[java-opensaml] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Mon Jun 5 19:22:36 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=bc7f6bbcd37f4aa9fd247e13d55a7268894655c9

The following commit(s) were added to refs/heads/main by this push:
     new bc7f6bbcd IDP-2083 - Treat NonnullElements as the default for collections
bc7f6bbcd is described below

commit bc7f6bbcd37f4aa9fd247e13d55a7268894655c9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Jun 5 15:22:33 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Reviewed opensaml-security-api/impl.
    Reduced some non-null uses of Integer in favor of int.
    Added missing annotations.
---
 .../GlobalNamedCurveRegistryInitializer.java       |  4 +-
 .../org/opensaml/security/config/package-info.java |  5 +-
 .../security/credential/BasicCredential.java       |  1 -
 .../opensaml/security/credential/package-info.java |  5 +-
 .../security/criteria/KeyAlgorithmCriterion.java   | 30 ++++++---
 .../security/criteria/KeyLengthCriterion.java      | 21 +++----
 .../security/criteria/KeyNameCriterion.java        | 33 ++++++----
 .../security/criteria/PeerEntityIDCriterion.java   | 33 ++++++----
 .../security/criteria/PublicKeyCriterion.java      | 12 ++--
 .../opensaml/security/criteria/UsageCriterion.java | 12 ++--
 .../opensaml/security/criteria/package-info.java   |  5 +-
 .../org/opensaml/security/crypto/KeySupport.java   |  4 +-
 .../org/opensaml/security/crypto/SigningUtil.java  |  2 +-
 .../org/opensaml/security/crypto/dh/DHSupport.java |  4 +-
 .../opensaml/security/crypto/dh/package-info.java  |  5 +-
 .../org/opensaml/security/crypto/ec/ECSupport.java | 11 ++--
 .../crypto/ec/EnhancedECParameterSpec.java         |  7 +--
 .../opensaml/security/crypto/ec/NamedCurve.java    |  4 +-
 .../security/crypto/ec/NamedCurveRegistry.java     | 19 +++---
 .../crypto/ec/curves/AbstractNamedCurve.java       |  5 +-
 .../security/crypto/ec/curves/package-info.java    |  5 +-
 .../opensaml/security/crypto/ec/package-info.java  |  5 +-
 .../org/opensaml/security/crypto/package-info.java |  5 +-
 .../HttpClientSecurityConfiguration.java           | 16 ++---
 .../HttpClientSecurityConfigurationCriterion.java  | 14 ++---
 .../httpclient/HttpClientSecurityParameters.java   | 62 +++++++++++++++----
 .../httpclient/TLSCriteriaSetCriterion.java        |  6 +-
 .../opensaml/security/httpclient/package-info.java |  5 +-
 .../ClientTLSSecurityParametersContext.java        | 18 ++++--
 .../messaging/HttpClientSecurityContext.java       | 15 ++++-
 .../ServletRequestX509CredentialAdapter.java       | 11 ++--
 .../opensaml/security/messaging/package-info.java  |  5 +-
 .../java/org/opensaml/security/package-info.java   |  5 +-
 .../org/opensaml/security/trust/package-info.java  |  5 +-
 .../security/x509/BasicX509Credential.java         | 22 +++----
 .../opensaml/security/x509/PKIXTrustEngine.java    |  2 +-
 .../security/x509/PKIXValidationInformation.java   |  6 +-
 .../x509/PKIXValidationInformationResolver.java    |  3 +-
 .../security/x509/PKIXValidationOptions.java       | 14 ++---
 .../security/x509/TrustedNamesCriterion.java       | 36 ++++++-----
 .../org/opensaml/security/x509/X500DNHandler.java  | 18 +++---
 .../org/opensaml/security/x509/X509Credential.java |  8 +--
 .../security/x509/X509DigestCriterion.java         |  3 +-
 .../security/x509/X509IssuerSerialCriterion.java   |  3 +-
 .../x509/X509SubjectKeyIdentifierCriterion.java    |  4 +-
 .../security/x509/X509SubjectNameCriterion.java    |  4 +-
 .../org/opensaml/security/x509/X509Support.java    | 26 +++++---
 .../org/opensaml/security/x509/package-info.java   |  5 +-
 .../security/x509/tls/CertificateNameOptions.java  |  5 +-
 .../ClientTLSValidationConfigurationCriterion.java | 14 ++---
 .../x509/tls/ClientTLSValidationParameters.java    | 17 ++++-
 .../tls/ClientTLSValidationParametersResolver.java |  3 +-
 .../opensaml/security/x509/tls/package-info.java   |  5 +-
 .../security/config/impl/package-info.java         |  5 +-
 .../impl/EvaluableEntityIDCredentialCriterion.java | 14 ++---
 .../EvaluableKeyAlgorithmCredentialCriterion.java  | 14 ++---
 .../EvaluableKeyLengthCredentialCriterion.java     | 20 +++---
 .../impl/EvaluableKeyNameCredentialCriterion.java  | 14 ++---
 .../EvaluablePublicKeyCredentialCriterion.java     | 10 +--
 .../impl/EvaluableUsageCredentialCriterion.java    |  4 +-
 ...aluableX509CertSelectorCredentialCriterion.java |  4 +-
 .../EvaluableX509DigestCredentialCriterion.java    |  3 +-
 ...aluableX509IssuerSerialCredentialCriterion.java |  4 +-
 ...509SubjectKeyIdentifierCredentialCriterion.java |  7 ++-
 ...valuableX509SubjectNameCredentialCriterion.java |  4 +-
 .../credential/criteria/impl/package-info.java     |  5 +-
 .../impl/AbstractChainingCredentialResolver.java   | 18 +++---
 .../impl/ChainingCredentialResolver.java           |  2 +-
 .../impl/CollectionCredentialResolver.java         |  5 +-
 .../impl/KeyStoreCredentialResolver.java           |  2 -
 .../credential/impl/StaticCredentialResolver.java  | 10 +--
 .../security/credential/impl/package-info.java     |  5 +-
 .../impl/BasicHttpClientSecurityConfiguration.java | 72 +++++++++++++++++-----
 .../BasicHttpClientSecurityParametersResolver.java |  4 +-
 .../impl/SecurityEnhancedTLSSocketFactory.java     |  2 +-
 .../ThreadLocalClientTLSCredentialHandler.java     |  6 +-
 .../impl/ThreadLocalServerTLSHandler.java          |  6 +-
 .../security/httpclient/impl/package-info.java     |  5 +-
 .../impl/BaseClientCertAuthSecurityHandler.java    |  6 +-
 .../impl/BaseTrustEngineSecurityHandler.java       |  6 +-
 .../security/messaging/impl/package-info.java      |  5 +-
 .../security/trust/impl/ChainingTrustEngine.java   |  6 +-
 .../opensaml/security/trust/impl/package-info.java |  5 +-
 .../x509/impl/BasicPKIXValidationInformation.java  | 15 +++--
 .../impl/BasicX509CredentialNameEvaluator.java     |  3 +-
 .../x509/impl/CertPathPKIXValidationOptions.java   |  5 +-
 .../x509/impl/PKIXX509CredentialTrustEngine.java   |  5 +-
 .../StaticPKIXValidationInformationResolver.java   |  5 +-
 .../x509/impl/X509CredentialNameEvaluator.java     |  6 +-
 .../opensaml/security/x509/impl/package-info.java  |  5 +-
 .../BasicClientTLSValidationConfiguration.java     | 15 ++++-
 ...BasicClientTLSValidationParametersResolver.java |  2 +
 .../tls/impl/ThreadLocalX509CredentialContext.java |  4 +-
 .../security/x509/tls/impl/package-info.java       |  5 +-
 94 files changed, 571 insertions(+), 369 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/config/GlobalNamedCurveRegistryInitializer.java b/opensaml-security-api/src/main/java/org/opensaml/security/config/GlobalNamedCurveRegistryInitializer.java
index 204121d97..44a450756 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/config/GlobalNamedCurveRegistryInitializer.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/config/GlobalNamedCurveRegistryInitializer.java
@@ -32,11 +32,11 @@ import org.opensaml.security.crypto.ec.ECSupport;
 import org.opensaml.security.crypto.ec.NamedCurve;
 import org.opensaml.security.crypto.ec.NamedCurveRegistry;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.component.InitializableComponent;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * OpenSAML {@link Initializer} implementation for {@link NamedCurveRegistry}.
@@ -48,7 +48,7 @@ public class GlobalNamedCurveRegistryInitializer implements Initializer {
             "opensaml.config.ec.registerBouncyCastleCurves";
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(GlobalNamedCurveRegistryInitializer.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(GlobalNamedCurveRegistryInitializer.class);
 
