diff --git a/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java b/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java
--- a/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java
+++ b/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java
@@ -236,7 +236,7 @@ public KeyStore loadStore(VertxInternal vertx) throws Exception {
       Iterable<Buffer> iterable = certValues::iterator;
       for (Buffer certValue : iterable) {
         for (Certificate cert : loadCerts(certValue)) {
-          keyStore.setCertificateEntry("cert-" + count, cert);
+          keyStore.setCertificateEntry("cert-" + count++, cert);
         }
       }
       return keyStore;

diff --git a/src/test/java/io/vertx/test/core/ClusteredEventBusWithSSLTest.java b/src/test/java/io/vertx/test/core/ClusteredEventBusWithSSLTest.java
--- a/src/test/java/io/vertx/test/core/ClusteredEventBusWithSSLTest.java
+++ b/src/test/java/io/vertx/test/core/ClusteredEventBusWithSSLTest.java
@@ -19,6 +19,8 @@
 import io.vertx.core.VertxOptions;
 import io.vertx.core.eventbus.EventBusOptions;
 import io.vertx.core.http.ClientAuth;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.runner.RunWith;
 import org.junit.runners.Parameterized;
 
@@ -38,7 +40,7 @@ public class ClusteredEventBusWithSSLTest extends ClusteredEventBusTestBase {
   private final EventBusOptions options;
 
 
-  public ClusteredEventBusWithSSLTest(TLSCert cert, TLSCert trust,
+  public ClusteredEventBusWithSSLTest(Cert<?> cert, Trust<?> trust,
                                       boolean requireClientAuth,
                                       boolean clientTrustAll,
                                       boolean useCrl,
@@ -53,8 +55,8 @@ public ClusteredEventBusWithSSLTest(TLSCert cert, TLSCert trust,
       options.addCrlPath("tls/root-ca/crl.pem");
     }
 
-    setOptions(options, trust.getClientTrustOptions());
-    setOptions(options, cert.getServerKeyCertOptions());
+    setOptions(options, trust.get());
+    setOptions(options, cert.get());
 
     if (enabledCipherSuites != null) {
       enabledCipherSuites.forEach(options::addEnabledCipherSuite);
@@ -72,13 +74,13 @@ public static Iterable<Object[]> data() {
     //KeyCert, Trust, requireClientAuth, clientTrustAll, useCrl, enabledCipherSuites
 
     return Arrays.asList(new Object[][]{
-        {TLSCert.JKS, TLSCert.NONE, false, true, false, Collections.emptyList()}, // trusts all server certs
-        {TLSCert.JKS, TLSCert.JKS, false, false, true, Collections.emptyList()},
-        {TLSCert.PKCS12, TLSCert.JKS, false, false, false, Collections.emptyList()},
-        {TLSCert.PEM, TLSCert.JKS, false, false, false, Collections.emptyList()},
-        {TLSCert.PKCS12_ROOT_CA, TLSCert.JKS_ROOT_CA, false, false, false, Collections.emptyList()},
-        {TLSCert.PEM_ROOT_CA, TLSCert.PKCS12_ROOT_CA, false, false, false, Collections.emptyList()},
-        {TLSCert.JKS, TLSCert.PEM_ROOT_CA, false, true, false, Arrays.asList(Http1xTest.ENABLED_CIPHER_SUITES)},
+        {Cert.SERVER_JKS, Trust.NONE, false, true, false, Collections.emptyList()}, // trusts all server certs
+        {Cert.SERVER_JKS, Trust.SERVER_JKS, false, false, true, Collections.emptyList()},
+        {Cert.SERVER_PKCS12, Trust.SERVER_JKS, false, false, false, Collections.emptyList()},
+        {Cert.SERVER_PEM, Trust.SERVER_JKS, false, false, false, Collections.emptyList()},
+        {Cert.SERVER_PKCS12_ROOT_CA, Trust.SERVER_JKS_ROOT_CA, false, false, false, Collections.emptyList()},
+        {Cert.SERVER_PEM_ROOT_CA, Trust.SERVER_PKCS12_ROOT_CA, false, false, false, Collections.emptyList()},
+        {Cert.SERVER_JKS, Trust.SERVER_PEM_ROOT_CA, false, true, false, Arrays.asList(Http1xTest.ENABLED_CIPHER_SUITES)},
     });
   }
 
diff --git a/src/test/java/io/vertx/test/core/Http1xTLSTest.java b/src/test/java/io/vertx/test/core/Http1xTLSTest.java
--- a/src/test/java/io/vertx/test/core/Http1xTLSTest.java
+++ b/src/test/java/io/vertx/test/core/Http1xTLSTest.java
@@ -20,6 +20,8 @@
 import io.vertx.core.http.HttpClientOptions;
 import io.vertx.core.http.HttpServer;
 import io.vertx.core.http.HttpServerOptions;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Test;
 
 /**
@@ -43,6 +45,6 @@ HttpClient createHttpClient(HttpClientOptions options) {
   @Test
   // Client and server uses ALPN
   public void testAlpn() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).serverUsesAlpn().clientUsesAlpn().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).serverUsesAlpn().clientUsesAlpn().pass();
   }
 }
diff --git a/src/test/java/io/vertx/test/core/Http2ClientTest.java b/src/test/java/io/vertx/test/core/Http2ClientTest.java
--- a/src/test/java/io/vertx/test/core/Http2ClientTest.java
+++ b/src/test/java/io/vertx/test/core/Http2ClientTest.java
@@ -65,6 +65,8 @@
 import io.vertx.core.net.NetSocket;
 import io.vertx.core.net.SocketAddress;
 import io.vertx.core.net.impl.SSLHelper;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Test;
 
 import java.io.ByteArrayOutputStream;
@@ -108,7 +110,7 @@ public void setUp() throws Exception {
     super.setUp();
     clientOptions = new HttpClientOptions().
         setUseAlpn(true).
-        setTrustStoreOptions((JksOptions) TLSCert.JKS.getClientTrustOptions()).
+        setTrustStoreOptions(Trust.SERVER_JKS.get()).
         setProtocolVersion(HttpVersion.HTTP_2);
     client = vertx.createHttpClient(clientOptions);
   }
@@ -1068,7 +1070,7 @@ private ServerBootstrap createH2Server(BiFunction<Http2ConnectionDecoder, Http2C
     bootstrap.childHandler(new ChannelInitializer<Channel>() {
       @Override
       protected void initChannel(Channel ch) throws Exception {
-        SSLHelper sslHelper = new SSLHelper(serverOptions, TLSCert.JKS.getServerKeyCertOptions(), null);
+        SSLHelper sslHelper = new SSLHelper(serverOptions, Cert.SERVER_JKS.get(), null);
         SslHandler sslHandler = sslHelper.setApplicationProtocols(Arrays.asList(HttpVersion.HTTP_2, HttpVersion.HTTP_1_1)).createSslHandler((VertxInternal) vertx, DEFAULT_HTTPS_HOST, DEFAULT_HTTPS_PORT);
         ch.pipeline().addLast(sslHandler);
         ch.pipeline().addLast(new ApplicationProtocolNegotiationHandler("whatever") {
diff --git a/src/test/java/io/vertx/test/core/Http2ServerTest.java b/src/test/java/io/vertx/test/core/Http2ServerTest.java
--- a/src/test/java/io/vertx/test/core/Http2ServerTest.java
+++ b/src/test/java/io/vertx/test/core/Http2ServerTest.java
@@ -70,6 +70,7 @@
 import io.vertx.core.net.impl.SSLHelper;
 import io.vertx.core.streams.ReadStream;
 import io.vertx.core.streams.WriteStream;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Test;
 
 import java.io.ByteArrayInputStream;
@@ -214,7 +215,7 @@ protected ChannelInitializer channelInitializer(int port, String host, Consumer<
       return new ChannelInitializer<Channel>() {
         @Override
         protected void initChannel(Channel ch) throws Exception {
-          SSLHelper sslHelper = new SSLHelper(new HttpClientOptions().setUseAlpn(true), null, TLSCert.JKS.getClientTrustOptions());
+          SSLHelper sslHelper = new SSLHelper(new HttpClientOptions().setUseAlpn(true), null, Trust.SERVER_JKS.get());
           SslHandler sslHandler = sslHelper.setApplicationProtocols(Arrays.asList(HttpVersion.HTTP_2, HttpVersion.HTTP_1_1)).createSslHandler((VertxInternal) vertx, host, port);
           ch.pipeline().addLast(sslHandler);
           ch.pipeline().addLast(new ApplicationProtocolNegotiationHandler("whatever") {
diff --git a/src/test/java/io/vertx/test/core/Http2TLSTest.java b/src/test/java/io/vertx/test/core/Http2TLSTest.java
--- a/src/test/java/io/vertx/test/core/Http2TLSTest.java
+++ b/src/test/java/io/vertx/test/core/Http2TLSTest.java
@@ -21,6 +21,10 @@
 import io.vertx.core.http.HttpServer;
 import io.vertx.core.http.HttpServerOptions;
 import io.vertx.core.http.HttpVersion;
+import io.vertx.core.net.KeyCertOptions;
+import io.vertx.core.net.TrustOptions;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 
 /**
  * @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
@@ -38,7 +42,7 @@ HttpClient createHttpClient(HttpClientOptions options) {
   }
 
