"ssl keystore path"       | DaemonJvmOptions.SSL_KEYSTORE_KEY         | "-D${DaemonJvmOptions.SSL_KEYSTORE_KEY}=/keystore/path"
        "ssl keystore password"   | DaemonJvmOptions.SSL_KEYSTOREPASSWORD_KEY | "-D${DaemonJvmOptions.SSL_KEYSTOREPASSWORD_KEY}=secret"

    @Override
    boolean defaultAllowInsecureProtocol() {
        return false
    }

    void beforeServerStart() {
        keyStore = TestKeyStore.init(resources.dir)
        keyStore.enableSslWithServerCert(server)
        keyStore.enableSslWithServerCert(backingServer)
        keyStore.configureServerCert(executer)
    }

    TestKeyStore keyStore

    @Override
    String getProxyScheme() {
        return 'https'
    }

    @Override
    String getRepoServerUrl() {
        "https://localhost:${server.sslPort}/repo"
    }

    @Override
    boolean isTunnel() { true }

    @Override
    void setupServer() {
        keyStore = TestKeyStore.init(resources.dir)

      throws GeneralSecurityException, IOException {
    KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
    try (InputStream in = new FileInputStream(keystoreFile)) {
      keystore.load(in, password.toCharArray());
    }
    KeyManagerFactory keyManagerFactory =
        KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    keyManagerFactory.init(keystore, password.toCharArray());

        then:
        configurationCache.assertStateLoaded()

        where:
        encryptionTransformation | source
        "AES/ECB/PKCS5PADDING"   | EncryptionKind.KEYSTORE
        "AES/CBC/PKCS5PADDING"   | EncryptionKind.KEYSTORE
        "AES/ECB/PKCS5PADDING"   | EncryptionKind.ENV_VAR
        "AES/CBC/PKCS5PADDING"   | EncryptionKind.ENV_VAR
    }

    factory.init(keyStore, password)
    val result = factory.keyManagers!!
    check(result.size == 1 && result[0] is X509KeyManager) {
      "Unexpected key managers:${result.contentToString()}"
    }

    return result[0] as X509KeyManager
  }

  private fun newEmptyKeyStore(keyStoreType: String?): KeyStore {
    return KeyStore.getInstance(keyStoreType ?: KeyStore.getDefaultType()).apply {

    val callbackHandler = ConsoleCallbackHandler

    val builderList: List<KeyStore.Builder> =
      listOf(
        KeyStore.Builder.newInstance("PKCS11", null, KeyStore.CallbackHandlerProtection(callbackHandler)),
        // Example if you want to combine multiple keystore types
        // KeyStore.Builder.newInstance("PKCS12", null, File("keystore.p12"), PasswordProtection("rosebud".toCharArray()))
      )

    @Rule
    TestResources resources = new TestResources(temporaryFolder)
    TestKeyStore keyStore = TestKeyStore.init(resources.dir)
    ResolveFailureTestFixture failedResolve = new ResolveFailureTestFixture(buildFile)

    def "unable to resolve dependencies when server only supports deprecated TLS versions"() {
        given:
        keyStore.enableSslWithServerCert(mavenHttpRepo.server) {
            it.addExcludeProtocols("TLSv1.2", "TLSv1.3")

                final KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
                keyStore.load(null, null);
                keyStore.setCertificateEntry("server", certificate);

                final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init(keyStore);

import org.gradle.test.fixtures.keystore.TestKeyStore
import org.gradle.test.fixtures.server.http.HttpServer
import org.gradle.test.fixtures.server.http.IvyHttpModule
import org.gradle.test.fixtures.server.http.IvyHttpRepository
import org.junit.Rule

class IvyPublishJavaRetriesIntegTest extends AbstractIvyPublishIntegTest {

    TestKeyStore keyStore

    @Rule public final HttpServer server = new HttpServer()