     /** {@inheritDoc} */
     public void init() throws InitializationException {
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/config/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/config/package-info.java
index 51078b438..4708ada93 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/config/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/config/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** OpenSAML configuration classes. */
-package org.opensaml.security.config;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.config;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/credential/BasicCredential.java b/opensaml-security-api/src/main/java/org/opensaml/security/credential/BasicCredential.java
index 67e4ecd43..3b90b9ac1 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/credential/BasicCredential.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/credential/BasicCredential.java
@@ -29,7 +29,6 @@ import javax.crypto.SecretKey;
  */
 public class BasicCredential extends AbstractCredential implements MutableCredential {
 
-
     /**
      * Default constructor.
      */
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/credential/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/credential/package-info.java
index 69dd9e444..f9c8de4b1 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/credential/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/credential/package-info.java
@@ -40,4 +40,7 @@
  *     </li>
  * </ul>
  */
-package org.opensaml.security.credential;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.credential;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyAlgorithmCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyAlgorithmCriterion.java
index 6871e3654..e673b9746 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyAlgorithmCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyAlgorithmCriterion.java
@@ -19,6 +19,7 @@ package org.opensaml.security.criteria;
 
 import javax.annotation.Nonnull;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.resolver.Criterion;
@@ -30,15 +31,15 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class KeyAlgorithmCriterion implements Criterion {
     
     /** Key algorithm type of resolved credentials. */
-    private String keyAlgorithm;
+    @Nonnull private String keyAlgorithm;
     
     /**
      * Constructor.
      *
      * @param algorithm key algorithm
      */
-    public KeyAlgorithmCriterion(@Nonnull final String algorithm) {
-        setKeyAlgorithm(algorithm);
+    public KeyAlgorithmCriterion(@Nonnull @NotEmpty final String algorithm) {
+        keyAlgorithm = validateAlgorithm(algorithm);
     }
  
     /**
@@ -46,7 +47,7 @@ public final class KeyAlgorithmCriterion implements Criterion {
      * 
      * @return returns the keyAlgorithm.
      */
-    @Nonnull public String getKeyAlgorithm() {
+    @Nonnull @NotEmpty public String getKeyAlgorithm() {
         return keyAlgorithm;
     }
 
@@ -56,10 +57,8 @@ public final class KeyAlgorithmCriterion implements Criterion {
      * @param algorithm The keyAlgorithm to set.
      */
     public void setKeyAlgorithm(@Nonnull final String algorithm) {
-        final String trimmed = StringSupport.trimOrNull(algorithm);
-        Constraint.isNotNull(trimmed, "Key algorithm criteria cannot be null or empty");
 
-        keyAlgorithm = trimmed;
+        keyAlgorithm = validateAlgorithm(algorithm);
     }
     
     /** {@inheritDoc} */
@@ -86,11 +85,24 @@ public final class KeyAlgorithmCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof KeyAlgorithmCriterion) {
-            return keyAlgorithm.equals(((KeyAlgorithmCriterion) obj).keyAlgorithm);
+        if (obj instanceof KeyAlgorithmCriterion algcrit) {
+            return keyAlgorithm.equals(algcrit.keyAlgorithm);
         }
 
         return false;
     }
 
+    /**
+     * Static method to validate and return null algorithm.
+     * 
+     * @param algorithm candidate
+     * 
+     * @return the input parameter if not null/empty after trimming
+     */
+    @Nonnull @NotEmpty private static String validateAlgorithm(@Nonnull final String algorithm) {
+        final String trimmed = StringSupport.trimOrNull(algorithm);
+
+        return Constraint.isNotNull(trimmed, "Key algorithm criterion cannot be null or empty");
+    }
+    
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyLengthCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyLengthCriterion.java
index 199907b70..82af7bdcb 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyLengthCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyLengthCriterion.java
@@ -17,9 +17,6 @@
 
 package org.opensaml.security.criteria;
 
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.Criterion;
 
 /**
@@ -28,14 +25,14 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class KeyLengthCriterion implements Criterion {
     
     /** Key length of resolved credentials. */
-    private Integer keyLength;
+    private int keyLength;
     
     /**
      * Constructor.
      *
      * @param length key length 
      */
-    public KeyLengthCriterion(@Nonnull final Integer length) {
+    public KeyLengthCriterion(final int length) {
         setKeyLength(length);
     }
 