   @Override
-  protected TLSTest testTLS(TLSCert clientCert, TLSCert clientTrust, TLSCert serverCert, TLSCert serverTrust) throws Exception {
+  protected TLSTest testTLS(Cert<?> clientCert, Trust<?> clientTrust, Cert<?> serverCert, Trust<?> serverTrust) throws Exception {
     return super.testTLS(clientCert, clientTrust, serverCert, serverTrust).version(HttpVersion.HTTP_2);
   }
 }
diff --git a/src/test/java/io/vertx/test/core/Http2Test.java b/src/test/java/io/vertx/test/core/Http2Test.java
--- a/src/test/java/io/vertx/test/core/Http2Test.java
+++ b/src/test/java/io/vertx/test/core/Http2Test.java
@@ -25,6 +25,7 @@
 import io.vertx.core.http.StreamResetException;
 import io.vertx.core.net.OpenSSLEngineOptions;
 import io.vertx.core.net.PemKeyCertOptions;
+import io.vertx.test.core.tls.Cert;
 import org.junit.Test;
 
 import java.util.concurrent.CompletableFuture;
@@ -130,7 +131,7 @@ public void testServerOpenSSL() throws Exception {
         .setUseAlpn(true)
         .setSsl(true)
         .addEnabledCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA") // Non Diffie-helman -> debuggable in wireshark
-        .setPemKeyCertOptions((PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions()).setSslEngineOptions(new OpenSSLEngineOptions());
+        .setPemKeyCertOptions(Cert.SERVER_PEM.get()).setSslEngineOptions(new OpenSSLEngineOptions());
     server.close();
     client.close();
     client = vertx.createHttpClient(createBaseClientOptions());
diff --git a/src/test/java/io/vertx/test/core/Http2TestBase.java b/src/test/java/io/vertx/test/core/Http2TestBase.java
--- a/src/test/java/io/vertx/test/core/Http2TestBase.java
+++ b/src/test/java/io/vertx/test/core/Http2TestBase.java
@@ -22,6 +22,8 @@
 import io.vertx.core.http.HttpServerOptions;
 import io.vertx.core.http.HttpVersion;
 import io.vertx.core.net.JksOptions;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 
 /**
  * @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
@@ -35,13 +37,13 @@ static HttpServerOptions createHttp2ServerOptions(int port, String host) {
         .setUseAlpn(true)
         .setSsl(true)
         .addEnabledCipherSuite("TLS_RSA_WITH_AES_128_CBC_SHA") // Non Diffie-helman -> debuggable in wireshark
-        .setKeyStoreOptions((JksOptions) TLSCert.JKS.getServerKeyCertOptions());
+        .setKeyStoreOptions(Cert.SERVER_JKS.get());
   };
 
   static HttpClientOptions createHttp2ClientOptions() {
     return new HttpClientOptions().
         setUseAlpn(true).
-        setTrustStoreOptions((JksOptions) TLSCert.JKS.getClientTrustOptions()).
+        setTrustStoreOptions(Trust.SERVER_JKS.get()).
         setProtocolVersion(HttpVersion.HTTP_2);
   }
 
diff --git a/src/test/java/io/vertx/test/core/HttpTLSTest.java b/src/test/java/io/vertx/test/core/HttpTLSTest.java
--- a/src/test/java/io/vertx/test/core/HttpTLSTest.java
+++ b/src/test/java/io/vertx/test/core/HttpTLSTest.java
@@ -19,6 +19,8 @@
 import io.vertx.core.VertxException;
 import io.vertx.core.http.*;
 import io.vertx.core.net.*;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
@@ -51,229 +53,241 @@ protected void tearDown() throws Exception {
   @Test
   // Client trusts all server certs
   public void testTLSClientTrustAll() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().pass();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().pass();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCertPKCS12() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.PKCS12, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_PKCS12, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCertPEM() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.PEM, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_PEM, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertJKSRootCAWithJKSRootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS_ROOT_CA, TLSCert.JKS_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS_ROOT_CA, Cert.SERVER_JKS_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertJKSRootCAWithPKCS12RootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PKCS12_ROOT_CA, TLSCert.JKS_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PKCS12_ROOT_CA, Cert.SERVER_JKS_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertJKSRootRootCAWithPEMRootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.JKS_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_JKS_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertPKCS12RootCAWithJKSRootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS_ROOT_CA, TLSCert.PKCS12_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS_ROOT_CA, Cert.SERVER_PKCS12_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertPKCS12RootCAWithPKCS12RootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PKCS12_ROOT_CA, TLSCert.PKCS12_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PKCS12_ROOT_CA, Cert.SERVER_PKCS12_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertPKCS12RootCAWithPEMRootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PKCS12_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PKCS12_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertPEMRootCAWithJKSRootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS_ROOT_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertPEMRootCAWithPKCS12RootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PKCS12_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PKCS12_ROOT_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts via a root CA (not trust all)
   public void testTLSClientTrustServerCertPEMRootCAWithPEMRootCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE).pass();
+  }
+
+  // These two tests should be grouped in same method - todo later
+  @Test
+  // Server specifies cert that the client trusts via a root CA that is in a multi pem store (not trust all)
+  public void testTLSClientTrustServerCertMultiPemWithPEMRootCA() throws Exception {
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA_AND_OTHER_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE).pass();
+  }
+  @Test
+  // Server specifies cert that the client trusts via a other CA that is in a multi pem store (not trust all)
+  public void testTLSClientTrustServerCertMultiPemWithPEMOtherCA() throws Exception {
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA_AND_OTHER_CA, Cert.SERVER_PEM_OTHER_CA, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert chain that the client trusts via a CA (not trust all)
   public void testTLSClientTrustServerCertPEMRootCAWithPEMCAChain() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_CA_CHAIN, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PEM_CA_CHAIN, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies intermediate cert that the client doesn't trust because it is missing the intermediate CA signed by the root CA
   public void testTLSClientUntrustedServerCertPEMRootCAWithPEMCA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_CA, TLSCert.NONE).fail();
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PEM_INT_CA, Trust.NONE).fail();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustPKCS12ServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PKCS12, TLSCert.JKS, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PKCS12, Cert.SERVER_JKS, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustPEMServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM, TLSCert.JKS, TLSCert.NONE).pass();
+    testTLS(Cert.NONE, Trust.SERVER_PEM, Cert.SERVER_JKS, Trust.NONE).pass();
   }
 
   @Test
   // Server specifies cert that the client doesn't trust
   public void testTLSClientUntrustedServer() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).fail();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).fail();
   }
 
   @Test
   // Server specifies cert that the client doesn't trust
   public void testTLSClientUntrustedServerPEM() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.PEM, TLSCert.NONE).fail();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_PEM, Trust.NONE).fail();
   }
 
   @Test
   // Client specifies cert even though it's not required
   public void testTLSClientCertNotRequired() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).pass();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).pass();
   }
 
   @Test
   // Client specifies cert even though it's not required
   public void testTLSClientCertNotRequiredPEM() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.PEM, TLSCert.JKS).pass();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_PEM, Trust.CLIENT_JKS).pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertRequired() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertRequiredPKCS12() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.PKCS12).requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PKCS12).requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertRequiredPEM() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.PEM).requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PEM).requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertPKCS12Required() throws Exception {
-    testTLS(TLSCert.PKCS12, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_PKCS12, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertPEMRequired() throws Exception {
-    testTLS(TLSCert.PEM, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_PEM, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert by CA and it is required
   public void testTLSClientCertPEM_CARequired() throws Exception {
-    testTLS(TLSCert.PEM_ROOT_CA, TLSCert.JKS, TLSCert.JKS, TLSCert.PEM_ROOT_CA).requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_PEM_ROOT_CA, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PEM_ROOT_CA).requiresClientAuth().pass();
   }
 
   @Test
   // Client doesn't specify cert but it's required
   public void testTLSClientCertRequiredNoClientCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).requiresClientAuth().fail();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).requiresClientAuth().fail();
   }
 
   @Test
   // Client specifies cert but it's not trusted
   public void testTLSClientCertClientNotTrusted() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).requiresClientAuth().fail();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).requiresClientAuth().fail();
   }
 
   @Test
   // Server specifies cert that the client does not trust via a revoked certificate of the CA
   public void testTLSClientRevokedServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE).clientUsesCrl().fail();
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE).clientUsesCrl().fail();
   }
 
   @Test
   // Client specifies cert that the server does not trust via a revoked certificate of the CA
   public void testTLSRevokedClientCertServer() throws Exception {
-    testTLS(TLSCert.PEM_ROOT_CA, TLSCert.JKS, TLSCert.JKS, TLSCert.PEM_ROOT_CA).requiresClientAuth().clientUsesCrl().fail();
+    testTLS(Cert.CLIENT_PEM_ROOT_CA, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PEM_ROOT_CA).requiresClientAuth().clientUsesCrl().fail();
   }
 
   @Test
   // Specify some matching cipher suites
   public void testTLSMatchingCipherSuites() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().serverEnabledCipherSuites(ENABLED_CIPHER_SUITES).pass();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().serverEnabledCipherSuites(ENABLED_CIPHER_SUITES).pass();
   }
 
   @Test
   // Specify some non matching cipher suites
   public void testTLSNonMatchingCipherSuites() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().serverEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}).clientEnabledCipherSuites(new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}).fail();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().serverEnabledCipherSuites(new String[]{"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"}).clientEnabledCipherSuites(new String[]{"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"}).fail();
   }
 
   @Test
   // Specify some matching TLS protocols
   public void testTLSMatchingProtocolVersions() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().serverEnabledSecureTransportProtocol(new String[]{"SSLv2Hello", "TLSv1", "TLSv1.1", "TLSv1.2"}).pass();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().serverEnabledSecureTransportProtocol(new String[]{"SSLv2Hello", "TLSv1", "TLSv1.1", "TLSv1.2"}).pass();
   }
 
   @Test
   // Specify some matching TLS protocols
   public void testTLSInvalidProtocolVersion() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().serverEnabledSecureTransportProtocol(new String[]{"HelloWorld"}).fail();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().serverEnabledSecureTransportProtocol(new String[]{"HelloWorld"}).fail();
   }
 
   @Test
   // Specify some non matching TLS protocols
   public void testTLSNonMatchingProtocolVersions() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().serverEnabledSecureTransportProtocol(new String[]{"TLSv1.2"}).clientEnabledSecureTransportProtocol(new String[]{"SSLv2Hello"}).fail();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().serverEnabledSecureTransportProtocol(new String[]{"TLSv1.2"}).clientEnabledSecureTransportProtocol(new String[]{"SSLv2Hello"}).fail();
   }
 
   @Test
   // Test host verification with a CN matching localhost
   public void testTLSVerifyMatchingHost() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE).clientTrustAll().clientVerifyHost().pass();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE).clientTrustAll().clientVerifyHost().pass();
   }
 
   @Test
   // Test host verification with a CN NOT matching localhost
   public void testTLSVerifyNonMatchingHost() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.MIM, TLSCert.NONE).clientTrustAll().clientVerifyHost().fail();
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_MIM, Trust.NONE).clientTrustAll().clientVerifyHost().fail();
   }
 
   // OpenSSL tests
@@ -281,64 +295,64 @@ public void testTLSVerifyNonMatchingHost() throws Exception {
   @Test
   // Server uses OpenSSL with JKS
   public void testTLSClientTrustServerCertJKSOpenSSL() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).serverOpenSSL().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).serverOpenSSL().pass();
   }
 
   @Test
   // Server uses OpenSSL with PKCS12
   public void testTLSClientTrustServerCertPKCS12OpenSSL() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.PKCS12, TLSCert.NONE).serverOpenSSL().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_PKCS12, Trust.NONE).serverOpenSSL().pass();
   }
 
   @Test
   // Server uses OpenSSL with PEM
   public void testTLSClientTrustServerCertPEMOpenSSL() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.PEM, TLSCert.NONE).serverOpenSSL().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_PEM, Trust.NONE).serverOpenSSL().pass();
   }
 
