trust store should allow both app1 and app2
+            }
         }
     }
 
@@ -215,7 +277,7 @@ public class ExternalAuthenticationTest extends QpidBrokerTestCase
 
         try
         {
-            getExternalSSLConnection(false);
+            getExternalSSLConnection(false, "&ssl_cert_alias='app2'");
         }
         catch (JMSException e)
         {
@@ -250,7 +312,7 @@ public class ExternalAuthenticationTest extends QpidBrokerTestCase
 
         try
         {
-            getExternalSSLConnection(false);
+            getExternalSSLConnection(false, "&ssl_cert_alias='app2'");
         }
         catch (JMSException e)
         {
@@ -267,26 +329,38 @@ public class ExternalAuthenticationTest extends QpidBrokerTestCase
 
     private Connection getExternalSSLConnection(boolean includeUserNameAndPassword) throws Exception
     {
-        String url = "amqp://%s@test/?brokerlist='tcp://localhost:%s?ssl='true'&sasl_mechs='EXTERNAL'&ssl_cert_alias='app2''";
+        return getExternalSSLConnection(includeUserNameAndPassword, "");
+    }
+
+    private Connection getExternalSSLConnection(boolean includeUserNameAndPassword, String optionString) throws Exception
+    {
+        String url = "amqp://%s@test/?brokerlist='tcp://localhost:%s?ssl='true'&sasl_mechs='EXTERNAL'%s'";
         if (includeUserNameAndPassword)
         {
-            url = String.format(url, "guest:guest", String.valueOf(QpidBrokerTestCase.DEFAULT_SSL_PORT));
+            url = String.format(url, "guest:guest", String.valueOf(QpidBrokerTestCase.DEFAULT_SSL_PORT), optionString);
         }
         else
         {
-            url = String.format(url, ":", String.valueOf(QpidBrokerTestCase.DEFAULT_SSL_PORT));
+            url = String.format(url, ":", String.valueOf(QpidBrokerTestCase.DEFAULT_SSL_PORT), optionString);
         }
         return getConnection(new AMQConnectionURL(url));
     }
 
     private void setCommonBrokerSSLProperties(boolean needClientAuth) throws ConfigurationException
     {
+        setCommonBrokerSSLProperties(needClientAuth, Collections.singleton(TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE));
+    }
+
+    private void setCommonBrokerSSLProperties(boolean needClientAuth, Collection<String> trustStoreNames) throws ConfigurationException
+    {
         TestBrokerConfiguration config = getBrokerConfiguration();
         Map<String, Object> sslPortAttributes = new HashMap<String, Object>();
         sslPortAttributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
         sslPortAttributes.put(Port.PORT, DEFAULT_SSL_PORT);
         sslPortAttributes.put(Port.NEED_CLIENT_AUTH, String.valueOf(needClientAuth));
         sslPortAttributes.put(Port.NAME, TestBrokerConfiguration.ENTRY_NAME_SSL_PORT);
+        sslPortAttributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
+        sslPortAttributes.put(Port.TRUST_STORES, trustStoreNames);
         config.addPortConfiguration(sslPortAttributes);
 
         Map<String, Object> externalAuthProviderAttributes = new HashMap<String, Object>();
@@ -311,6 +385,5 @@ public class ExternalAuthenticationTest extends QpidBrokerTestCase
     {
         setSystemProperty("javax.net.ssl.trustStore", TRUSTSTORE);
         setSystemProperty("javax.net.ssl.trustStorePassword", TRUSTSTORE_PASSWORD);
-        setSystemProperty("javax.net.debug", "ssl");
     }
 }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/MultipleAuthenticationManagersTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/MultipleAuthenticationManagersTest.java
index 40346d7424..44057025ba 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/MultipleAuthenticationManagersTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/auth/manager/MultipleAuthenticationManagersTest.java
@@ -56,6 +56,8 @@ public class MultipleAuthenticationManagersTest extends QpidBrokerTestCase
         sslPortAttributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
         sslPortAttributes.put(Port.PORT, DEFAULT_SSL_PORT);
         sslPortAttributes.put(Port.NAME, TestBrokerConfiguration.ENTRY_NAME_SSL_PORT);
+        sslPortAttributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
+        sslPortAttributes.put(Port.TRUST_STORES, Collections.singleton(TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE));
         sslPortAttributes.put(Port.AUTHENTICATION_PROVIDER, TestBrokerConfiguration.ENTRY_NAME_ANONYMOUS_PROVIDER);
         config.addPortConfiguration(sslPortAttributes);
 