@@ -44,7 +41,7 @@ public final class KeyLengthCriterion implements Criterion {
      * 
      * @return Returns the keyLength.
      */
-    @Nonnull public Integer getKeyLength() {
+    public int getKeyLength() {
         return keyLength;
     }
 
@@ -53,9 +50,7 @@ public final class KeyLengthCriterion implements Criterion {
      * 
      * @param length The keyLength to set.
      */
-    public void setKeyLength(@Nonnull final Integer length) {
-        Constraint.isNotNull(length, "Key length criteria value cannot be null");
-
+    public void setKeyLength(final int length) {
         keyLength = length;
     }
     
@@ -70,7 +65,7 @@ public final class KeyLengthCriterion implements Criterion {
 
     /** {@inheritDoc} */
     public int hashCode() {
-        return keyLength.hashCode();
+        return Integer.valueOf(keyLength).hashCode();
     }
 
     /** {@inheritDoc} */
@@ -83,11 +78,11 @@ public final class KeyLengthCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof KeyLengthCriterion) {
-            return keyLength.equals(((KeyLengthCriterion) obj).keyLength);
+        if (obj instanceof KeyLengthCriterion lencrit) {
+            return keyLength == lencrit.keyLength;
         }
 
         return false;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyNameCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyNameCriterion.java
index c2999c4d4..2dfa127dd 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyNameCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/KeyNameCriterion.java
@@ -19,6 +19,7 @@ package org.opensaml.security.criteria;
 
 import javax.annotation.Nonnull;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.resolver.Criterion;
@@ -30,15 +31,15 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class KeyNameCriterion implements Criterion {
 
     /** Key name of resolved credentials.  */
-    private String keyName;
+    @Nonnull @NotEmpty private String keyName;
     
     /**
      * Constructor.
      *
      * @param name key name
      */
-    public KeyNameCriterion(@Nonnull final String name) {
-        setKeyName(name);
+    public KeyNameCriterion(@Nonnull @NotEmpty final String name) {
+        keyName = validateKeyName(name);
     }
 
     /**
@@ -46,7 +47,7 @@ public final class KeyNameCriterion implements Criterion {
      * 
      * @return Returns the keyName.
      */
-    @Nonnull public String getKeyName() {
+    @Nonnull @NotEmpty public String getKeyName() {
         return keyName;
     }
 
@@ -55,11 +56,8 @@ public final class KeyNameCriterion implements Criterion {
      * 
      * @param name The keyName to set.
      */
-    public void setKeyName(@Nonnull final String name) {
-        final String trimmed = StringSupport.trimOrNull(name);
-        Constraint.isNotNull(trimmed, "Key name criteria value cannot be null or empty");
-
-        keyName = trimmed;
+    public void setKeyName(@Nonnull @NotEmpty final String name) {
+        keyName = validateKeyName(name);
     }
     
     /** {@inheritDoc} */
@@ -86,11 +84,24 @@ public final class KeyNameCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof KeyNameCriterion) {
-            return keyName.equals(((KeyNameCriterion) obj).keyName);
+        if (obj instanceof KeyNameCriterion namecrit) {
+            return keyName.equals(namecrit.keyName);
         }
 
         return false;
     }
 
+    /**
+     * Validate key name criterion.
+     * 
+     * @param name name to check
+     * 
+     * @return the input if non-null/empty
+     */
+    @Nonnull @NotEmpty public String validateKeyName(@Nonnull @NotEmpty final String name) {
+        final String trimmed = StringSupport.trimOrNull(name);
+
+        return Constraint.isNotNull(trimmed, "Key name criterion value cannot be null or empty");
+    }
+    
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PeerEntityIDCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PeerEntityIDCriterion.java
index acfcf78e8..cfcfd4c7e 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PeerEntityIDCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PeerEntityIDCriterion.java
@@ -19,6 +19,7 @@ package org.opensaml.security.criteria;
 
 import javax.annotation.Nonnull;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.resolver.Criterion;
@@ -35,15 +36,15 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class PeerEntityIDCriterion implements Criterion {
     
     /** Peer entity ID criteria. */
-    private String peerID;
+    @Nonnull @NotEmpty private String peerID;
     
     /**
     * Constructor.
      *
      * @param peer the entity ID which is the peer relative to a primary entity ID
      */
-    public PeerEntityIDCriterion(@Nonnull final String peer) {
-        setPeerID(peer);
+    public PeerEntityIDCriterion(@Nonnull @NotEmpty final String peer) {
+        peerID = validatePeerID(peer);
     }
 
     /**
@@ -51,7 +52,7 @@ public final class PeerEntityIDCriterion implements Criterion {
      * 
      * @return the peer entity ID.
      */
-    @Nonnull public String getPeerID() {
+    @Nonnull @NotEmpty public String getPeerID() {
         return peerID;
     }
 
@@ -60,11 +61,8 @@ public final class PeerEntityIDCriterion implements Criterion {
      * 
      * @param peer The peerID to set.
      */
-    public void setPeerID(@Nonnull final String peer) {
-        final String trimmed = StringSupport.trimOrNull(peer);
-        Constraint.isNotNull(trimmed, "Peer entity ID criteria cannot be null");
-        
-        peerID = trimmed;
+    public void setPeerID(@Nonnull @NotEmpty final String peer) {
+        peerID = validatePeerID(peer);
     }
     
     /** {@inheritDoc} */
@@ -91,11 +89,24 @@ public final class PeerEntityIDCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof PeerEntityIDCriterion) {
-            return peerID.equals(((PeerEntityIDCriterion) obj).peerID);
+        if (obj instanceof PeerEntityIDCriterion peercrit) {
+            return peerID.equals(peercrit.peerID);
         }
 
         return false;
     }
     
+    /**
+     * Validate peer ID criterion.
+     * 
+     * @param peer ID to check
+     * 
+     * @return the input if non-null/empty
+     */
+    @Nonnull @NotEmpty public String validatePeerID(@Nonnull @NotEmpty final String peer) {
+        final String trimmed = StringSupport.trimOrNull(peer);
+
+        return Constraint.isNotNull(trimmed, "Peer entityID criterion value cannot be null or empty");
+    }
+
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PublicKeyCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PublicKeyCriterion.java
index 129d7d9b8..1295c4643 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PublicKeyCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/PublicKeyCriterion.java
@@ -30,7 +30,7 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class PublicKeyCriterion implements Criterion {
 
     /** Specifier of public key associated with resolved credentials. */
-    private PublicKey publicKey;
+    @Nonnull private PublicKey publicKey;
     