   @Test
   // Client trusts OpenSSL with PEM
   public void testTLSClientTrustServerCertWithJKSOpenSSL() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).clientOpenSSL().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).clientOpenSSL().pass();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCertWithPKCS12OpenSSL() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PKCS12, TLSCert.JKS, TLSCert.NONE).clientOpenSSL().pass();
+    testTLS(Cert.NONE, Trust.SERVER_PKCS12, Cert.SERVER_JKS, Trust.NONE).clientOpenSSL().pass();
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCertWithPEMOpenSSL() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM, TLSCert.JKS, TLSCert.NONE).clientOpenSSL().pass();
+    testTLS(Cert.NONE, Trust.SERVER_PEM, Cert.SERVER_JKS, Trust.NONE).clientOpenSSL().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertRequiredOpenSSL() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).clientOpenSSL().requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).clientOpenSSL().requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertPKCS12RequiredOpenSSL() throws Exception {
-    testTLS(TLSCert.PKCS12, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).clientOpenSSL().requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_PKCS12, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).clientOpenSSL().requiresClientAuth().pass();
   }
 
   @Test
   // Client specifies cert and it is required
   public void testTLSClientCertPEMRequiredOpenSSL() throws Exception {
-    testTLS(TLSCert.PEM, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS).clientOpenSSL().requiresClientAuth().pass();
+    testTLS(Cert.CLIENT_PEM, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS).clientOpenSSL().requiresClientAuth().pass();
   }
 
   class TLSTest {
 
     HttpVersion version;
-    TLSCert clientCert;
-    TLSCert clientTrust;
-    TLSCert serverCert;
-    TLSCert serverTrust;
+    KeyCertOptions clientCert;
+    TrustOptions clientTrust;
+    KeyCertOptions serverCert;
+    TrustOptions serverTrust;
     boolean clientTrustAll;
     boolean clientUsesCrl;
     boolean clientUsesAlpn;
@@ -358,12 +372,12 @@ class TLSTest {
     private String connectHostname;
 
 
-    public TLSTest(TLSCert clientCert, TLSCert clientTrust, TLSCert serverCert, TLSCert serverTrust) {
+    public TLSTest(Cert<?> clientCert, Trust<?> clientTrust, Cert<?> serverCert, Trust<?> serverTrust) {
       this.version = HttpVersion.HTTP_1_1;
-      this.clientCert = clientCert;
-      this.clientTrust = clientTrust;
-      this.serverCert = serverCert;
-      this.serverTrust = serverTrust;
+      this.clientCert = clientCert.get();
+      this.clientTrust = clientTrust.get();
+      this.serverCert = serverCert.get();
+      this.serverTrust = serverTrust.get();
     }
 
     TLSTest version(HttpVersion version) {
@@ -487,8 +501,8 @@ void run(boolean shouldPass) {
         options.setUseAlpn(true);
       }
       options.setVerifyHost(clientVerifyHost);
-      setOptions(options, clientTrust.getClientTrustOptions());
-      setOptions(options, clientCert.getClientKeyCertOptions());
+      setOptions(options, clientTrust);
+      setOptions(options, clientCert);
       for (String suite: clientEnabledCipherSuites) {
         options.addEnabledCipherSuite(suite);
       }
@@ -511,8 +525,8 @@ void run(boolean shouldPass) {
       client = createHttpClient(options);
       HttpServerOptions serverOptions = new HttpServerOptions();
       serverOptions.setSsl(true);
-      setOptions(serverOptions, serverTrust.getServerTrustOptions());
-      setOptions(serverOptions, serverCert.getServerKeyCertOptions());
+      setOptions(serverOptions, serverTrust);
+      setOptions(serverOptions, serverCert);
       if (requiresClientAuth) {
         serverOptions.setClientAuth(ClientAuth.REQUIRED);
       }
@@ -573,61 +587,61 @@ void run(boolean shouldPass) {
 
   abstract HttpClient createHttpClient(HttpClientOptions options);
 
-  protected TLSTest testTLS(TLSCert clientCert, TLSCert clientTrust,
-                          TLSCert serverCert, TLSCert serverTrust) throws Exception {
+  protected TLSTest testTLS(Cert<?> clientCert, Trust<?> clientTrust,
+                          Cert<?> serverCert, Trust<?> serverTrust) throws Exception {
     return new TLSTest(clientCert, clientTrust, serverCert, serverTrust);
   }
 
   @Test
   public void testJKSInvalidPath() {
-    testInvalidKeyStore(((JksOptions) TLSCert.JKS.getServerKeyCertOptions()).setPath("/invalid.jks"), "java.nio.file.NoSuchFileException: ", "invalid.jks");
+    testInvalidKeyStore(Cert.SERVER_JKS.get().setPath("/invalid.jks"), "java.nio.file.NoSuchFileException: ", "invalid.jks");
   }
 
   @Test
   public void testJKSMissingPassword() {
-    testInvalidKeyStore(((JksOptions) TLSCert.JKS.getServerKeyCertOptions()).setPassword(null), "Password must not be null", null);
+    testInvalidKeyStore(Cert.SERVER_JKS.get().setPassword(null), "Password must not be null", null);
   }
 
   @Test
   public void testJKSInvalidPassword() {
-    testInvalidKeyStore(((JksOptions) TLSCert.JKS.getServerKeyCertOptions()).setPassword("wrongpassword"), "Keystore was tampered with, or password was incorrect", null);
+    testInvalidKeyStore(Cert.SERVER_JKS.get().setPassword("wrongpassword"), "Keystore was tampered with, or password was incorrect", null);
   }
 
   @Test
   public void testPKCS12InvalidPath() {
-    testInvalidKeyStore(((PfxOptions) TLSCert.PKCS12.getServerKeyCertOptions()).setPath("/invalid.p12"), "java.nio.file.NoSuchFileException: ", "invalid.p12");
+    testInvalidKeyStore(Cert.SERVER_PKCS12.get().setPath("/invalid.p12"), "java.nio.file.NoSuchFileException: ", "invalid.p12");
   }
 
   @Test
   public void testPKCS12MissingPassword() {
-    testInvalidKeyStore(((PfxOptions) TLSCert.PKCS12.getServerKeyCertOptions()).setPassword(null), "Get Key failed: null", null);
+    testInvalidKeyStore(Cert.SERVER_PKCS12.get().setPassword(null), "Get Key failed: null", null);
   }
 
   @Test
   public void testPKCS12InvalidPassword() {
-    testInvalidKeyStore(((PfxOptions) TLSCert.PKCS12.getServerKeyCertOptions()).setPassword("wrongpassword"), Arrays.asList(
+    testInvalidKeyStore(Cert.SERVER_PKCS12.get().setPassword("wrongpassword"), Arrays.asList(
         "failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded",
         "keystore password was incorrect"), null);
   }
 
   @Test
   public void testKeyCertMissingKeyPath() {
-    testInvalidKeyStore(((PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions()).setKeyPath(null), "Missing private key", null);
+    testInvalidKeyStore(Cert.SERVER_PEM.get().setKeyPath(null), "Missing private key", null);
   }
 
   @Test
   public void testKeyCertInvalidKeyPath() {
-    testInvalidKeyStore(((PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions()).setKeyPath("/invalid.pem"), "java.nio.file.NoSuchFileException: ", "invalid.pem");
+    testInvalidKeyStore(Cert.SERVER_PEM.get().setKeyPath("/invalid.pem"), "java.nio.file.NoSuchFileException: ", "invalid.pem");
   }
 
   @Test
   public void testKeyCertMissingCertPath() {
-    testInvalidKeyStore(((PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions()).setCertPath(null), "Missing X.509 certificate", null);
+    testInvalidKeyStore(Cert.SERVER_PEM.get().setCertPath(null), "Missing X.509 certificate", null);
   }
 
   @Test
   public void testKeyCertInvalidCertPath() {
-    testInvalidKeyStore(((PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions()).setCertPath("/invalid.pem"), "java.nio.file.NoSuchFileException: ", "invalid.pem");
+    testInvalidKeyStore(Cert.SERVER_PEM.get().setCertPath("/invalid.pem"), "java.nio.file.NoSuchFileException: ", "invalid.pem");
   }
 
   @Test
@@ -648,7 +662,7 @@ public void testKeyCertInvalidPem() throws IOException {
       Path file = testFolder.newFile("vertx" + UUID.randomUUID().toString() + ".pem").toPath();
       Files.write(file, Collections.singleton(contents[i]));
       String expectedMessage = messages[i];
-      testInvalidKeyStore(((PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions()).setKeyPath(file.toString()), expectedMessage, null);
+      testInvalidKeyStore(Cert.SERVER_PEM.get().setKeyPath(file.toString()), expectedMessage, null);
     }
   }
 
@@ -737,7 +751,7 @@ private void testStore(HttpServerOptions serverOptions, List<String> expectedPos
   @Test
   public void testCrlInvalidPath() throws Exception {
     HttpClientOptions clientOptions = new HttpClientOptions();
-    setOptions(clientOptions, TLSCert.PEM_ROOT_CA.getClientTrustOptions());
+    setOptions(clientOptions, Trust.SERVER_PEM_ROOT_CA.get());
     clientOptions.setSsl(true);
     clientOptions.addCrlPath("/invalid.pem");
     HttpClient client = vertx.createHttpClient(clientOptions);
@@ -755,7 +769,7 @@ public void testCrlInvalidPath() throws Exception {
   // Access https server via connect proxy
   public void testHttpsProxy() throws Exception {
     startProxy(null, ProxyType.HTTP);
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy().pass();
     assertNotNull("connection didn't access the proxy", proxy.getLastUri());
     assertEquals("hostname resolved but it shouldn't be", "localhost:4043", proxy.getLastUri());
     assertEquals("Host header doesn't contain target host", "localhost:4043", proxy.getLastRequestHeaders().get("Host"));
@@ -765,14 +779,14 @@ public void testHttpsProxy() throws Exception {
   // Check that proxy auth fails if it is missing
   public void testHttpsProxyAuthFail() throws Exception {
     startProxy("username", ProxyType.HTTP);
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy().useProxyAuth().fail();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy().useProxyAuth().fail();
   }
 