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/management/jmx/ManagementLoggingTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/management/jmx/ManagementLoggingTest.java
index 9279287117..4ec38fbe23 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/management/jmx/ManagementLoggingTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/management/jmx/ManagementLoggingTest.java
@@ -314,11 +314,9 @@ public class ManagementLoggingTest extends AbstractTestLogging
 
         if(useManagementSSL)
         {
-            // This test requires we have an ssl connection
+            // This test requires we have ssl, change the transport and add they keystore to the port config
             config.setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_JMX_PORT, Port.TRANSPORTS, Collections.singleton(Transport.SSL));
-
-            setSystemProperty("javax.net.ssl.keyStore", "test-profiles/test_resources/ssl/java_broker_keystore.jks");
-            setSystemProperty("javax.net.ssl.keyStorePassword", "password");
+            config.setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_JMX_PORT, Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
         }
 
         startBroker();
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/Asserts.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/Asserts.java
index e20db6a6ac..6f795cc61d 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/Asserts.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/Asserts.java
@@ -207,14 +207,14 @@ public class Asserts
         }
         if (isAMQPPort)
         {
-            assertAttributesPresent(port, Port.AVAILABLE_ATTRIBUTES, Port.CREATED, Port.UPDATED, Port.AUTHENTICATION_PROVIDER);
+            assertAttributesPresent(port, Port.AVAILABLE_ATTRIBUTES, Port.CREATED, Port.UPDATED, Port.AUTHENTICATION_PROVIDER, Port.KEY_STORE, Port.TRUST_STORES);
             assertNotNull("Unexpected value of attribute " + Port.BINDING_ADDRESS, port.get(Port.BINDING_ADDRESS));
         }
         else
         {
             assertAttributesPresent(port, Port.AVAILABLE_ATTRIBUTES, Port.CREATED, Port.UPDATED, Port.AUTHENTICATION_PROVIDER,
                     Port.BINDING_ADDRESS, Port.TCP_NO_DELAY, Port.SEND_BUFFER_SIZE, Port.RECEIVE_BUFFER_SIZE,
-                    Port.NEED_CLIENT_AUTH, Port.WANT_CLIENT_AUTH);
+                    Port.NEED_CLIENT_AUTH, Port.WANT_CLIENT_AUTH, Port.KEY_STORE, Port.TRUST_STORES);
         }
 
         @SuppressWarnings("unchecked")
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BasicAuthRestTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BasicAuthRestTest.java
index 22fb70fa68..ea63cc7f4e 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BasicAuthRestTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BasicAuthRestTest.java
@@ -58,6 +58,8 @@ public class BasicAuthRestTest extends QpidRestTestCase
         if (useSsl)
         {
             getBrokerConfiguration().setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_HTTP_PORT, Port.PROTOCOLS, Collections.singleton(Protocol.HTTPS));
+            getBrokerConfiguration().setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_HTTP_PORT, Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
+
         }
         super.customizeConfiguration();
     }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestHttpsTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestHttpsTest.java
index 06927946ba..7fd13ed8aa 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestHttpsTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestHttpsTest.java
@@ -54,6 +54,7 @@ public class BrokerRestHttpsTest extends QpidRestTestCase
         Map<String, Object> newAttributes = new HashMap<String, Object>();
         newAttributes.put(Port.PROTOCOLS, Collections.singleton(Protocol.HTTPS));
         newAttributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
+        newAttributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
         getBrokerConfiguration().setObjectAttributes(TestBrokerConfiguration.ENTRY_NAME_HTTP_PORT,newAttributes);
     }
 