     /**
      * Constructor.
@@ -38,7 +38,7 @@ public final class PublicKeyCriterion implements Criterion {
      * @param pubKey public key
      */
     public PublicKeyCriterion(@Nonnull final PublicKey pubKey) {
-        setPublicKey(pubKey);
+        publicKey = Constraint.isNotNull(pubKey, "Public key criterion value cannot be null");
     }
     
     /**
@@ -56,9 +56,7 @@ public final class PublicKeyCriterion implements Criterion {
      * @param key The publicKey to set.
      */
     public void setPublicKey(@Nonnull final PublicKey key) {
-        Constraint.isNotNull(key, "Public key criteria value cannot be null");
-
-        publicKey = key;
+        publicKey = Constraint.isNotNull(key, "Public key criterion value cannot be null");
     }
     
     /** {@inheritDoc} */
@@ -85,8 +83,8 @@ public final class PublicKeyCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof PublicKeyCriterion) {
-            return publicKey.equals(((PublicKeyCriterion) obj).publicKey);
+        if (obj instanceof PublicKeyCriterion keycrit) {
+            return publicKey.equals(keycrit.publicKey);
         }
 
         return false;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/UsageCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/UsageCriterion.java
index b65545423..ccb508ed9 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/UsageCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/UsageCriterion.java
@@ -32,7 +32,7 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class UsageCriterion implements Criterion {
    
     /** Key usage type of resolved credentials. */
-    private UsageType credUsage;
+    @Nonnull private UsageType credUsage;
     
     /**
     * Constructor.
@@ -40,7 +40,11 @@ public final class UsageCriterion implements Criterion {
      * @param usage the usage for which a credential is intended
      */
     public UsageCriterion(@Nullable final UsageType usage) {
-        setUsage(usage);
+        if (usage != null) {
+            credUsage = usage;
+        } else {
+            credUsage = UsageType.UNSPECIFIED;
+        }
     }
 
     /**
@@ -89,8 +93,8 @@ public final class UsageCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof UsageCriterion) {
-            return credUsage.equals(((UsageCriterion) obj).credUsage);
+        if (obj instanceof UsageCriterion usagecrit) {
+            return credUsage.equals(usagecrit.credUsage);
         }
 
         return false;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/package-info.java
index 2608d3170..a700cc8e8 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/criteria/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/criteria/package-info.java
@@ -25,4 +25,7 @@
  * which may have general applicability throughout the library. Criterion implementations which are more
  * specialized in nature may be found in other packages, such as {@link org.opensaml.security.x509}.</p>
  */
-package org.opensaml.security.criteria;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.criteria;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/KeySupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/KeySupport.java
index d1d6408d7..7cf6bafba 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/KeySupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/KeySupport.java
@@ -65,12 +65,12 @@ import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.collection.LazyMap;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.bouncycastle.jcajce.provider.asymmetric.util.EC5Util;
 import org.cryptacular.util.KeyPairUtil;
 import org.opensaml.security.SecurityException;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.io.ByteStreams;
 import com.google.common.io.Files;
@@ -84,7 +84,7 @@ public final class KeySupport {
     @Nonnull private static final Logger LOG = LoggerFactory.getLogger(KeySupport.class);
 
     /** Maps key algorithms to the signing algorithm used in the key matching function. */
-    private static Map<String, String> keyMatchAlgorithms;
+    @Nonnull private static final Map<String, String> keyMatchAlgorithms;
 
     /** Constructor. */
     private KeySupport() {
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java
index 88ba49fcd..bf447b016 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/SigningUtil.java
@@ -32,9 +32,9 @@ import org.opensaml.security.SecurityException;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialSupport;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A utility class for computing and verifying raw signatures and MAC values.
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/DHSupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/DHSupport.java
index e03460e0e..000e887c9 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/DHSupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/DHSupport.java
@@ -37,9 +37,9 @@ import org.bouncycastle.asn1.x9.DomainParameters;
 import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.security.crypto.KeySupport;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Cryptography support related to Elliptic Curve.
@@ -47,7 +47,7 @@ import net.shibboleth.shared.logic.Constraint;
 public final class DHSupport {
     
     /** Logger. */
-    private static final Logger LOG = LoggerFactory.getLogger(DHSupport.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(DHSupport.class);
     
     /** Constructor. */
     private DHSupport() { }
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/package-info.java
index f6f3750a6..a9fddc372 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/dh/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Support for Diffie-Hellman cryptography. */
-package org.opensaml.security.crypto.dh;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.crypto.dh;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/ECSupport.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/ECSupport.java
index 2b45ede52..c7f0622d8 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/ECSupport.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/ECSupport.java
@@ -46,11 +46,12 @@ import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.crypto.ec.curves.BasicNamedCurve;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Cryptography support related to Elliptic Curve.
@@ -58,7 +59,7 @@ import net.shibboleth.shared.logic.Constraint;
 public final class ECSupport {
     
     /** Logger. */
-    private static final Logger LOG = LoggerFactory.getLogger(ECSupport.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(ECSupport.class);
     
     /** Constructor. */
     private ECSupport() { }
@@ -310,7 +311,7 @@ public final class ECSupport {
      * 
      * @return the set of curves known to Bouncy Castle
      */
-    @Nonnull @NonnullElements @NotLive
+    @Nonnull @Unmodifiable @NotLive
     public static Set<NamedCurve> getCurvesFromBouncyCastle() {
         final HashSet<NamedCurve> curves = new HashSet<>();
         
@@ -341,7 +342,7 @@ public final class ECSupport {
             }
         }
         
-        return curves;
+        return CollectionSupport.copyToSet(curves);
     }
 
 } 
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/EnhancedECParameterSpec.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/EnhancedECParameterSpec.java
index 9c4030230..413c4f37d 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/EnhancedECParameterSpec.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/EnhancedECParameterSpec.java
@@ -31,7 +31,7 @@ import javax.annotation.Nullable;
 public class EnhancedECParameterSpec extends ECParameterSpec {
     
     /** The original instance. */
-    private final ECParameterSpec original;
+    @Nonnull private final ECParameterSpec original;
     
     /**
      * Constructor.
@@ -63,8 +63,7 @@ public class EnhancedECParameterSpec extends ECParameterSpec {
             return true;
         }
         