   @Test
   // Access https server via connect proxy with proxy auth required
   public void testHttpsProxyAuth() throws Exception {
     startProxy("username", ProxyType.HTTP);
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy().useProxyAuth().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy().useProxyAuth().pass();
     assertNotNull("connection didn't access the proxy", proxy.getLastUri());
     assertEquals("hostname resolved but it shouldn't be", "localhost:4043", proxy.getLastUri());
     assertEquals("Host header doesn't contain target host", "localhost:4043", proxy.getLastRequestHeaders().get("Host"));
@@ -785,7 +799,7 @@ public void testHttpsProxyAuth() throws Exception {
   public void testHttpsProxyUnknownHost() throws Exception {
     startProxy(null, ProxyType.HTTP);
     proxy.setForceUri("localhost:4043");
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy()
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy()
         .connectHostname("doesnt-resolve.host-name").clientTrustAll().clientVerifyHost(false).pass();
     assertNotNull("connection didn't access the proxy", proxy.getLastUri());
     assertEquals("hostname resolved but it shouldn't be", "doesnt-resolve.host-name:4043", proxy.getLastUri());
@@ -796,7 +810,7 @@ public void testHttpsProxyUnknownHost() throws Exception {
   // Access https server via socks5 proxy
   public void testHttpsSocks() throws Exception {
     startProxy(null, ProxyType.SOCKS5);
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy().useSocksProxy().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy().useSocksProxy().pass();
     assertNotNull("connection didn't access the proxy", proxy.getLastUri());
     assertEquals("hostname resolved but it shouldn't be", "localhost:4043", proxy.getLastUri());
   }
@@ -805,7 +819,7 @@ public void testHttpsSocks() throws Exception {
   // Access https server via socks5 proxy with authentication
   public void testHttpsSocksAuth() throws Exception {
     startProxy("username", ProxyType.SOCKS5);
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy().useSocksProxy().useProxyAuth().pass();
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy().useSocksProxy().useProxyAuth().pass();
     assertNotNull("connection didn't access the proxy", proxy.getLastUri());
     assertEquals("hostname resolved but it shouldn't be", "localhost:4043", proxy.getLastUri());
   }
@@ -817,7 +831,7 @@ public void testHttpsSocksAuth() throws Exception {
   public void testSocksProxyUnknownHost() throws Exception {
     startProxy(null, ProxyType.SOCKS5);
     proxy.setForceUri("localhost:4043");
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE).useProxy().useSocksProxy()
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE).useProxy().useSocksProxy()
         .connectHostname("doesnt-resolve.host-name").clientTrustAll().clientVerifyHost(false).pass();
     assertNotNull("connection didn't access the proxy", proxy.getLastUri());
     assertEquals("hostname resolved but it shouldn't be", "doesnt-resolve.host-name:4043", proxy.getLastUri());
diff --git a/src/test/java/io/vertx/test/core/KeyStoreTest.java b/src/test/java/io/vertx/test/core/KeyStoreTest.java
--- a/src/test/java/io/vertx/test/core/KeyStoreTest.java
+++ b/src/test/java/io/vertx/test/core/KeyStoreTest.java
@@ -26,6 +26,8 @@
 import io.vertx.core.net.PfxOptions;
 import io.vertx.core.net.TrustOptions;
 import io.vertx.core.net.impl.KeyStoreHelper;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Test;
 
 import javax.net.ssl.KeyManager;
@@ -281,12 +283,12 @@ public void testCopyTrustOptions() throws Exception {
 
   @Test
   public void testJKSPath() throws Exception {
-    testKeyStore(TLSCert.JKS.getServerKeyCertOptions());
+    testKeyStore(Cert.SERVER_JKS.get());
   }
 
   @Test
   public void testJKSValue() throws Exception {
-    JksOptions options = (JksOptions) TLSCert.JKS.getServerKeyCertOptions();
+    JksOptions options = Cert.SERVER_JKS.get();
     Buffer store = vertx.fileSystem().readFileBlocking(options.getPath());
     options.setPath(null).setValue(store);
     testKeyStore(options);
@@ -294,12 +296,12 @@ public void testJKSValue() throws Exception {
 
   @Test
   public void testPKCS12Path() throws Exception {
-    testKeyStore(TLSCert.PKCS12.getServerKeyCertOptions());
+    testKeyStore(Cert.SERVER_PKCS12.get());
   }
 
   @Test
   public void testPKCS12Value() throws Exception {
-    PfxOptions options = (PfxOptions) TLSCert.PKCS12.getServerKeyCertOptions();
+    PfxOptions options = Cert.SERVER_PKCS12.get();
     Buffer store = vertx.fileSystem().readFileBlocking(options.getPath());
     options.setPath(null).setValue(store);
     testKeyStore(options);
@@ -307,12 +309,12 @@ public void testPKCS12Value() throws Exception {
 
   @Test
   public void testKeyCertPath() throws Exception {
-    testKeyStore(TLSCert.PEM.getServerKeyCertOptions());
+    testKeyStore(Cert.SERVER_PEM.get());
   }
 
   @Test
   public void testKeyCertValue() throws Exception {
-    PemKeyCertOptions options = (PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions();
+    PemKeyCertOptions options = Cert.SERVER_PEM.get();
     Buffer key = vertx.fileSystem().readFileBlocking(options.getKeyPath());
     options.setKeyValue(null).setKeyValue(key);
     Buffer cert = vertx.fileSystem().readFileBlocking(options.getCertPath());
@@ -322,12 +324,12 @@ public void testKeyCertValue() throws Exception {
 
   @Test
   public void testCaPath() throws Exception {
-    testTrustStore(TLSCert.PEM.getServerTrustOptions());
+    testTrustStore(Trust.SERVER_PEM.get());
   }
 
   @Test
   public void testCaPathValue() throws Exception {
-    PemTrustOptions options = (PemTrustOptions) TLSCert.PEM.getServerTrustOptions();
+    PemTrustOptions options = Trust.SERVER_PEM.get();
     options.getCertPaths().
         stream().
         map(vertx.fileSystem()::readFileBlocking).
@@ -338,13 +340,13 @@ public void testCaPathValue() throws Exception {
 
   @Test
   public void testKeyOptionsEquality() {
-    JksOptions jksOptions = (JksOptions) TLSCert.JKS.getServerKeyCertOptions();
+    JksOptions jksOptions = Cert.SERVER_JKS.get();
     JksOptions jksOptionsCopy = new JksOptions(jksOptions);
 
-    PfxOptions pfxOptions = (PfxOptions) TLSCert.PKCS12.getServerKeyCertOptions();
+    PfxOptions pfxOptions = Cert.SERVER_PKCS12.get();
     PfxOptions pfxOptionsCopy = new PfxOptions(pfxOptions);
 
-    PemKeyCertOptions pemKeyCertOptions = (PemKeyCertOptions) TLSCert.PEM.getServerKeyCertOptions();
+    PemKeyCertOptions pemKeyCertOptions = Cert.SERVER_PEM.get();
     PemKeyCertOptions pemKeyCertOptionsCopy = new PemKeyCertOptions(pemKeyCertOptions);
 
     assertEquals(jksOptions, jksOptionsCopy);
diff --git a/src/test/java/io/vertx/test/core/NetTest.java b/src/test/java/io/vertx/test/core/NetTest.java
--- a/src/test/java/io/vertx/test/core/NetTest.java
+++ b/src/test/java/io/vertx/test/core/NetTest.java
@@ -29,6 +29,8 @@
 import io.vertx.core.logging.LoggerFactory;
 import io.vertx.core.net.*;
 import io.vertx.core.net.impl.SocketAddressImpl;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import io.vertx.test.netty.TestLoggerFactory;
 import org.junit.Assume;
 import org.junit.Rule;
@@ -2358,14 +2360,14 @@ public void testConnectSSLWithSocks5Proxy() {
         .setPort(1234)
         .setHost("localhost")
         .setSsl(true)
-        .setKeyCertOptions(TLSCert.JKS_ROOT_CA.getServerKeyCertOptions());
+        .setKeyCertOptions(Cert.SERVER_JKS_ROOT_CA.get());
     NetServer server = vertx.createNetServer(options);
 
     NetClientOptions clientOptions = new NetClientOptions()
         .setHostnameVerificationAlgorithm("HTTPS")
         .setSsl(true)
         .setProxyOptions(new ProxyOptions().setType(ProxyType.SOCKS5).setHost("127.0.0.1").setPort(11080))
-        .setTrustOptions(TLSCert.JKS_ROOT_CA.getClientTrustOptions());
+        .setTrustOptions(Trust.SERVER_JKS_ROOT_CA.get());
     NetClient client = vertx.createNetClient(clientOptions);
     server.connectHandler(sock -> {
 
@@ -2394,13 +2396,13 @@ public void testUpgradeSSLWithSocks5Proxy() {
         .setPort(1234)
         .setHost("localhost")
         .setSsl(true)
-        .setKeyCertOptions(TLSCert.JKS_ROOT_CA.getServerKeyCertOptions());
+        .setKeyCertOptions(Cert.SERVER_JKS_ROOT_CA.get());
     NetServer server = vertx.createNetServer(options);
 
     NetClientOptions clientOptions = new NetClientOptions()
         .setHostnameVerificationAlgorithm("HTTPS")
         .setProxyOptions(new ProxyOptions().setType(ProxyType.SOCKS5).setHost("127.0.0.1").setPort(11080))
-        .setTrustOptions(TLSCert.JKS_ROOT_CA.getClientTrustOptions());
+        .setTrustOptions(Trust.SERVER_JKS_ROOT_CA.get());
     NetClient client = vertx.createNetClient(clientOptions);
     server.connectHandler(sock -> {
 
@@ -2548,12 +2550,12 @@ public void testWithSocks4LocalResolver() {
   public void testTLSHostnameCertCheckCorrect() {
     server.close();
     server = vertx.createNetServer(new NetServerOptions().setSsl(true).setPort(4043)
-        .setKeyCertOptions(TLSCert.JKS_ROOT_CA.getServerKeyCertOptions()));
+        .setKeyCertOptions(Cert.SERVER_JKS_ROOT_CA.get()));
     server.connectHandler(netSocket -> netSocket.close()).listen(ar -> {
 
       NetClientOptions options = new NetClientOptions()
           .setHostnameVerificationAlgorithm("HTTPS")
-          .setTrustOptions(TLSCert.JKS_ROOT_CA.getClientTrustOptions());
+          .setTrustOptions(Trust.SERVER_JKS_ROOT_CA.get());
 
       NetClient client = vertx.createNetClient(options);
 
@@ -2579,12 +2581,12 @@ public void testTLSHostnameCertCheckCorrect() {
   public void testTLSHostnameCertCheckIncorrect() {
     server.close();
     server = vertx.createNetServer(new NetServerOptions().setSsl(true).setPort(4043)
-        .setKeyCertOptions(TLSCert.JKS_ROOT_CA.getServerKeyCertOptions()));
+        .setKeyCertOptions(Cert.SERVER_JKS_ROOT_CA.get()));
     server.connectHandler(netSocket -> netSocket.close()).listen(ar -> {
 
       NetClientOptions options = new NetClientOptions()
           .setHostnameVerificationAlgorithm("HTTPS")
-          .setTrustOptions(TLSCert.JKS_ROOT_CA.getClientTrustOptions());
+          .setTrustOptions(Trust.SERVER_JKS_ROOT_CA.get());
 