@@ -63,7 +64,6 @@ public class BrokerRestHttpsTest extends QpidRestTestCase
 
         Asserts.assertAttributesPresent(brokerDetails, Broker.AVAILABLE_ATTRIBUTES, Broker.BYTES_RETAINED,
                 Broker.PROCESS_PID, Broker.SUPPORTED_STORE_TYPES, Broker.CREATED, Broker.TIME_TO_LIVE, Broker.UPDATED,
-                Broker.ACL_FILE, Broker.KEY_STORE_CERT_ALIAS, Broker.TRUST_STORE_PATH, Broker.TRUST_STORE_PASSWORD,
-                Broker.GROUP_FILE, Broker.PEER_STORE_PATH, Broker.PEER_STORE_PASSWORD);
+                Broker.ACL_FILE, Broker.GROUP_FILE);
     }
 }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java
index a795063750..f0e4c1d02a 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/BrokerRestTest.java
@@ -142,13 +142,6 @@ public class BrokerRestTest extends QpidRestTestCase
         invalidAttributes.put(Broker.CONNECTION_HEART_BEAT_DELAY, -11000);
         invalidAttributes.put(Broker.STATISTICS_REPORTING_PERIOD, -12000);
         invalidAttributes.put(Broker.ACL_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-acl.acl");
-        invalidAttributes.put(Broker.KEY_STORE_PATH, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-keystore.jks");
-        invalidAttributes.put(Broker.KEY_STORE_PASSWORD, "password1");
-        invalidAttributes.put(Broker.KEY_STORE_CERT_ALIAS, "java-broker1");
-        invalidAttributes.put(Broker.TRUST_STORE_PATH, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-truststore.jks");
-        invalidAttributes.put(Broker.TRUST_STORE_PASSWORD, "password2");
-        invalidAttributes.put(Broker.PEER_STORE_PATH, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "non-existing-peerstore.jks");
-        invalidAttributes.put(Broker.PEER_STORE_PASSWORD, "password3");
         invalidAttributes.put(Broker.GROUP_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "groups-non-existing");
         invalidAttributes.put(Broker.VIRTUALHOST_STORE_TRANSACTION_IDLE_TIMEOUT_CLOSE, -13000);
         invalidAttributes.put(Broker.VIRTUALHOST_STORE_TRANSACTION_IDLE_TIMEOUT_WARN, -14000);
@@ -191,13 +184,6 @@ public class BrokerRestTest extends QpidRestTestCase
         brokerAttributes.put(Broker.STATISTICS_REPORTING_PERIOD, 12000);
         brokerAttributes.put(Broker.STATISTICS_REPORTING_RESET_ENABLED, true);
         brokerAttributes.put(Broker.ACL_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "broker_example.acl");
-        brokerAttributes.put(Broker.KEY_STORE_PATH, TestSSLConstants.BROKER_KEYSTORE);
-        brokerAttributes.put(Broker.KEY_STORE_PASSWORD, TestSSLConstants.BROKER_KEYSTORE_PASSWORD);
-        brokerAttributes.put(Broker.KEY_STORE_CERT_ALIAS, "java-broker");
-        brokerAttributes.put(Broker.TRUST_STORE_PATH, TestSSLConstants.TRUSTSTORE);
-        brokerAttributes.put(Broker.TRUST_STORE_PASSWORD, TestSSLConstants.TRUSTSTORE_PASSWORD);
-        brokerAttributes.put(Broker.PEER_STORE_PATH, TestSSLConstants.TRUSTSTORE);
-        brokerAttributes.put(Broker.PEER_STORE_PASSWORD, TestSSLConstants.TRUSTSTORE_PASSWORD);
         brokerAttributes.put(Broker.GROUP_FILE, QpidTestCase.QPID_HOME + File.separator + "etc" + File.separator + "groups");
         brokerAttributes.put(Broker.VIRTUALHOST_STORE_TRANSACTION_IDLE_TIMEOUT_CLOSE, 13000);
         brokerAttributes.put(Broker.VIRTUALHOST_STORE_TRANSACTION_IDLE_TIMEOUT_WARN, 14000);
@@ -212,10 +198,7 @@ public class BrokerRestTest extends QpidRestTestCase
         {
             String attributeName = entry.getKey();
             Object attributeValue = entry.getValue();
-            if (attributeName.equals(Broker.KEY_STORE_PASSWORD) || attributeName.equals(Broker.TRUST_STORE_PASSWORD) || attributeName.equals(Broker.PEER_STORE_PASSWORD))
-            {
-                attributeValue = "********";
-            }
+
             Object currentValue = actualAttributes.get(attributeName);
             assertEquals("Unexpected attribute " + attributeName + " value:", attributeValue, currentValue);
         }
@@ -225,10 +208,7 @@ public class BrokerRestTest extends QpidRestTestCase
     {
         Asserts.assertAttributesPresent(brokerDetails, Broker.AVAILABLE_ATTRIBUTES,
                 Broker.BYTES_RETAINED, Broker.PROCESS_PID, Broker.SUPPORTED_STORE_TYPES,
-                Broker.CREATED, Broker.TIME_TO_LIVE, Broker.UPDATED, Broker.ACL_FILE,
-                Broker.KEY_STORE_PATH, Broker.KEY_STORE_PASSWORD, Broker.KEY_STORE_CERT_ALIAS,
-                Broker.TRUST_STORE_PATH, Broker.TRUST_STORE_PASSWORD, Broker.GROUP_FILE,
-                Broker.PEER_STORE_PATH, Broker.PEER_STORE_PASSWORD);
+                Broker.CREATED, Broker.TIME_TO_LIVE, Broker.UPDATED, Broker.ACL_FILE, Broker.GROUP_FILE);
 