-        if (obj instanceof ECParameterSpec) {
-            final ECParameterSpec other = (ECParameterSpec) obj;
+        if (obj instanceof ECParameterSpec other) {
             // Copying Santuario's logic here.  It seems curve's ECField is an interface and the impls
             // don't obviously take into account the field size equality.  This field size compare is maybe
             // redundant with ECField.equals(), but eval it explicitly to be safe.
@@ -79,4 +78,4 @@ public class EnhancedECParameterSpec extends ECParameterSpec {
         return false;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurve.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurve.java
index a1a5e093c..bdef1e900 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurve.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurve.java
@@ -61,8 +61,8 @@ public interface NamedCurve {
      * 
      * @return the key length, in bits
      */
-    @Nonnull default Integer getKeyLength() {
+    default int getKeyLength() {
         return getParameterSpec().getCurve().getField().getFieldSize();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurveRegistry.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurveRegistry.java
index 8dbd1cc31..7f75a7ca7 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurveRegistry.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/NamedCurveRegistry.java
@@ -26,12 +26,12 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 /**
@@ -40,19 +40,19 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class NamedCurveRegistry {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(NamedCurveRegistry.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(NamedCurveRegistry.class);
     
     /** Index by OID. */
-    private Map<String, NamedCurve> byOID;
+    @Nonnull private final Map<String, NamedCurve> byOID;
     
     /** Index by URI. */
-    private Map<String, NamedCurve> byURI;
+    @Nonnull private final Map<String, NamedCurve> byURI;
     
     /** Index by name. */
-    private Map<String, NamedCurve> byName;
+    @Nonnull private final Map<String, NamedCurve> byName;
     
     /** Index by {@link EnhancedECParameterSpec}. */
-    private Map<EnhancedECParameterSpec, NamedCurve> byParamSpec;
+    @Nonnull private final Map<EnhancedECParameterSpec, NamedCurve> byParamSpec;
     
     
     /**
@@ -166,9 +166,10 @@ public class NamedCurveRegistry {
      * 
      * @return the set of registered curves
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive
+    @SuppressWarnings("null")
+    @Nonnull @Unmodifiable @NotLive
     public Set<NamedCurve> getRegisteredCurves() {
-        return Set.copyOf(byOID.values());
+        return CollectionSupport.copyToSet(byOID.values());
     }
     
     /**
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/AbstractNamedCurve.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/AbstractNamedCurve.java
index 96aefca76..fb0c91650 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/AbstractNamedCurve.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/AbstractNamedCurve.java
@@ -30,13 +30,13 @@ import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.crypto.ec.ECSupport;
 import org.opensaml.security.crypto.ec.NamedCurve;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.MoreObjects;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Abstract base class for implementations of {@link NamedCurve}.
@@ -44,7 +44,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
 public abstract class AbstractNamedCurve extends AbstractInitializableComponent implements NamedCurve {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(this.getClass());
+    @Nonnull private final Logger log = LoggerFactory.getLogger(this.getClass());
     
     /** Instance of {@link ECParameterSpec} corresponding to the curve. */
     @NonnullAfterInit private ECParameterSpec paramSpec;
@@ -52,6 +52,7 @@ public abstract class AbstractNamedCurve extends AbstractInitializableComponent
     /** {@inheritDoc} */
     @Nonnull public ECParameterSpec getParameterSpec() {
         checkComponentActive();
+        assert paramSpec != null;
         return paramSpec;
     }
 
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/package-info.java
index 4e8b82d3f..84117da45 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/curves/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Implementations of {@link org.opensaml.security.crypto.ec.NamedCurve} used with Elliptic-Curve cryptography. */
-package org.opensaml.security.crypto.ec.curves;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.crypto.ec.curves;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/package-info.java
index 9fee76eb3..6247fa652 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/ec/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Support for Elliptic-Curve cryptography. */
-package org.opensaml.security.crypto.ec;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.crypto.ec;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/package-info.java
index 205df7cf7..2c9f745c4 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** General cryptographic functionality. */
-package org.opensaml.security.crypto;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.crypto;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
index 959f20aef..9a4bccbb5 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfiguration.java
@@ -36,42 +36,42 @@ public interface HttpClientSecurityConfiguration {
      * 
      * @return the credentials provider, or null
      */
-    @Nullable public CredentialsProvider getCredentialsProvider();
+    @Nullable CredentialsProvider getCredentialsProvider();
     
     /**
      * Sets the optional trust engine used in evaluating server TLS credentials.
      * 
      * @return the trust engine instance to use, or null
      */
-    @Nullable public TrustEngine<? super X509Credential> getTLSTrustEngine();
+    @Nullable TrustEngine<? super X509Credential> getTLSTrustEngine();
     
     /**
      * Get the optional list of TLS protocols. 
      * 
      * @return the TLS protocols, or null
      */
-    @Nullable public List<String> getTLSProtocols();
+    @Nullable List<String> getTLSProtocols();
     
     /**
      * Get the optional list of TLS cipher suites.
      * 
      * @return the list of TLS cipher suites, or null
      */
-    @Nullable public List<String> getTLSCipherSuites();
+    @Nullable List<String> getTLSCipherSuites();
     
     /**
      * Get the optional hostname verifier.
      * 
      * @return the hostname verifier, or null
      */
-    @Nullable public HostnameVerifier getHostnameVerifier();
+    @Nullable HostnameVerifier getHostnameVerifier();
     
     /**
      * Get the optional client TLS credential.
      * 
      * @return the client TLS credential, or null
      */
-    @Nullable public X509Credential getClientTLSCredential();
+    @Nullable X509Credential getClientTLSCredential();
     
     /**
      * Get the flag indicating whether failure of server TLS trust engine evaluation should be treated as 
@@ -85,6 +85,6 @@ public interface HttpClientSecurityConfiguration {
      * @return true if fatal, false if non-fatal, null if not explicitly configured
      * 
      */
-    @Nullable public Boolean isServerTLSFailureFatal();
+    @Nullable Boolean isServerTLSFailureFatal();
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java
index 007300e0b..9b9614d55 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityConfigurationCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -35,15 +34,15 @@ import net.shibboleth.shared.resolver.Criterion;
 public class HttpClientSecurityConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    @Nonnull @NonnullElements private List<HttpClientSecurityConfiguration> configs;
+    @Nonnull private List<HttpClientSecurityConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public HttpClientSecurityConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
-            List<HttpClientSecurityConfiguration> configurations) {
+    public HttpClientSecurityConfigurationCriterion(
+            @Nonnull @NotEmpty final List<HttpClientSecurityConfiguration> configurations) {
         Constraint.isNotNull(configurations, "List of configurations cannot be null");
         configs = CollectionSupport.copyToList(configurations);
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -55,8 +54,8 @@ public class HttpClientSecurityConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public HttpClientSecurityConfigurationCriterion(@Nonnull @NonnullElements  @NotEmpty final
-            HttpClientSecurityConfiguration... configurations) {
+    public HttpClientSecurityConfigurationCriterion(
+            @Nonnull @NotEmpty final HttpClientSecurityConfiguration... configurations) {
         Constraint.isNotNull(configurations, "List of configurations cannot be null");
         configs = CollectionSupport.listOf(configurations);
         Constraint.isNotEmpty(configs, "At least one configuration is required");
@@ -66,8 +65,7 @@ public class HttpClientSecurityConfigurationCriterion implements Criterion {
      * Get the list of configuration instances.
      * @return the list of configuration instances
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<HttpClientSecurityConfiguration> getConfigurations() {
+    @Nonnull @NotEmpty @NotLive @Unmodifiable public List<HttpClientSecurityConfiguration> getConfigurations() {
         return configs;
     }
     