       NetClient client = vertx.createNetClient(options);
 
diff --git a/src/test/java/io/vertx/test/core/SSLHelperTest.java b/src/test/java/io/vertx/test/core/SSLHelperTest.java
--- a/src/test/java/io/vertx/test/core/SSLHelperTest.java
+++ b/src/test/java/io/vertx/test/core/SSLHelperTest.java
@@ -25,13 +25,13 @@
 import io.vertx.core.http.HttpServerOptionsConverter;
 import io.vertx.core.impl.VertxInternal;
 import io.vertx.core.json.JsonObject;
-import io.vertx.core.net.NetServerOptions;
 import io.vertx.core.net.NetServerOptionsConverter;
 import io.vertx.core.net.NetworkOptionsConverter;
 import io.vertx.core.net.OpenSSLEngineOptions;
-import io.vertx.core.net.TCPSSLOptions;
 import io.vertx.core.net.TCPSSLOptionsConverter;
 import io.vertx.core.net.impl.SSLHelper;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Test;
 
 import javax.net.ssl.SSLContext;
@@ -55,8 +55,8 @@ public void testUseJdkCiphersWhenNotSpecified() throws Exception {
     SSLEngine engine = context.createSSLEngine();
     String[] expected = engine.getEnabledCipherSuites();
     SSLHelper helper = new SSLHelper(new HttpClientOptions(),
-        TLSCert.JKS.getClientKeyCertOptions(),
-        TLSCert.JKS.getClientTrustOptions());
+        Cert.CLIENT_JKS.get(),
+        Trust.SERVER_JKS.get());
     SslContext ctx = helper.getContext((VertxInternal) vertx);
     assertEquals(new HashSet<>(Arrays.asList(expected)), new HashSet<>(ctx.cipherSuites()));
   }
@@ -66,8 +66,8 @@ public void testUseOpenSSLCiphersWhenNotSpecified() throws Exception {
     Set<String> expected = OpenSsl.availableCipherSuites();
     SSLHelper helper = new SSLHelper(
         new HttpClientOptions().setOpenSslEngineOptions(new OpenSSLEngineOptions()),
-        TLSCert.PEM.getClientKeyCertOptions(),
-        TLSCert.PEM.getClientTrustOptions());
+        Cert.CLIENT_PEM.get(),
+        Trust.SERVER_PEM.get());
     SslContext ctx = helper.getContext((VertxInternal) vertx);
     assertEquals(expected, new HashSet<>(ctx.cipherSuites()));
   }
@@ -90,8 +90,8 @@ private void testOpenSslServerSessionContext(boolean testDefault){
     }
 
     SSLHelper defaultHelper = new SSLHelper(httpServerOptions,
-            TLSCert.PEM.getServerKeyCertOptions(),
-            TLSCert.PEM.getServerTrustOptions());
+            Cert.SERVER_PEM.get(),
+            Trust.SERVER_PEM.get());
 
     SslContext ctx = defaultHelper.getContext((VertxInternal) vertx);
     assertTrue(ctx instanceof OpenSslServerContext);
@@ -121,7 +121,7 @@ public void testPreserveEnabledCipherSuitesOrder() throws Exception {
     NetServerOptionsConverter.toJson(options, json);
     HttpServerOptionsConverter.toJson(options, json);
     assertEquals(new ArrayList<>(new HttpServerOptions(json).getEnabledCipherSuites()), Arrays.asList(engine.getEnabledCipherSuites()));
-    SSLHelper helper = new SSLHelper(options, TLSCert.JKS.getServerKeyCertOptions(), null);
+    SSLHelper helper = new SSLHelper(options, Cert.SERVER_JKS.get(), null);
     assertEquals(Arrays.asList(helper.createSslHandler((VertxInternal) vertx).engine().getEnabledCipherSuites()), Arrays.asList(engine.getEnabledCipherSuites()));
   }
 
@@ -140,7 +140,7 @@ public void testPreserveEnabledSecureTransportProtocolOrder() throws Exception {
     NetServerOptionsConverter.toJson(options, json);
     HttpServerOptionsConverter.toJson(options, json);
     assertEquals(new ArrayList<>(new HttpServerOptions(json).getEnabledSecureTransportProtocols()), Arrays.asList(protocols));
-    SSLHelper helper = new SSLHelper(options, TLSCert.JKS.getServerKeyCertOptions(), null);
+    SSLHelper helper = new SSLHelper(options, Cert.SERVER_JKS.get(), null);
     List<String> engineProtocols = Arrays.asList(helper.createSslHandler((VertxInternal) vertx).engine().getEnabledProtocols());
     List<String> expectedProtocols = new ArrayList<>(Arrays.asList(protocols));
     expectedProtocols.retainAll(engineProtocols);
diff --git a/src/test/java/io/vertx/test/core/TLSCert.java b/src/test/java/io/vertx/test/core/TLSCert.java
deleted file mode 100644
--- a/src/test/java/io/vertx/test/core/TLSCert.java
+++ /dev/null
@@ -1,236 +0,0 @@
-/*
- * Copyright (c) 2011-2014 The original author or authors
- * ------------------------------------------------------
- * All rights reserved. This program and the accompanying materials
- * are made available under the terms of the Eclipse Public License v1.0
- * and Apache License v2.0 which accompanies this distribution.
- *
- *     The Eclipse Public License is available at
- *     http://www.eclipse.org/legal/epl-v10.html
- *
- *     The Apache License v2.0 is available at
- *     http://www.opensource.org/licenses/apache2.0.php
- *
- * You may elect to redistribute this code under either of these licenses.
- */
-package io.vertx.test.core;
-
-import io.netty.handler.codec.UnsupportedMessageTypeException;
-import io.vertx.core.net.JksOptions;
-import io.vertx.core.net.KeyCertOptions;
-import io.vertx.core.net.PemKeyCertOptions;
-import io.vertx.core.net.PemTrustOptions;
-import io.vertx.core.net.PfxOptions;
-import io.vertx.core.net.TrustOptions;
-
-/**
- * @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
- */
-public enum TLSCert {
-
-  NONE() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return null;
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return null;
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return null;
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      return null;
-    }
-  },
-
-  // Self signed
-  JKS() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new JksOptions().setPath("tls/server-keystore.jks").setPassword("wibble");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return new JksOptions().setPath("tls/server-truststore.jks").setPassword("wibble");
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new JksOptions().setPath("tls/client-truststore.jks").setPassword("wibble");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      return new JksOptions().setPath("tls/client-keystore.jks").setPassword("wibble");
-    }
-  },
-
-  // Self signed
-  PKCS12() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new PfxOptions().setPath("tls/server-keystore.p12").setPassword("wibble");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return new PfxOptions().setPath("tls/server-truststore.p12").setPassword("wibble");
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new PfxOptions().setPath("tls/client-truststore.p12").setPassword("wibble");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      return new PfxOptions().setPath("tls/client-keystore.p12").setPassword("wibble");
-    }
-  },
-
-  // Self signed
-  PEM() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert.pem");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/client-cert.pem");
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/server-cert.pem");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      return new PemKeyCertOptions().setKeyPath("tls/client-key.pem").setCertPath("tls/client-cert.pem");
-    }
-  },
-
-  // Signed by root CA
-  JKS_ROOT_CA() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new JksOptions().setPath("tls/server-keystore-root-ca.jks").setPassword("wibble");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      throw new UnsupportedOperationException();
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new JksOptions().setPath("tls/client-truststore-root-ca.jks").setPassword("wibble");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      throw new UnsupportedOperationException();
-    }
-  },
-
-  // Signed by root CA
-  PKCS12_ROOT_CA() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new PfxOptions().setPath("tls/server-keystore-root-ca.p12").setPassword("wibble");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      throw new UnsupportedOperationException();
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new PfxOptions().setPath("tls/client-truststore-root-ca.p12").setPassword("wibble");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      throw new UnsupportedOperationException();
-    }
-  },
-
-  // Signed by root CA
-  PEM_ROOT_CA() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-root-ca.pem");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      return new PemKeyCertOptions().setKeyPath("tls/client-key.pem").setCertPath("tls/client-cert-root-ca.pem");
-    }
-  },
-
-  // Signed by an intermediate CA
-  PEM_CA() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-int-ca.pem");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/int-ca/ca-cert.pem");
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/int-ca/ca-cert.pem");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      throw new UnsupportedMessageTypeException();
-    }
-  },
-
-  // Signed by an intermediate CA using a chain
-  PEM_CA_CHAIN() {
-    @Override
-    public KeyCertOptions getServerKeyCertOptions() {
-      return new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-ca-chain.pem");
-    }
-    @Override
-    public TrustOptions getServerTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
-    }
-    @Override
-    public TrustOptions getClientTrustOptions() {
-      return new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
-    }
-    @Override
-    public KeyCertOptions getClientKeyCertOptions() {
-      throw new UnsupportedMessageTypeException();
-    }
-  },
-
-  // Man-in-middle attack : the server cert CN does not match the resolved URI host
-  MIM() {
-      @Override
-      public KeyCertOptions getServerKeyCertOptions() {
-          return new JksOptions().setPath("tls/mim-server-keystore.jks").setPassword("wibble");
-      }
-      @Override
-      public TrustOptions getServerTrustOptions() {
-          return null;
-      }
-      @Override
-      public TrustOptions getClientTrustOptions() {
-          return null;
-      }
-      @Override
-      public KeyCertOptions getClientKeyCertOptions() {
-          return null;
-      }
-  };
-
-
-  public abstract KeyCertOptions getServerKeyCertOptions();
-  public abstract KeyCertOptions getClientKeyCertOptions();
-  public abstract TrustOptions getServerTrustOptions();
-  public abstract TrustOptions getClientTrustOptions();
-
-}
diff --git a/src/test/java/io/vertx/test/core/WebsocketTest.java b/src/test/java/io/vertx/test/core/WebsocketTest.java
--- a/src/test/java/io/vertx/test/core/WebsocketTest.java
+++ b/src/test/java/io/vertx/test/core/WebsocketTest.java
@@ -28,8 +28,12 @@
 import io.vertx.core.buffer.Buffer;
 import io.vertx.core.http.*;
 import io.vertx.core.impl.ConcurrentHashSet;
+import io.vertx.core.net.KeyCertOptions;
 import io.vertx.core.net.NetSocket;
+import io.vertx.core.net.TrustOptions;
 import io.vertx.core.streams.ReadStream;
+import io.vertx.test.core.tls.Cert;
+import io.vertx.test.core.tls.Trust;
 import org.junit.Test;
 
 import java.security.MessageDigest;
@@ -193,125 +197,125 @@ public void testInvalidSubProtocolHybi17() throws Exception {
   @Test
   // Client trusts all server certs
   public void testTLSClientTrustAll() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE, false, false, true, false, true);
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE, false, false, true, false, true);
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE, false, false, false, false, true);
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE, false, false, false, false, true);
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCertPKCS12() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.PKCS12, TLSCert.NONE, false, false, false, false, true);
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_PKCS12, Trust.NONE, false, false, false, false, true);
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustServerCertPEM() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.PEM, TLSCert.NONE, false, false, false, false, true);
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_PEM, Trust.NONE, false, false, false, false, true);
   }
 