         assertEquals("Unexpected value of attribute " + Broker.BUILD_VERSION, QpidProperties.getBuildVersion(),
                 brokerDetails.get(Broker.BUILD_VERSION));
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/KeyStoreRestTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/KeyStoreRestTest.java
new file mode 100644
index 0000000000..149ddcfcbb
--- /dev/null
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/KeyStoreRestTest.java
@@ -0,0 +1,269 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.systest.rest;
+
+import java.io.IOException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.qpid.server.model.KeyStore;
+import org.apache.qpid.server.model.Port;
+import org.apache.qpid.server.model.Transport;
+import org.apache.qpid.server.model.adapter.AbstractKeyStoreAdapter;
+import org.apache.qpid.test.utils.TestBrokerConfiguration;
+import org.apache.qpid.test.utils.TestSSLConstants;
+import org.codehaus.jackson.JsonGenerationException;
+import org.codehaus.jackson.JsonParseException;
+import org.codehaus.jackson.map.JsonMappingException;
+
+public class KeyStoreRestTest extends QpidRestTestCase
+{
+    @Override
+    public void setUp() throws Exception
+    {
+        // not calling super.setUp() to avoid broker start-up until
+        // after any necessary configuration
+    }
+
+    public void testGet() throws Exception
+    {
+        super.setUp();
+
+        //verify existence of the default keystore used by the systests
+        List<Map<String, Object>> keyStores = assertNumberOfKeyStores(1);
+
+        Map<String, Object> keystore = keyStores.get(0);
+        assertKeyStoreAttributes(keystore, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE,
+                System.getProperty(QPID_HOME) + "/../" + TestSSLConstants.BROKER_KEYSTORE, null);
+    }
+
+    public void testCreate() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+        String certAlias = "app2";
+
+        assertNumberOfKeyStores(1);
+        createKeyStore(name, certAlias);
+        assertNumberOfKeyStores(2);
+
+        List<Map<String, Object>> keyStores = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details cannot be null", keyStores);
+
+        assertKeyStoreAttributes(keyStores.get(0), name, TestSSLConstants.KEYSTORE, certAlias);
+    }
+
+    public void testDelete() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+        String certAlias = "app2";
+
+        assertNumberOfKeyStores(1);
+        createKeyStore(name, certAlias);
+        assertNumberOfKeyStores(2);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name , "DELETE", null);
+        assertEquals("Unexpected response code for provider deletion", 200, responseCode);
+
+        List<Map<String, Object>> keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+        assertTrue("details should be empty as the keystore no longer exists", keyStore.isEmpty());
+
+        //check only the default systests key store remains
+        List<Map<String, Object>> keyStores = assertNumberOfKeyStores(1);
+        Map<String, Object> keystore = keyStores.get(0);
+        assertKeyStoreAttributes(keystore, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE,
+                System.getProperty(QPID_HOME) + "/../" + TestSSLConstants.BROKER_KEYSTORE, null);
+    }
+
+    public void testDeleteFailsWhenKeyStoreInUse() throws Exception
+    {
+        String name = "testDeleteFailsWhenKeyStoreInUse";
+
+        //add a new key store config to use
+        Map<String, Object> sslKeyStoreAttributes = new HashMap<String, Object>();
+        sslKeyStoreAttributes.put(KeyStore.NAME, name);
+        sslKeyStoreAttributes.put(KeyStore.PATH, TestSSLConstants.BROKER_KEYSTORE);
+        sslKeyStoreAttributes.put(KeyStore.PASSWORD, TestSSLConstants.BROKER_KEYSTORE_PASSWORD);
+        getBrokerConfiguration().addKeyStoreConfiguration(sslKeyStoreAttributes);
+
+        //add the SSL port using it
+        Map<String, Object> sslPortAttributes = new HashMap<String, Object>();
+        sslPortAttributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
+        sslPortAttributes.put(Port.PORT, DEFAULT_SSL_PORT);
+        sslPortAttributes.put(Port.NAME, TestBrokerConfiguration.ENTRY_NAME_SSL_PORT);
+        sslPortAttributes.put(Port.KEY_STORE, name);
+        getBrokerConfiguration().addPortConfiguration(sslPortAttributes);
+
+        super.setUp();
+
+        //verify the keystore is there
+        assertNumberOfKeyStores(2);
+
+        List<Map<String, Object>> keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.BROKER_KEYSTORE, null);
+
+        //try to delete it, which should fail as it is in use
+        int responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name , "DELETE", null);
+        assertEquals("Unexpected response code for provider deletion", 409, responseCode);
+
+        //check its still there
+        assertNumberOfKeyStores(2);
+        keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.BROKER_KEYSTORE, null);
+    }
+
+    public void testUpdateWithGoodPathSucceeds() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfKeyStores(1);
+        createKeyStore(name, null);
+        assertNumberOfKeyStores(2);
+
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(KeyStore.NAME, name);
+        attributes.put(KeyStore.PATH, TestSSLConstants.UNTRUSTED_KEYSTORE);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for keystore update", 200, responseCode);
+
+        List<Map<String, Object>> keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.UNTRUSTED_KEYSTORE, null);
+    }
+
+    public void testUpdateWithNonExistentPathFails() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfKeyStores(1);
+        createKeyStore(name, null);
+        assertNumberOfKeyStores(2);
+
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(KeyStore.NAME, name);
+        attributes.put(KeyStore.PATH, "does.not.exist");
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for keystore update", 409, responseCode);
+
+        List<Map<String, Object>> keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+
+        //verify the details remain unchanged
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.KEYSTORE, null);
+    }
+
+    public void testUpdateCertificateAlias() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfKeyStores(1);
+        createKeyStore(name, "app1");
+        assertNumberOfKeyStores(2);
+
+        List<Map<String, Object>> keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.KEYSTORE, "app1");
+
+        //Update the certAlias from app1 to app2
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(KeyStore.NAME, name);
+        attributes.put(KeyStore.CERTIFICATE_ALIAS, "app2");
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for keystore update", 200, responseCode);
+
+        keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.KEYSTORE, "app2");
+
+        //Update the certAlias to clear it (i.e go from from app1 to null)
+        attributes = new HashMap<String, Object>();
+        attributes.put(KeyStore.NAME, name);
+        attributes.put(KeyStore.CERTIFICATE_ALIAS, null);
+
+        responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for keystore update", 200, responseCode);
+
+        keyStore = getRestTestHelper().getJsonAsList("/rest/keystore/" + name);
+        assertNotNull("details should not be null", keyStore);
+
+        assertKeyStoreAttributes(keyStore.get(0), name, TestSSLConstants.KEYSTORE, null);
+    }
+
+    private List<Map<String, Object>> assertNumberOfKeyStores(int numberOfKeystores) throws IOException,
+    JsonParseException, JsonMappingException
+    {
+        List<Map<String, Object>> keyStores = getRestTestHelper().getJsonAsList("/rest/keystore");
+        assertNotNull("keystores should not be null", keyStores);
+        assertEquals("Unexpected number of keystores", numberOfKeystores, keyStores.size());
+
+        return keyStores;
+    }
+
+    private void createKeyStore(String name, String certAlias) throws IOException, JsonGenerationException, JsonMappingException
+    {
+        Map<String, Object> keyStoreAttributes = new HashMap<String, Object>();
+        keyStoreAttributes.put(KeyStore.NAME, name);
+        keyStoreAttributes.put(KeyStore.PATH, TestSSLConstants.KEYSTORE);
+        keyStoreAttributes.put(KeyStore.PASSWORD, TestSSLConstants.KEYSTORE_PASSWORD);
+        keyStoreAttributes.put(KeyStore.CERTIFICATE_ALIAS, certAlias);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/keystore/" + name, "PUT", keyStoreAttributes);
+        assertEquals("Unexpected response code", 201, responseCode);
+    }
+
+    private void assertKeyStoreAttributes(Map<String, Object> keystore, String name, String path, String certAlias)
+    {
+        assertEquals("default systests key store is missing",
+                name, keystore.get(KeyStore.NAME));
+        assertEquals("unexpected path to key store",
+                path, keystore.get(KeyStore.PATH));
+        assertEquals("unexpected (dummy) password of default systests key store",
+                AbstractKeyStoreAdapter.DUMMY_PASSWORD_MASK, keystore.get(KeyStore.PASSWORD));
+        assertEquals("unexpected type of default systests key store",
+                java.security.KeyStore.getDefaultType(), keystore.get(KeyStore.TYPE));
+        assertEquals("unexpected certificateAlias value",
+                certAlias, keystore.get(KeyStore.CERTIFICATE_ALIAS));
+        if(certAlias == null)
+        {
+            assertFalse("should not be a certificateAlias attribute",
+                            keystore.containsKey(KeyStore.CERTIFICATE_ALIAS));
+        }
+    }
+}
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/PortRestTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/PortRestTest.java
index 1497d740dc..8ec9e50fa9 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/PortRestTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/PortRestTest.java
@@ -30,7 +30,6 @@ import java.util.List;
 import java.util.Map;
 