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
index 94af2f80b..4517530bd 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/HttpClientSecurityParameters.java
@@ -21,6 +21,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.net.ssl.HostnameVerifier;
 
@@ -81,9 +82,12 @@ public class HttpClientSecurityParameters {
      * Set an instance of {@link CredentialsProvider} used for authentication by the HttpClient instance.
      * 
      * @param provider the credentials provider
+     * 
+     * @return this object
      */
-    public void setCredentialsProvider(@Nullable final CredentialsProvider provider) {
+    @Nonnull public HttpClientSecurityParameters setCredentialsProvider(@Nullable final CredentialsProvider provider) {
         credentialsProvider = provider;
+        return this;
     }
     
     /**
@@ -102,10 +106,14 @@ public class HttpClientSecurityParameters {
      * 
      * @param cache the auth cache
      * 
+     * @return this object
+     * 
      * @since 3.4.0
      */
-    public void setAuthCache(@Nullable final AuthCache cache) {
+    @Nonnull public HttpClientSecurityParameters setAuthCache(@Nullable final AuthCache cache) {
         authCache = cache;
+        
+        return this;
     }
     
     
@@ -140,8 +148,11 @@ public class HttpClientSecurityParameters {
      * 
      * @param credentials the username and password credentials
      * @param scope the HTTP client auth scope with which to scope the credentials, may be null
+     * 
+     * @return this object
      */
-    public void setBasicCredentialsWithScope(@Nullable final UsernamePasswordCredentials credentials,
+    @Nonnull public HttpClientSecurityParameters setBasicCredentialsWithScope(
+            @Nullable final UsernamePasswordCredentials credentials,
             @Nullable final AuthScope scope) {
 
         if (credentials != null) {
@@ -156,6 +167,7 @@ public class HttpClientSecurityParameters {
             credentialsProvider = null;
         }
 
+        return this;
     }
     
     /**
@@ -171,9 +183,14 @@ public class HttpClientSecurityParameters {
      * Sets the optional trust engine used in evaluating server TLS credentials.
      * 
      * @param engine the trust engine instance to use
+     * 
+     * @return this object
      */
-    public void setTLSTrustEngine(@Nullable final TrustEngine<? super X509Credential> engine) {
+    @Nonnull public HttpClientSecurityParameters setTLSTrustEngine(
+            @Nullable final TrustEngine<? super X509Credential> engine) {
         tlsTrustEngine = engine;
+        
+        return this;
     }
 
     /**
@@ -189,9 +206,13 @@ public class HttpClientSecurityParameters {
      * Set the optional criteria set used in evaluating server TLS credentials.
      * 
      * @param criteriaSet the new criteria set instance to use
+     * 
+     * @return this object
      */
-    public void setTLSCriteriaSet(@Nullable final CriteriaSet criteriaSet) {
+    @Nonnull public HttpClientSecurityParameters setTLSCriteriaSet(@Nullable final CriteriaSet criteriaSet) {
         tlsCriteriaSet = criteriaSet;
+        
+        return this;
     }
 
     /**
@@ -207,12 +228,16 @@ public class HttpClientSecurityParameters {
      * Set the optional list of TLS protocols. 
      * 
      * @param protocols the TLS protocols or null
+     * 
+     * @return this object
      */
-    public void setTLSProtocols(@Nullable final Collection<String> protocols) {
+    @Nonnull public HttpClientSecurityParameters setTLSProtocols(@Nullable final Collection<String> protocols) {
         tlsProtocols = new ArrayList<>(StringSupport.normalizeStringCollection(protocols));
         if (tlsProtocols.isEmpty()) {
             tlsProtocols = null;
         }
+        
+        return this;
     }
 
     /**
@@ -228,12 +253,16 @@ public class HttpClientSecurityParameters {
      * Set the optional list of TLS cipher suites.
      * 
      * @param cipherSuites the TLS cipher suites, or null
+     * 
+     * @return this object
      */
-    public void setTLSCipherSuites(@Nullable final Collection<String> cipherSuites) {
+    @Nonnull public HttpClientSecurityParameters setTLSCipherSuites(@Nullable final Collection<String> cipherSuites) {
         tlsCipherSuites = new ArrayList<>(StringSupport.normalizeStringCollection(cipherSuites));
         if (tlsCipherSuites.isEmpty()) {
             tlsCipherSuites = null;
         }
+        
+        return this;
     }
 
     /**
@@ -249,9 +278,13 @@ public class HttpClientSecurityParameters {
      * Set the optional hostname verifier.
      * 
      * @param verifier the hostname verifier, or null
+     * 
+     * @return this object
      */
-    public void setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
+    @Nonnull public HttpClientSecurityParameters setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
         hostnameVerifier = verifier;
+        
+        return this;
     }
 
     /**
@@ -267,9 +300,13 @@ public class HttpClientSecurityParameters {
      * Set the optional client TLS credential.
      * 
      * @param credential the client TLS credential, or null
+     * 
+     * @return this object
      */
-    public void setClientTLSCredential(@Nullable final X509Credential credential) {
+    @Nonnull public HttpClientSecurityParameters setClientTLSCredential(@Nullable final X509Credential credential) {
         clientTLSCredential = credential;
+        
+        return this;
     }
 
     /**
@@ -299,9 +336,12 @@ public class HttpClientSecurityParameters {
      * 
      * @param flag true if fatal, false if non-fatal, null if not explicitly configured
      * 
+     * @return this object
      */
-    public void setServerTLSFailureFatal(@Nullable final Boolean flag) {
-        this.serverTLSFailureFatal = flag ;
+    @Nonnull public HttpClientSecurityParameters setServerTLSFailureFatal(@Nullable final Boolean flag) {
+        serverTLSFailureFatal = flag;
+        
+        return this;
     }
 