   @Test
   // Server specifies cert that the client trusts via a CA (not trust all)
   public void testTLSClientTrustServerCertPEM_CA() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE, false, false, false, false, true);
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE, false, false, false, false, true);
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustPKCS12ServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PKCS12, TLSCert.JKS, TLSCert.NONE, false, false, false, false, true);
+    testTLS(Cert.NONE, Trust.SERVER_PKCS12, Cert.SERVER_JKS, Trust.NONE, false, false, false, false, true);
   }
 
   @Test
   // Server specifies cert that the client trusts (not trust all)
   public void testTLSClientTrustPEMServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM, TLSCert.JKS, TLSCert.NONE, false, false, false, false, true);
+    testTLS(Cert.NONE, Trust.SERVER_PEM, Cert.SERVER_JKS, Trust.NONE, false, false, false, false, true);
   }
 
   @Test
   // Server specifies cert that the client doesn't trust
   public void testTLSClientUntrustedServer() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE, false, false, false, false, false);
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE, false, false, false, false, false);
   }
 
   @Test
   //Client specifies cert even though it's not required
   public void testTLSClientCertNotRequired() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, false, false, false, false, true);
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS, false, false, false, false, true);
   }
 
   @Test
   //Client specifies cert and it is required
   public void testTLSClientCertRequired() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, true, false, false, false, true);
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS, true, false, false, false, true);
   }
 
   @Test
   //Client specifies cert and it is required
   public void testTLSClientCertRequiredPKCS12() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.PKCS12, true, false, false, false, true);
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PKCS12, true, false, false, false, true);
   }
 
   @Test
   //Client specifies cert and it is required
   public void testTLSClientCertRequiredPEM() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.PEM, true, false, false, false, true);
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PEM, true, false, false, false, true);
   }
 
   @Test
   //Client specifies cert and it is required
   public void testTLSClientCertPKCS12Required() throws Exception {
-    testTLS(TLSCert.PKCS12, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, true, false, false, false, true);
+    testTLS(Cert.CLIENT_PKCS12, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS, true, false, false, false, true);
   }
 
   @Test
   //Client specifies cert and it is required
   public void testTLSClientCertPEMRequired() throws Exception {
-    testTLS(TLSCert.PEM, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, true, false, false, false, true);
+    testTLS(Cert.CLIENT_PEM, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS, true, false, false, false, true);
   }
 
   @Test
   //Client specifies cert signed by CA and it is required
   public void testTLSClientCertPEM_CARequired() throws Exception {
-    testTLS(TLSCert.PEM_ROOT_CA, TLSCert.JKS, TLSCert.JKS, TLSCert.PEM_ROOT_CA, true, false, false, false, true);
+    testTLS(Cert.CLIENT_PEM_ROOT_CA, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PEM_ROOT_CA, true, false, false, false, true);
   }
 
   @Test
   //Client doesn't specify cert but it's required
   public void testTLSClientCertRequiredNoClientCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, true, false, false, false, false);
+    testTLS(Cert.NONE, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_JKS, true, false, false, false, false);
   }
 
   @Test
   //Client specifies cert but it's not trusted
   public void testTLSClientCertClientNotTrusted() throws Exception {
-    testTLS(TLSCert.JKS, TLSCert.JKS, TLSCert.JKS, TLSCert.NONE, true, false, false, false, false);
+    testTLS(Cert.CLIENT_JKS, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.NONE, true, false, false, false, false);
   }
 
   @Test
   // Server specifies cert that the client does not trust via a revoked certificate of the CA
   public void testTLSClientRevokedServerCert() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.PEM_ROOT_CA, TLSCert.PEM_ROOT_CA, TLSCert.NONE, false, false, false, true, false);
+    testTLS(Cert.NONE, Trust.SERVER_PEM_ROOT_CA, Cert.SERVER_PEM_ROOT_CA, Trust.NONE, false, false, false, true, false);
   }
 
   @Test
   //Client specifies cert that the server does not trust via a revoked certificate of the CA
   public void testTLSRevokedClientCertServer() throws Exception {
-    testTLS(TLSCert.PEM_ROOT_CA, TLSCert.JKS, TLSCert.JKS, TLSCert.PEM_ROOT_CA, true, true, false, false, false);
+    testTLS(Cert.CLIENT_PEM_ROOT_CA, Trust.SERVER_JKS, Cert.SERVER_JKS, Trust.CLIENT_PEM_ROOT_CA, true, true, false, false, false);
   }
 
   @Test
   // Test with cipher suites
   public void testTLSCipherSuites() throws Exception {
-    testTLS(TLSCert.NONE, TLSCert.NONE, TLSCert.JKS, TLSCert.NONE, false, false, true, false, true, ENABLED_CIPHER_SUITES);
+    testTLS(Cert.NONE, Trust.NONE, Cert.SERVER_JKS, Trust.NONE, false, false, true, false, true, ENABLED_CIPHER_SUITES);
   }
 
-  private void testTLS(TLSCert clientCert, TLSCert clientTrust,
-                       TLSCert serverCert, TLSCert serverTrust,
+  private void testTLS(Cert<?> clientCert, Trust<?> clientTrust,
+                       Cert<?> serverCert, Trust<?> serverTrust,
                        boolean requireClientAuth, boolean serverUsesCrl, boolean clientTrustAll,
                        boolean clientUsesCrl, boolean shouldPass,
                        String... enabledCipherSuites) throws Exception {
@@ -323,16 +327,16 @@ private void testTLS(TLSCert clientCert, TLSCert clientTrust,
     if (clientUsesCrl) {
       options.addCrlPath("tls/root-ca/crl.pem");
     }
-    setOptions(options, clientTrust.getClientTrustOptions());
-    setOptions(options, clientCert.getClientKeyCertOptions());
+    setOptions(options, clientTrust.get());
+    setOptions(options, clientCert.get());
     for (String suite: enabledCipherSuites) {
       options.addEnabledCipherSuite(suite);
     }
     client = vertx.createHttpClient(options);
     HttpServerOptions serverOptions = new HttpServerOptions();
     serverOptions.setSsl(true);
-    setOptions(serverOptions, serverTrust.getServerTrustOptions());
-    setOptions(serverOptions, serverCert.getServerKeyCertOptions());
+    setOptions(serverOptions, serverTrust.get());
+    setOptions(serverOptions, serverCert.get());
     if (requireClientAuth) {
       serverOptions.setClientAuth(ClientAuth.REQUIRED);
     }
diff --git a/src/test/java/io/vertx/test/core/tls/Cert.java b/src/test/java/io/vertx/test/core/tls/Cert.java
new file mode 100644
--- /dev/null
+++ b/src/test/java/io/vertx/test/core/tls/Cert.java
@@ -0,0 +1,31 @@
+package io.vertx.test.core.tls;
+
+import io.vertx.core.net.JksOptions;
+import io.vertx.core.net.KeyCertOptions;
+import io.vertx.core.net.PemKeyCertOptions;
+import io.vertx.core.net.PfxOptions;
+
+import java.util.function.Supplier;
+
+/**
+ * @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
+ */
+public interface Cert<K extends KeyCertOptions> extends Supplier<K> {
+
+  Cert<KeyCertOptions> NONE = () -> null;
+  Cert<JksOptions> SERVER_JKS = () -> new JksOptions().setPath("tls/server-keystore.jks").setPassword("wibble");
+  Cert<JksOptions> CLIENT_JKS = () -> new JksOptions().setPath("tls/client-keystore.jks").setPassword("wibble");
+  Cert<PfxOptions> SERVER_PKCS12 = () -> new PfxOptions().setPath("tls/server-keystore.p12").setPassword("wibble");
+  Cert<PfxOptions> CLIENT_PKCS12 = () -> new PfxOptions().setPath("tls/client-keystore.p12").setPassword("wibble");
+  Cert<PemKeyCertOptions> SERVER_PEM = () -> new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert.pem");
+  Cert<PemKeyCertOptions> CLIENT_PEM = () -> new PemKeyCertOptions().setKeyPath("tls/client-key.pem").setCertPath("tls/client-cert.pem");
+  Cert<JksOptions> SERVER_JKS_ROOT_CA = () -> new JksOptions().setPath("tls/server-keystore-root-ca.jks").setPassword("wibble");
+  Cert<PfxOptions> SERVER_PKCS12_ROOT_CA = () -> new PfxOptions().setPath("tls/server-keystore-root-ca.p12").setPassword("wibble");
+  Cert<PemKeyCertOptions> SERVER_PEM_ROOT_CA = () -> new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-root-ca.pem");
+  Cert<PemKeyCertOptions> CLIENT_PEM_ROOT_CA = () -> new PemKeyCertOptions().setKeyPath("tls/client-key.pem").setCertPath("tls/client-cert-root-ca.pem");
+  Cert<PemKeyCertOptions> SERVER_PEM_INT_CA = () -> new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-int-ca.pem");
+  Cert<PemKeyCertOptions> SERVER_PEM_CA_CHAIN = () -> new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-ca-chain.pem");
+  Cert<PemKeyCertOptions> SERVER_PEM_OTHER_CA = () -> new PemKeyCertOptions().setKeyPath("tls/server-key.pem").setCertPath("tls/server-cert-other-ca.pem");
+  Cert<JksOptions> SERVER_MIM = () -> new JksOptions().setPath("tls/mim-server-keystore.jks").setPassword("wibble");
+
+}
diff --git a/src/test/java/io/vertx/test/core/tls/Trust.java b/src/test/java/io/vertx/test/core/tls/Trust.java
new file mode 100644
--- /dev/null
+++ b/src/test/java/io/vertx/test/core/tls/Trust.java
@@ -0,0 +1,28 @@
+package io.vertx.test.core.tls;
+
+import io.vertx.core.net.JksOptions;
+import io.vertx.core.net.PemTrustOptions;
+import io.vertx.core.net.PfxOptions;
+import io.vertx.core.net.TrustOptions;
+
+import java.util.function.Supplier;
+
+/**
+ * @author <a href="mailto:julien@julienviet.com">Julien Viet</a>
+ */
+public interface Trust<T extends TrustOptions> extends Supplier<T> {
+
+  Trust<TrustOptions> NONE = () -> null;
+  Trust<JksOptions> SERVER_JKS = () -> new JksOptions().setPath("tls/client-truststore.jks").setPassword("wibble");
+  Trust<JksOptions> CLIENT_JKS = () -> new JksOptions().setPath("tls/server-truststore.jks").setPassword("wibble");
+  Trust<PfxOptions> SERVER_PKCS12 = () -> new PfxOptions().setPath("tls/client-truststore.p12").setPassword("wibble");
+  Trust<PfxOptions> CLIENT_PKCS12 = () -> new PfxOptions().setPath("tls/server-truststore.p12").setPassword("wibble");
+  Trust<PemTrustOptions> SERVER_PEM = () -> new PemTrustOptions().addCertPath("tls/server-cert.pem");
+  Trust<PemTrustOptions> CLIENT_PEM = () -> new PemTrustOptions().addCertPath("tls/client-cert.pem");
+  Trust<JksOptions> SERVER_JKS_ROOT_CA = () -> new JksOptions().setPath("tls/client-truststore-root-ca.jks").setPassword("wibble");
+  Trust<PfxOptions> SERVER_PKCS12_ROOT_CA = () -> new PfxOptions().setPath("tls/client-truststore-root-ca.p12").setPassword("wibble");
+  Trust<PemTrustOptions> SERVER_PEM_ROOT_CA = () -> new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
+  Trust<PemTrustOptions> CLIENT_PEM_ROOT_CA = () -> new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem");
+  Trust<PemTrustOptions> SERVER_PEM_ROOT_CA_AND_OTHER_CA = () -> new PemTrustOptions().addCertPath("tls/root-ca/ca-cert.pem").addCertPath("tls/other-ca/ca-cert.pem");
+
+}
diff --git a/src/test/java/io/vertx/test/it/SSLEngineTest.java b/src/test/java/io/vertx/test/it/SSLEngineTest.java
--- a/src/test/java/io/vertx/test/it/SSLEngineTest.java
+++ b/src/test/java/io/vertx/test/it/SSLEngineTest.java
@@ -14,7 +14,7 @@
 import io.vertx.core.net.SSLEngineOptions;
 import io.vertx.core.net.impl.SSLHelper;
 import io.vertx.test.core.HttpTestBase;
-import io.vertx.test.core.TLSCert;
+import io.vertx.test.core.tls.Cert;
 import org.junit.Test;
 