 import org.apache.qpid.server.model.AuthenticationProvider;
-import org.apache.qpid.server.model.Broker;
 import org.apache.qpid.server.model.Port;
 import org.apache.qpid.server.model.Protocol;
 import org.apache.qpid.server.model.State;
@@ -205,6 +204,7 @@ public class PortRestTest extends QpidRestTestCase
         Map<String, Object> attributes = new HashMap<String, Object>();
         attributes.put(Port.NAME, portName);
         attributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
+        attributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
 
         int responseCode = getRestTestHelper().submitRequest("/rest/port/" + portName, "PUT", attributes);
         assertEquals("Transport has not been changed to SSL " , 200, responseCode);
@@ -217,12 +217,13 @@ public class PortRestTest extends QpidRestTestCase
         Collection<String> transports = (Collection<String>) port.get(Port.TRANSPORTS);
         assertEquals("Unexpected auth provider", new HashSet<String>(Arrays.asList(Transport.SSL.name())),
                 new HashSet<String>(transports));
+
+        String keyStore = (String) port.get(Port.KEY_STORE);
+        assertEquals("Unexpected auth provider", TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE, keyStore);
     }
 
     public void testUpdateTransportFromTCPToSSLWithoutKeystoreConfiguredFails() throws Exception
     {
-        getBrokerConfiguration().setBrokerAttribute(Broker.KEY_STORE_PATH, null);
-        getBrokerConfiguration().setSaved(false);
         restartBrokerInManagementMode();
 