 }
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java
index a3296da09..f49223a93 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/TLSCriteriaSetCriterion.java
@@ -31,7 +31,7 @@ import net.shibboleth.shared.resolver.Criterion;
 public final class TLSCriteriaSetCriterion implements Criterion {
    
     /** TLS CriteriaSet data. */
-    private CriteriaSet criteriaSet;
+    @Nonnull private CriteriaSet criteriaSet;
     
     /**
     * Constructor.
@@ -75,8 +75,8 @@ public final class TLSCriteriaSetCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof TLSCriteriaSetCriterion) {
-            return criteriaSet.equals(((TLSCriteriaSetCriterion) obj).criteriaSet);
+        if (obj instanceof TLSCriteriaSetCriterion tlscrit) {
+            return criteriaSet.equals(tlscrit.criteriaSet);
         }
 
         return false;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/package-info.java
index fc366dec3..18b448e95 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/httpclient/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Security API support for Apache HttpClient. */
-package org.opensaml.security.httpclient;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.httpclient;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java
index 674d2c303..bb94a889e 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ClientTLSSecurityParametersContext.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.security.messaging;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.BaseContext;
@@ -51,9 +52,13 @@ public final class ClientTLSSecurityParametersContext extends BaseContext {
      * <p>Defaults to: <code>true</code></p>
      * 
      * @param flag true if should evaluate, false otherwise
+     * 
+     * @return this context
      */
-    public void setEvaluateClientCertificate(final boolean flag) {
+    @Nonnull public ClientTLSSecurityParametersContext setEvaluateClientCertificate(final boolean flag) {
         evaluateClientCertificate = flag;
+        
+        return this;
     }
 
     /**
@@ -69,9 +74,14 @@ public final class ClientTLSSecurityParametersContext extends BaseContext {
      * Set an instance of {@link ClientTLSValidationParameters}.
      * 
      * @param params the parameters instance to set, may be null
+     * 
+     * @return this context
      */
-    public void setValidationParameters(@Nullable final ClientTLSValidationParameters params) {
-        this.validationParameters = params;
+    @Nonnull public ClientTLSSecurityParametersContext setValidationParameters(
+            @Nullable final ClientTLSValidationParameters params) {
+        validationParameters = params;
+        
+        return this;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
index d4f902332..74823bb5d 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/HttpClientSecurityContext.java
@@ -19,6 +19,7 @@ package org.opensaml.security.messaging;
 
 import java.util.function.Function;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.messaging.context.BaseContext;
@@ -52,9 +53,14 @@ public final class HttpClientSecurityContext extends BaseContext {
      * Set the {@link HttpClientSecurityParameters} instance.
      * 
      * @param parameters the parameters instance, or null
+     * 
+     * @return this context
      */
-    public void setSecurityParameters(@Nullable final HttpClientSecurityParameters parameters) {
+    @Nonnull public HttpClientSecurityContext setSecurityParameters(
+            @Nullable final HttpClientSecurityParameters parameters) {
         securityParameters = parameters;
+        
+        return this;
     }
 
     /**
@@ -70,9 +76,14 @@ public final class HttpClientSecurityContext extends BaseContext {
      * Set the TLS criteria strategy function.
      * 
      * @param strategy the strategy function instance, or null
+     * 
+     * @return this context
      */
-    public void setTLSCriteriaSetStrategy(@Nullable final Function<MessageContext,CriteriaSet> strategy) {
+    @Nonnull public HttpClientSecurityContext setTLSCriteriaSetStrategy(
+            @Nullable final Function<MessageContext,CriteriaSet> strategy) {
         tlsCriteriaSetStrategy = strategy;
+        
+        return this;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
index acc59cee0..0a7f9a2d3 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/ServletRequestX509CredentialAdapter.java
@@ -33,7 +33,6 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.x509.X509Credential;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -57,7 +56,7 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
     @Nonnull private X509Certificate cert;
     
     /** The certificate chain. */
-    @Nonnull @NonnullElements private List<X509Certificate> certChain;
+    @Nonnull private List<X509Certificate> certChain;
 
     /**
      * Constructor.
@@ -67,7 +66,7 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
      * @throws SecurityException if request does not contain an X.509 client certificate in 
      *  request attribute 'javax.servlet.request.X509Certificate'
      */
-    public ServletRequestX509CredentialAdapter(final ServletRequest request) throws SecurityException {
+    public ServletRequestX509CredentialAdapter(@Nonnull final ServletRequest request) throws SecurityException {
         X509Certificate[] chain = (X509Certificate[]) request.getAttribute(JAKARTA_X509_CERT_REQUEST_ATTRIBUTE);
         
         if (chain == null || chain.length == 0) {
@@ -94,12 +93,12 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<X509Certificate> getEntityCertificateChain() {
+    @Nonnull @Unmodifiable @NotLive public Collection<X509Certificate> getEntityCertificateChain() {
         return certChain;
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
+    @Nullable @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
         return null;
     }
 
@@ -108,4 +107,4 @@ public class ServletRequestX509CredentialAdapter extends AbstractCredential impl
         return getEntityCertificate().getPublicKey();
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/package-info.java
index f6ef87994..adfb75201 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/messaging/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/messaging/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Messaging-related security classes. */
-package org.opensaml.security.messaging;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.messaging;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/package-info.java
index d2b66618b..1fc0769aa 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/package-info.java
@@ -19,4 +19,7 @@
  * Interfaces and classes used in representing cryptographic credentials,
  * evaluating the trustworthiness of security of tokens, etc.
  */
-package org.opensaml.security;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/trust/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/trust/package-info.java
index 24eb25230..87db0c82f 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/trust/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/trust/package-info.java
@@ -19,4 +19,7 @@
  * Interfaces and classes used to evaluate the trustworthiness and validity of
  * {@link org.opensaml.security.credential.Credential}s.
  */
-package org.opensaml.security.trust;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.trust;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
index df119f4df..53ad3b752 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/BasicX509Credential.java
@@ -31,7 +31,6 @@ import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.credential.Credential;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -47,10 +46,10 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
     @Nonnull private X509Certificate entityCert;
 
     /** Entity certificate chain, must include entity certificate. */
-    @Nullable @NonnullElements private Collection<X509Certificate> entityCertChain;
+    @Nullable private Collection<X509Certificate> entityCertChain;
 
     /** CRLs for this credential. */
-    @Nullable @NonnullElements private Collection<X509CRL> crls;
+    @Nullable private Collection<X509CRL> crls;
     