 /**
@@ -66,7 +66,7 @@ private void doTest(SSLEngineOptions engine,
         .setSslEngineOptions(engine)
         .setPort(DEFAULT_HTTP_PORT)
         .setHost(DEFAULT_HTTP_HOST)
-        .setKeyCertOptions(TLSCert.PEM.getServerKeyCertOptions())
+        .setKeyCertOptions(Cert.SERVER_PEM.get())
         .setSsl(true)
         .setUseAlpn(useAlpn);
     try {
diff --git a/src/test/resources/tls/openssl.cnf b/src/test/resources/tls/openssl.cnf
--- a/src/test/resources/tls/openssl.cnf
+++ b/src/test/resources/tls/openssl.cnf
@@ -11,6 +11,16 @@ default_days     = 365
 crlnumber        = root-ca/crlnumber
 default_crl_days = 365
 
+[ CA_other ]
+new_certs_dir    = other-ca
+database         = other-ca/index.txt
+default_md       = sha1
+policy           = policy_match
+serial           = other-ca/serial
+default_days     = 365
+crlnumber        = other-ca/crlnumber
+default_crl_days = 365
+
 [ CA_int ]
 new_certs_dir    = int-ca
 database         = int-ca/index.txt
diff --git a/src/test/resources/tls/other-ca/01.pem b/src/test/resources/tls/other-ca/01.pem
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/01.pem
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: CN=localhost
+        Validity
+            Not Before: Sep  6 21:33:44 2016 GMT
+            Not After : Sep  6 21:33:44 2017 GMT
+        Subject: CN=localhost
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (2048 bit)
+                Modulus (2048 bit):
+                    00:9a:c7:2c:01:f8:a4:3d:f8:72:40:39:ed:94:74:
+                    8a:e8:d7:2f:59:fb:85:45:97:83:7f:f2:78:5b:be:
+                    db:12:fd:7b:36:4c:92:75:1f:a1:0b:eb:ec:7b:9e:
+                    2e:13:d7:81:94:09:27:0a:54:46:08:83:03:62:1d:
+                    53:29:5e:18:31:95:84:47:9f:14:f1:3a:58:10:64:
+                    24:4e:c0:d5:71:30:c1:26:2e:bc:6a:e0:d5:8e:c0:
+                    66:dd:43:2c:09:ee:18:06:de:ba:36:ea:b3:3f:43:
+                    34:70:2e:14:5b:09:1f:a0:b1:77:6c:52:f7:03:fe:
+                    7a:ed:94:3d:b8:cf:f4:5f:07:03:68:79:3c:d8:ee:
+                    ce:29:a8:15:6a:7b:11:ed:4f:0a:6c:6e:b4:e2:2a:
+                    d6:60:e7:b9:2f:d0:a2:25:18:8a:01:d9:53:9e:12:
+                    8f:96:06:0c:d9:ff:a0:7f:58:f8:9b:9e:29:7c:a0:
+                    4c:76:4d:c6:c9:87:85:6f:ce:ab:4d:80:6f:b2:02:
+                    2b:58:9d:c9:b0:27:96:77:a8:55:44:78:4d:ab:29:
+                    2c:62:8c:e2:d6:86:4d:20:5c:6f:2e:af:21:85:8b:
+                    78:0b:fa:a8:94:8d:75:05:6f:62:19:c7:45:8b:77:
+                    5d:5a:dc:cb:5a:bc:7d:68:9d:0c:93:62:b0:e5:73:
+                    31:c7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Alternative Name: 
+                DNS:localhost
+    Signature Algorithm: sha1WithRSAEncryption
+        ae:3d:ab:a9:f6:d7:f3:3f:1b:5f:7f:b5:11:7f:ec:33:e9:9a:
+        c9:fc:70:23:af:48:d6:ca:fc:ac:ca:91:dc:28:bf:3c:b4:86:
+        70:86:b8:76:5f:17:32:22:5d:d4:2c:5b:70:88:7b:ec:6e:5c:
+        bf:53:00:35:2b:36:d6:bf:1d:2f:fd:32:16:7f:e0:aa:d1:20:
+        b6:cd:3f:81:c2:6b:46:ab:f2:0d:79:a1:53:9e:33:17:a5:40:
+        7e:60:6c:d5:56:9c:9d:0b:89:c6:07:6a:92:a2:00:7f:03:b1:
+        83:9a:9a:79:01:81:d3:4b:95:41:1e:07:94:d6:1c:a5:53:1c:
+        49:01:17:a0:49:45:9f:4f:ca:28:12:c6:6d:cc:5a:b6:90:d0:
+        a1:0b:b5:62:47:63:92:13:0d:af:35:e6:10:4d:66:ec:3f:61:
+        a6:a2:4c:3d:39:10:63:0f:d4:88:fc:90:f5:5e:01:5d:0c:60:
+        45:29:a8:3e:92:fb:35:80:d4:88:f6:e6:d7:d3:09:79:ef:7c:
+        03:76:11:d8:7b:db:8d:92:cf:f6:e6:50:13:d3:d7:e8:11:89:
+        92:af:c5:e7:4e:89:f5:e5:f2:41:de:27:54:f2:1e:1b:17:ec:
+        04:71:7a:7d:7a:40:db:45:c9:50:0f:9f:87:fc:a4:35:50:83:
+        cf:f7:41:21
+-----BEGIN CERTIFICATE-----
+MIICuzCCAaOgAwIBAgIBATANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDEwlsb2Nh
+bGhvc3QwHhcNMTYwOTA2MjEzMzQ0WhcNMTcwOTA2MjEzMzQ0WjAUMRIwEAYDVQQD
+Ewlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCaxywB
++KQ9+HJAOe2UdIro1y9Z+4VFl4N/8nhbvtsS/Xs2TJJ1H6EL6+x7ni4T14GUCScK
+VEYIgwNiHVMpXhgxlYRHnxTxOlgQZCROwNVxMMEmLrxq4NWOwGbdQywJ7hgG3ro2
+6rM/QzRwLhRbCR+gsXdsUvcD/nrtlD24z/RfBwNoeTzY7s4pqBVqexHtTwpsbrTi
+KtZg57kv0KIlGIoB2VOeEo+WBgzZ/6B/WPibnil8oEx2TcbJh4VvzqtNgG+yAitY
+ncmwJ5Z3qFVEeE2rKSxijOLWhk0gXG8uryGFi3gL+qiUjXUFb2IZx0WLd11a3Mta
+vH1onQyTYrDlczHHAgMBAAGjGDAWMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkq
+hkiG9w0BAQUFAAOCAQEArj2rqfbX8z8bX3+1EX/sM+mayfxwI69I1sr8rMqR3Ci/
+PLSGcIa4dl8XMiJd1CxbcIh77G5cv1MANSs21r8dL/0yFn/gqtEgts0/gcJrRqvy
+DXmhU54zF6VAfmBs1VacnQuJxgdqkqIAfwOxg5qaeQGB00uVQR4HlNYcpVMcSQEX
+oElFn0/KKBLGbcxatpDQoQu1YkdjkhMNrzXmEE1m7D9hpqJMPTkQYw/UiPyQ9V4B
+XQxgRSmoPpL7NYDUiPbm19MJee98A3YR2HvbjZLP9uZQE9PX6BGJkq/F506J9eXy
+Qd4nVPIeGxfsBHF6fXpA20XJUA+fh/ykNVCDz/dBIQ==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/tls/other-ca/ca-cert.pem b/src/test/resources/tls/other-ca/ca-cert.pem
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/ca-cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIDCCAgigAwIBAgIJAKwEua1HODABMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV
+BAMTCWxvY2FsaG9zdDAeFw0xNjA5MDYyMTMzMDhaFw0xNjEwMDYyMTMzMDhaMBQx
+EjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAL9ewDrSBF9ca9M76h3shgda9hVmIiHE0V1jSkXwNxKF/AE5qPU81BVLZYmU
+l79Aoy3DW7puISZVOwQgk+XEb8yx5DChPEyrRy/2o5PBIoTImNbIq52OaRYkMzwI
+ARuPu1sALAJcp8JmoUlDJmuwL6muK4/QG19EamLuv1e3OPJ3ph9mvt14mRKn95Ci
+Q4jPb/I2CK/VgaCUXDDqPqBIBMW89Yqc6Aet3jyvPa+grg5hjnhJ9CsVZ06TQjxn
+zRo6EzF6H7rKOINcvOeRO8yDw0gI6CoW/K89zgXXmNTvC3NPZGlIzJI9sNoMGL8J
+HdslGvaRIqcUO3tNByBvcc6XzYsCAwEAAaN1MHMwHQYDVR0OBBYEFHnlh9N5EGIP
+yWeKMCmt7S79NWO5MEQGA1UdIwQ9MDuAFHnlh9N5EGIPyWeKMCmt7S79NWO5oRik
+FjAUMRIwEAYDVQQDEwlsb2NhbGhvc3SCCQCsBLmtRzgwATAMBgNVHRMEBTADAQH/
+MA0GCSqGSIb3DQEBBQUAA4IBAQBwdCgqPoSQk862Ygbj7nG3xWwCDqt2igZS8luo
+H/Ki4PXo0rpQAgIF7Va+YrOZIFO5vsSmSnMg9vJdtL/pMTzAnTKzgj6UmKQRK/Br
+bg80mKkxudZ8KaGejlMlid2eeFDjMgsXVyLkrElINpP7T7KsMWp8/iAzjpzg+zv2
+KdMLbBPeJk7qqQHqxTnF78sxpjQDAR9L88xSPPHTYLC8eLd4S7Ev9wU0HDmWcmuY
+S/aNIs87OdzVXJg9bYlKex48xQVBFVHR89wmVqf5Fq0UuBcZWwZb7P0Uq1YPg3BB
+WUyPOCs+x7p6WDaDkWQ7s2p/0Gxdn6AoUdTXJXAvHEjdtvDP
+-----END CERTIFICATE-----
diff --git a/src/test/resources/tls/other-ca/ca-key.pem b/src/test/resources/tls/other-ca/ca-key.pem