         String portName = TestBrokerConfiguration.ENTRY_NAME_AMQP_PORT;
@@ -241,6 +242,8 @@ public class PortRestTest extends QpidRestTestCase
         attributes.put(Port.NAME, portName);
         attributes.put(Port.PORT, DEFAULT_SSL_PORT);
         attributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
+        attributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
+        attributes.put(Port.TRUST_STORES, Collections.singleton(TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE));
 
         int responseCode = getRestTestHelper().submitRequest("/rest/port/" + portName, "PUT", attributes);
         assertEquals("SSL port was not added", 201, responseCode);
@@ -257,6 +260,11 @@ public class PortRestTest extends QpidRestTestCase
         Map<String, Object> port = getRestTestHelper().getJsonAsSingletonList("/rest/port/" + portName);
         assertEquals("Unexpected " + Port.NEED_CLIENT_AUTH, true, port.get(Port.NEED_CLIENT_AUTH));
         assertEquals("Unexpected " + Port.WANT_CLIENT_AUTH, true, port.get(Port.WANT_CLIENT_AUTH));
+        assertEquals("Unexpected " + Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE, port.get(Port.KEY_STORE));
+        @SuppressWarnings("unchecked")
+        Collection<String> trustStores = (Collection<String>) port.get(Port.TRUST_STORES);
+        assertEquals("Unexpected auth provider", new HashSet<String>(Arrays.asList(TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE)),
+                new HashSet<String>(trustStores));
 
         restartBrokerInManagementMode();
 
@@ -265,7 +273,7 @@ public class PortRestTest extends QpidRestTestCase
         attributes.put(Port.TRANSPORTS, Collections.singleton(Transport.TCP));
 
         responseCode = getRestTestHelper().submitRequest("/rest/port/" + portName, "PUT", attributes);
-        assertEquals("Should not be able to change transport to SSL without reseting of attributes for need/want client auth", 409, responseCode);
+        assertEquals("Should not be able to change transport to TCP without reseting of attributes for need/want client auth", 409, responseCode);
 
