The key manager must be able to get a pin from somewhere. It looks in property, then an environment variable, then a file, and finally in a configuration attribute. At least one must be present. Can we express this ordering and this "at least one" constraint? Perhaps support a "one-of" element which can be used to group a set of properties. The provider accesses key information in a file on the local filesystem. Multiple file formats may be supported, depending on the providers supported by the underlying Java runtime. ds-cfg-file-based-key-manager-provider ds-cfg-key-manager-provider org.opends.server.extensions.FileBasedKeyManagerProvider Should use a file-based property definition? Specifies the path to the file containing the private key information. It may be an absolute path, or a path that is relative to the instance root. Changes to this configuration attribute will take effect the next time that the key manager is accessed. ds-cfg-key-store-file Can we restrict this to an enumeration? How can the client guess which values are possible? What is the default value? Specifies the format for the data in the key store file. Valid values should always include 'JKS' and 'PKCS12', but different implementations may allow other values as well. If no value is provided, then the JVM-default value will be used. Changes to this configuration attribute will take effect the next time that the key manager is accessed. ds-cfg-key-store-type