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/ca-key.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,D8DE143B04407920
+
+OqMSGXrluJfgRmNkbhW8hpENJqaT/YqnW/6W+iV8MWdEH3tYrfcNhimRpJMVi1Tl
+/lUNQDtEFlQJGN+THR8jcB+PGFWNkOEmkS0DhTm17oKLOn0tz75TPuf+IcQBp0Kf
+X5h5YY9SvIMpGsVHvR8nPzzMi9q2tQxSqkBFxQ3Ztu/T0e1zZaL/1F7RBovQRqtY
+PWl2z5FW8PQnkMW7IzPnlgrs+gMfMJ2R/UNMNiBaU7ssCtxU/D6stncsib+B3FaF
+ooozGBIy0YBnsk6VCNhsqnNh23kCgguupVNcpneTMMQQFUqZzNrUjUgpEPWk0sT4
+UeVMAQ0GX/xzh/RM21dptB92U7zTTT/z6Sw/cmUcwIYP49u6LV2A4PaEpZzDNF4q
+n1Uj8tW6q9Cpum04KjIOkV3KYgF6g/9bn2Q0Ehs5ndmvk+zLGrJ5iwt92/SmN2vF
+aeDra48rLLPSHtPHAeunu6m0G1icvqP90OpOtKBxlkaVj3SH5HO+mPgXjq6QvuTE
+rY4f+6Nitg7lm6ts3LP+3mq8FivsNe+jHvHprZ+b5WCUwnsm+m/rDvs04S0llypF
+vkLNrOPjxX+cKK2a4QpfCREebQNcih+sI8fiNcSDN3KB5BLq9aznI9/tIYBZYapp
+LTi0n2NAigFn5wGeXCnT9BAntzKxUoE52judp3tiT3xnom2w5tzZSMQvfyAhFi12
++UwDjhH8/63eRW+aifROnDVIH2V7EolcqSggHcPIaQtuxuG+nbTQ6MdIxJAzTCuM
+kiOQ4LkZt9Hw+X8U26NcriwAD7wJ9fYtM9q1kKPfNMejcoh82KrLkYZIWlWb+A3G
+Lr9EgWQ721AuAkxdFJFq/L8dqmD58UFNnYDTr50N2293lJr8gBme1Nof8NUA5rpO
+Kb39y29gstn2IjkECGICI3ih4IVC3CKyQjFMPu2Q/QYTModdflLNIqLjwPT2X6CX
+Kg26oeXJ5sJd//YGBHDGF5+LNh9pBIrALHErOYKJxiviBEUIkmweDcv4YJLl5oN/
+kgaKS1iT/lOHjs6g1XzsCSJL4roq1GnzQ6BQc5LzzGinIdDrk98cne1wu1wiJv6h
+YHYEdzCYiLkuiHmhtM9+EQXVLQjFnbHdSICDqdTRVJpvI7dYA/pN9G/l9YWnM3sf
+zcrgyYI/hZ8O+twcEaEiu5nQZv5NPpxzZTsRJMcZD3pZLG/t5/teNJ6MPcvkBCTF
+fXk+c3elGwVH8hp4tVqPNsUkhba+xr4Wp0XBSie5RVosPVH4yTWbkg1hk17IDb+d
+SuLEokNBS6pJxjojZQ2WcCvCVg3X3KJTW0Wy/Bf5BKOM0vjbgQSMADou5nu5V+cx
+21oURSNL1cY+0oeJFd15YE19vkiz7W/Ml3/YTeZdiRZ6RRj3AFmly1uyGMgkI5Y+
+k1f7cVB5dEQvH+gjHPNcOGsLrP60AqIwit8wcmBZR+QFD3hVQ00OLOk8m521Iio0
+z2hzoeUhSmmOngN6YNuhDgolQoNyVmSB4Gx1eYtVv+QHEiwgn7gJ9LK4P3P0yXRI
+4Fc5OTM26pZ6A7A3xCW6fGcaC6mt+UmqqUee1xntqawsXzkhOz9GQniuuhhA87DX
+-----END RSA PRIVATE KEY-----
diff --git a/src/test/resources/tls/other-ca/crlnumber b/src/test/resources/tls/other-ca/crlnumber
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/crlnumber
@@ -0,0 +1 @@
+1000
diff --git a/src/test/resources/tls/other-ca/index.txt b/src/test/resources/tls/other-ca/index.txt
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/index.txt
@@ -0,0 +1 @@
+V	170906213344Z		01	unknown	/CN=localhost
diff --git a/src/test/resources/tls/other-ca/index.txt.attr b/src/test/resources/tls/other-ca/index.txt.attr
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = no
diff --git a/src/test/resources/tls/other-ca/index.txt.attr.old b/src/test/resources/tls/other-ca/index.txt.attr.old
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/index.txt.attr.old
@@ -0,0 +1 @@
+unique_subject = no
diff --git a/src/test/resources/tls/other-ca/index.txt.old b/src/test/resources/tls/other-ca/index.txt.old
new file mode 100644
diff --git a/src/test/resources/tls/other-ca/serial b/src/test/resources/tls/other-ca/serial
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/serial
@@ -0,0 +1 @@
+02
diff --git a/src/test/resources/tls/other-ca/serial.old b/src/test/resources/tls/other-ca/serial.old
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/other-ca/serial.old
@@ -0,0 +1 @@
+01
diff --git a/src/test/resources/tls/server-cert-other-ca.pem b/src/test/resources/tls/server-cert-other-ca.pem
new file mode 100644
--- /dev/null
+++ b/src/test/resources/tls/server-cert-other-ca.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICuzCCAaOgAwIBAgIBATANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDEwlsb2Nh
+bGhvc3QwHhcNMTYwOTA2MjEzMzQ0WhcNMTcwOTA2MjEzMzQ0WjAUMRIwEAYDVQQD
+Ewlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCaxywB
++KQ9+HJAOe2UdIro1y9Z+4VFl4N/8nhbvtsS/Xs2TJJ1H6EL6+x7ni4T14GUCScK
+VEYIgwNiHVMpXhgxlYRHnxTxOlgQZCROwNVxMMEmLrxq4NWOwGbdQywJ7hgG3ro2
+6rM/QzRwLhRbCR+gsXdsUvcD/nrtlD24z/RfBwNoeTzY7s4pqBVqexHtTwpsbrTi
+KtZg57kv0KIlGIoB2VOeEo+WBgzZ/6B/WPibnil8oEx2TcbJh4VvzqtNgG+yAitY
+ncmwJ5Z3qFVEeE2rKSxijOLWhk0gXG8uryGFi3gL+qiUjXUFb2IZx0WLd11a3Mta
+vH1onQyTYrDlczHHAgMBAAGjGDAWMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkq
+hkiG9w0BAQUFAAOCAQEArj2rqfbX8z8bX3+1EX/sM+mayfxwI69I1sr8rMqR3Ci/
+PLSGcIa4dl8XMiJd1CxbcIh77G5cv1MANSs21r8dL/0yFn/gqtEgts0/gcJrRqvy
+DXmhU54zF6VAfmBs1VacnQuJxgdqkqIAfwOxg5qaeQGB00uVQR4HlNYcpVMcSQEX
+oElFn0/KKBLGbcxatpDQoQu1YkdjkhMNrzXmEE1m7D9hpqJMPTkQYw/UiPyQ9V4B
+XQxgRSmoPpL7NYDUiPbm19MJee98A3YR2HvbjZLP9uZQE9PX6BGJkq/F506J9eXy
+Qd4nVPIeGxfsBHF6fXpA20XJUA+fh/ykNVCDz/dBIQ==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/tls/ssl.txt b/src/test/resources/tls/ssl.txt
--- a/src/test/resources/tls/ssl.txt
+++ b/src/test/resources/tls/ssl.txt
@@ -176,6 +176,25 @@ openssl pkcs12 -in client-keystore.p12 -nokeys -out client-cert.pem
 
 
 
+# Signed by other CA server->client
+(cert contains alt subject name "localhost" as required by Java for hostname verification)
+
+## PEM signed by other CA
+
+1) Create a other CA database
+
+mkdir other-ca
+openssl req -x509 -newkey rsa:2048 -subj "/CN=localhost" -keyout other-ca/ca-key.pem -out other-ca/ca-cert.pem
+touch other-ca/index.txt
+echo 01 > other-ca/serial
+echo 1000 > other-ca/crlnumber
+echo "unique_subject = no" > other-ca/index.txt.attr
+
+3) Sign the server cert with the other CA and convert it to the X.509 format
+
+openssl ca -config openssl.cnf -name CA_other -keyfile other-ca/ca-key.pem -cert other-ca/ca-cert.pem -in server-csr.pem  -extensions req_ext -extfile openssl.cnf | openssl x509 -out server-cert-other-ca.pem -outform PEM
+
+
 
 # PEM signed by root CA client-server (not sure this is useful)
 

Unable to load multiple client certificates into PEM trust store
If I try to load multiple client certificates for client authentication, only one of the certificates gets loaded.

``` java
PemTrustOptions trustStore = new PemTrustOptions();
        File certDir = new File("cert");
        File clientCertsDir = new File(certDir,"clients");
        Files.find(clientCertsDir.toPath(), 1, (Path path, BasicFileAttributes attrs)->{
            return path.getFileName().toString().endsWith(".pem");
        }).forEach(certPath ->{
            log.info("Adding cert "+certPath);
            trustStore.addCertPath(certPath.toString());
        });
```

I have created pull request #1612 that _should_ fix this issue. The certificates were all being loaded with the same name/alias into the keystore.


@eyce9000 can you make a test for this ?