         attributes = new HashMap<String, Object>();
         attributes.put(Port.NAME, portName);
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/TrustStoreRestTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/TrustStoreRestTest.java
new file mode 100644
index 0000000000..87e7367235
--- /dev/null
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/TrustStoreRestTest.java
@@ -0,0 +1,261 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.systest.rest;
+
+import java.io.IOException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.qpid.server.model.KeyStore;
+import org.apache.qpid.server.model.Port;
+import org.apache.qpid.server.model.Transport;
+import org.apache.qpid.server.model.TrustStore;
+import org.apache.qpid.server.model.adapter.AbstractKeyStoreAdapter;
+import org.apache.qpid.test.utils.TestBrokerConfiguration;
+import org.apache.qpid.test.utils.TestSSLConstants;
+import org.codehaus.jackson.JsonGenerationException;
+import org.codehaus.jackson.JsonParseException;
+import org.codehaus.jackson.map.JsonMappingException;
+
+public class TrustStoreRestTest extends QpidRestTestCase
+{
+    @Override
+    public void setUp() throws Exception
+    {
+        // not calling super.setUp() to avoid broker start-up until
+        // after any necessary configuration
+    }
+
+    public void testGet() throws Exception
+    {
+        super.setUp();
+
+        //verify existence of the default trust store used by the systests
+        List<Map<String, Object>> trustStores = assertNumberOfTrustStores(1);
+
+        Map<String, Object> truststore = trustStores.get(0);
+        assertTrustStoreAttributes(truststore, TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE,
+                System.getProperty(QPID_HOME) + "/../" + TestSSLConstants.BROKER_TRUSTSTORE, false);
+    }
+
+    public void testCreate() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfTrustStores(1);
+        createTrustStore(name, true);
+        assertNumberOfTrustStores(2);
+
+        List<Map<String, Object>> trustStores = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details cannot be null", trustStores);
+
+        assertTrustStoreAttributes(trustStores.get(0), name, TestSSLConstants.TRUSTSTORE, true);
+    }
+
+    public void testDelete() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfTrustStores(1);
+        createTrustStore(name, false);
+        assertNumberOfTrustStores(2);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name , "DELETE", null);
+        assertEquals("Unexpected response code for provider deletion", 200, responseCode);
+
+        List<Map<String, Object>> trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+        assertTrue("details should be empty as the truststore no longer exists", trustStore.isEmpty());
+
+        //check only the default systests trust store remains
+        List<Map<String, Object>> trustStores = assertNumberOfTrustStores(1);
+        Map<String, Object> truststore = trustStores.get(0);
+        assertTrustStoreAttributes(truststore, TestBrokerConfiguration.ENTRY_NAME_SSL_TRUSTSTORE,
+                System.getProperty(QPID_HOME) + "/../" + TestSSLConstants.BROKER_TRUSTSTORE, false);
+    }
+
+    public void testDeleteFailsWhenTrustStoreInUse() throws Exception
+    {
+        String name = "testDeleteFailsWhenTrustStoreInUse";
+
+        //add a new trust store config to use
+        Map<String, Object> sslTrustStoreAttributes = new HashMap<String, Object>();
+        sslTrustStoreAttributes.put(TrustStore.NAME, name);
+        sslTrustStoreAttributes.put(TrustStore.PATH, TestSSLConstants.TRUSTSTORE);
+        sslTrustStoreAttributes.put(TrustStore.PASSWORD, TestSSLConstants.TRUSTSTORE_PASSWORD);
+        getBrokerConfiguration().addTrustStoreConfiguration(sslTrustStoreAttributes);
+
+        //add the SSL port using it
+        Map<String, Object> sslPortAttributes = new HashMap<String, Object>();
+        sslPortAttributes.put(Port.TRANSPORTS, Collections.singleton(Transport.SSL));
+        sslPortAttributes.put(Port.PORT, DEFAULT_SSL_PORT);
+        sslPortAttributes.put(Port.NAME, TestBrokerConfiguration.ENTRY_NAME_SSL_PORT);
+        sslPortAttributes.put(Port.KEY_STORE, TestBrokerConfiguration.ENTRY_NAME_SSL_KEYSTORE);
+        sslPortAttributes.put(Port.TRUST_STORES, Collections.singleton(name));
+        getBrokerConfiguration().addPortConfiguration(sslPortAttributes);
+
+        super.setUp();
+
+        //verify the truststore is there
+        assertNumberOfTrustStores(2);
+
+        List<Map<String, Object>> trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+        assertTrustStoreAttributes(trustStore.get(0), name, TestSSLConstants.TRUSTSTORE, false);
+
+        //try to delete it, which should fail as it is in use
+        int responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name , "DELETE", null);
+        assertEquals("Unexpected response code for provider deletion", 409, responseCode);
+
+        //check its still there
+        assertNumberOfTrustStores(2);
+        trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+        assertTrustStoreAttributes(trustStore.get(0), name, TestSSLConstants.TRUSTSTORE, false);
+    }
+
+    public void testUpdateWithGoodPathSucceeds() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfTrustStores(1);
+        createTrustStore(name, false);
+        assertNumberOfTrustStores(2);
+
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(TrustStore.NAME, name);
+        attributes.put(TrustStore.PATH, TestSSLConstants.TRUSTSTORE);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for truststore update", 200, responseCode);
+
+        List<Map<String, Object>> trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+
+        assertTrustStoreAttributes(trustStore.get(0), name, TestSSLConstants.TRUSTSTORE, false);
+    }
+
+    public void testUpdateWithNonExistentPathFails() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfTrustStores(1);
+        createTrustStore(name, false);
+        assertNumberOfTrustStores(2);
+
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(TrustStore.NAME, name);
+        attributes.put(TrustStore.PATH, "does.not.exist");
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for trust store update", 409, responseCode);
+
+        List<Map<String, Object>> trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+
+        //verify the details remain unchanged
+        assertTrustStoreAttributes(trustStore.get(0), name, TestSSLConstants.TRUSTSTORE, false);
+    }
+
+    public void testUpdatePeersOnly() throws Exception
+    {
+        super.setUp();
+
+        String name = getTestName();
+
+        assertNumberOfTrustStores(1);
+        createTrustStore(name, false);
+        assertNumberOfTrustStores(2);
+
+        //update the peersOnly attribute from false to true
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(TrustStore.NAME, name);
+        attributes.put(TrustStore.PEERS_ONLY, true);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for trust store update", 200, responseCode);
+
+        List<Map<String, Object>> trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+
+        assertTrustStoreAttributes(trustStore.get(0), name, TestSSLConstants.TRUSTSTORE, true);
+
+        //Update peersOnly to clear it (i.e go from from true to null, which will default to false)
+        attributes = new HashMap<String, Object>();
+        attributes.put(TrustStore.NAME, name);
+        attributes.put(TrustStore.PEERS_ONLY, null);
+
+        responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name , "PUT", attributes);
+        assertEquals("Unexpected response code for trust store update", 200, responseCode);
+
+        trustStore = getRestTestHelper().getJsonAsList("/rest/truststore/" + name);
+        assertNotNull("details should not be null", trustStore);
+
+        assertTrustStoreAttributes(trustStore.get(0), name, TestSSLConstants.TRUSTSTORE, false);
+    }
+
+    private List<Map<String, Object>> assertNumberOfTrustStores(int numberOfTrustStores) throws IOException,
+    JsonParseException, JsonMappingException
+    {
+        List<Map<String, Object>> trustStores = getRestTestHelper().getJsonAsList("/rest/truststore");
+        assertNotNull("trust stores should not be null", trustStores);
+        assertEquals("Unexpected number of trust stores", numberOfTrustStores, trustStores.size());
+
+        return trustStores;
+    }
+
+    private void createTrustStore(String name, boolean peersOnly) throws IOException, JsonGenerationException, JsonMappingException
+    {
+        Map<String, Object> trustStoreAttributes = new HashMap<String, Object>();
+        trustStoreAttributes.put(TrustStore.NAME, name);
+        //deliberately using the client trust store to differentiate from the one we are already for broker
+        trustStoreAttributes.put(TrustStore.PATH, TestSSLConstants.TRUSTSTORE);
+        trustStoreAttributes.put(TrustStore.PASSWORD, TestSSLConstants.TRUSTSTORE_PASSWORD);
+        trustStoreAttributes.put(TrustStore.PEERS_ONLY, peersOnly);
+
+        int responseCode = getRestTestHelper().submitRequest("/rest/truststore/" + name, "PUT", trustStoreAttributes);
+        assertEquals("Unexpected response code", 201, responseCode);
+    }
+
+    private void assertTrustStoreAttributes(Map<String, Object> truststore, String name, String path, boolean peersOnly)
+    {
+        assertEquals("default systests trust store is missing",
+                name, truststore.get(TrustStore.NAME));
+        assertEquals("unexpected path to trust store",
+                path, truststore.get(TrustStore.PATH));
+        assertEquals("unexpected (dummy) password of default systests trust store",
+                AbstractKeyStoreAdapter.DUMMY_PASSWORD_MASK, truststore.get(TrustStore.PASSWORD));
+        assertEquals("unexpected type of default systests trust store",
+                java.security.KeyStore.getDefaultType(), truststore.get(TrustStore.TYPE));
+        assertEquals("unexpected peersOnly value",
+                peersOnly, truststore.get(TrustStore.PEERS_ONLY));
+    }
+}
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/JMXTestUtils.java b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/JMXTestUtils.java
index 6e6e3271f0..4004a43fde 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/JMXTestUtils.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/JMXTestUtils.java
@@ -31,8 +31,6 @@ import org.apache.qpid.management.common.mbeans.ManagedExchange;
 import org.apache.qpid.management.common.mbeans.ManagedQueue;
 import org.apache.qpid.management.common.mbeans.ServerInformation;
 import org.apache.qpid.management.common.mbeans.UserManagement;
-import org.apache.qpid.server.model.Plugin;
-import org.apache.qpid.server.plugin.PluginFactory;
 
 import javax.management.InstanceNotFoundException;
 import javax.management.JMException;
@@ -47,9 +45,7 @@ import javax.management.ObjectName;
 import javax.management.remote.JMXConnector;
 import java.io.IOException;
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
 
 /**
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestBrokerConfiguration.java b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestBrokerConfiguration.java
index db10bfb7e7..44a46fc8b2 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestBrokerConfiguration.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestBrokerConfiguration.java
@@ -31,8 +31,10 @@ import java.util.UUID;
 import org.apache.qpid.server.configuration.ConfigurationEntry;
 import org.apache.qpid.server.configuration.store.MemoryConfigurationEntryStore;
 import org.apache.qpid.server.model.AuthenticationProvider;
+import org.apache.qpid.server.model.KeyStore;
 import org.apache.qpid.server.model.Plugin;
 import org.apache.qpid.server.model.Port;
+import org.apache.qpid.server.model.TrustStore;
 import org.apache.qpid.server.model.UUIDGenerator;
 import org.apache.qpid.server.model.VirtualHost;
 import org.apache.qpid.server.plugin.PluginFactory;
@@ -52,6 +54,8 @@ public class TestBrokerConfiguration
     public static final String ENTRY_NAME_JMX_MANAGEMENT = "MANAGEMENT-JMX";
     public static final String MANAGEMENT_JMX_PLUGIN_TYPE = "MANAGEMENT-JMX";
     public static final String ENTRY_NAME_ANONYMOUS_PROVIDER = "anonymous";
+    public static final String ENTRY_NAME_SSL_KEYSTORE = "systestsKeyStore";
+    public static final String ENTRY_NAME_SSL_TRUSTSTORE = "systestsTrustStore";
 
     private MemoryConfigurationEntryStore _store;
     private boolean _saved;
@@ -144,6 +148,18 @@ public class TestBrokerConfiguration
         return addObjectConfiguration(name, AuthenticationProvider.class.getSimpleName(), attributes);
     }
 
+    public UUID addTrustStoreConfiguration(Map<String, Object> attributes)
+    {
+        String name = (String) attributes.get(TrustStore.NAME);
+        return addObjectConfiguration(name, TrustStore.class.getSimpleName(), attributes);
+    }
+
+    public UUID addKeyStoreConfiguration(Map<String, Object> attributes)
+    {
+        String name = (String) attributes.get(KeyStore.NAME);
+        return addObjectConfiguration(name, KeyStore.class.getSimpleName(), attributes);
+    }
+
     private boolean setObjectAttributes(ConfigurationEntry entry, Map<String, Object> attributes)
     {
         Map<String, Object> newAttributes = new HashMap<String, Object>(entry.getAttributes());
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestSSLConstants.java b/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestSSLConstants.java
deleted file mode 100644
index 5664e94bd9..0000000000
--- a/qpid/java/systests/src/main/java/org/apache/qpid/test/utils/TestSSLConstants.java
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements.  See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership.  The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License.  You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-package org.apache.qpid.test.utils;
-
-public interface TestSSLConstants
-{
-    String KEYSTORE = "test-profiles/test_resources/ssl/java_client_keystore.jks";
-    String UNTRUSTED_KEYSTORE = "test-profiles/test_resources/ssl/java_client_untrusted_keystore.jks";
-    String KEYSTORE_PASSWORD = "password";
-    String TRUSTSTORE = "test-profiles/test_resources/ssl/java_client_truststore.jks";
-    String TRUSTSTORE_PASSWORD = "password";
-
-    String BROKER_KEYSTORE = "test-profiles/test_resources/ssl/java_broker_keystore.jks";
-    String BROKER_KEYSTORE_PASSWORD = "password";
-}