     /**
      * Constructor.
@@ -82,7 +81,7 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
+    @Nullable @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
         return crls;
     }
 
@@ -91,7 +90,7 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
      * 
      * @param newCRLs CRLs for this credential
      */
-    public void setCRLs(@Nullable @NonnullElements final Collection<X509CRL> newCRLs) {
+    public void setCRLs(@Nullable final Collection<X509CRL> newCRLs) {
         if (newCRLs != null) {
             crls = CollectionSupport.copyToList(newCRLs);
         } else {
@@ -132,13 +131,12 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
     }
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<X509Certificate> getEntityCertificateChain() {
+    @Nonnull @Unmodifiable @NotLive public Collection<X509Certificate> getEntityCertificateChain() {
         synchronized(this) {
-            if (entityCertChain == null) {
-                return CollectionSupport.singletonList(entityCert);
+            if (entityCertChain != null) {
+                return entityCertChain;
             }
-            assert entityCertChain != null;
-            return entityCertChain;
+            return CollectionSupport.singletonList(entityCert);
         }
     }
 
@@ -149,7 +147,7 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
      * @param newCertificateChain entity certificate chain for this credential
      */
     public void setEntityCertificateChain(
-            @Nonnull @NotEmpty @NonnullElements final Collection<X509Certificate> newCertificateChain) {
+            @Nonnull @NotEmpty final Collection<X509Certificate> newCertificateChain) {
         Constraint.isNotNull(newCertificateChain, "Certificate chain collection cannot be null");
         Constraint.isNotEmpty(newCertificateChain, "Certificate chain collection cannot be empty");
         
@@ -178,4 +176,4 @@ public class BasicX509Credential extends BasicCredential implements X509Credenti
         throw new UnsupportedOperationException("An X509Credential may not contain a secret key");
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEngine.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEngine.java
index 15021f4d4..8784815a0 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEngine.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXTrustEngine.java
@@ -33,6 +33,6 @@ public interface PKIXTrustEngine<TokenType> extends TrustEngine<TokenType> {
      * 
      * @return the currently configured resolver instance
      */
-    @Nonnull public PKIXValidationInformationResolver getPKIXResolver();
+    @Nonnull PKIXValidationInformationResolver getPKIXResolver();
     
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java
index cf51221cb..6e981586a 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformation.java
@@ -36,20 +36,20 @@ public interface PKIXValidationInformation {
      * 
      * @return maximum allowable trust chain verification depth
      */
-    @Nullable public Integer getVerificationDepth();
+    @Nullable Integer getVerificationDepth();
 
     /**
      * Gets the certificate trust anchors used during PKIX validation.
      * 
      * @return trust anchors used during PKIX validation
      */
-    @Nullable @Unmodifiable @NotLive public Collection<X509Certificate> getCertificates();
+    @Nullable @Unmodifiable @NotLive Collection<X509Certificate> getCertificates();
 
     /**
      * Gets the CRLs used during PKIX validation.
      * 
      * @return CRLs used during PKIX validation
      */
-    @Nullable @Unmodifiable @NotLive public Collection<X509CRL> getCRLs();
+    @Nullable @Unmodifiable @NotLive Collection<X509CRL> getCRLs();
 
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
index 5d8bf46f2..60f1babe5 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationInformationResolver.java
@@ -22,7 +22,6 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -50,7 +49,7 @@ public interface PKIXValidationInformationResolver extends Resolver<PKIXValidati
      * @throws ResolverException thrown if there is an error resolving the trusted names
      * @throws UnsupportedOperationException thrown if this optional method is not supported by the implementation
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive Set<String> resolveTrustedNames(
+    @Nonnull @Unmodifiable @NotLive Set<String> resolveTrustedNames(
             @Nullable final CriteriaSet criteriaSet) throws ResolverException;
     
     /**
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
index 4c84e3d7b..987c6b67e 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
@@ -17,10 +17,6 @@
 
 package org.opensaml.security.x509;
 
-import javax.annotation.Nonnull;
-
-import net.shibboleth.shared.logic.Constraint;
-
 /**
  * Options which may be supplied to influence the processing behavior of a {@link PKIXTrustEvaluator}.
  */
@@ -36,7 +32,7 @@ public class PKIXValidationOptions {
     private boolean processCredentialCRLs;
     
     /** Default verification depth. */
-    @Nonnull private Integer defaultVerificationDepth;
+    private int defaultVerificationDepth;
 
     /** Constructor. */
     public PKIXValidationOptions() {
@@ -121,7 +117,7 @@ public class PKIXValidationOptions {
      * 
      * @return Returns the defaultVerificationDepth.
      */
-    @Nonnull public Integer getDefaultVerificationDepth() {
+    public int getDefaultVerificationDepth() {
         return defaultVerificationDepth;
     }
 
@@ -133,8 +129,8 @@ public class PKIXValidationOptions {
      * 
      * @param depth default verification depth to set
      */
-    public void setDefaultVerificationDepth(@Nonnull final Integer depth) {
-        defaultVerificationDepth = Constraint.isNotNull(depth, "Default verification depth cannot be null");
+    public void setDefaultVerificationDepth(final int depth) {
+        defaultVerificationDepth = depth;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/TrustedNamesCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/TrustedNamesCriterion.java
index 6f1536658..6c2487416 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/TrustedNamesCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/TrustedNamesCriterion.java
@@ -22,7 +22,6 @@ import java.util.Set;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -37,19 +36,15 @@ import net.shibboleth.shared.resolver.Criterion;
 public class TrustedNamesCriterion implements Criterion {
     
     /** The set of trusted names. */
-    @Nonnull @NonnullElements private Set<String> trustedNames;
+    @Nonnull private Set<String> trustedNames;
     
     /**
      * Constructor.
      *
      * @param names the set of trusted names
      */
-    public TrustedNamesCriterion(@Nullable @NonnullElements final Set<String> names)  {
-        if (names != null) {
-            trustedNames = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(names));
-        } else {
-            trustedNames = CollectionSupport.emptySet();
-        }
+    public TrustedNamesCriterion(@Nullable final Set<String> names)  {
+        trustedNames = processNames(names);
     }
     
     /**
@@ -57,7 +52,7 @@ public class TrustedNamesCriterion implements Criterion {
      * 
      * @return the set of trusted names
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<String> getTrustedNames() {
+    @Nonnull @NotLive @Unmodifiable public Set<String> getTrustedNames() {
         return trustedNames;
     }
     
@@ -66,12 +61,8 @@ public class TrustedNamesCriterion implements Criterion {
      * 
      * @param names the new trusted names
      */
-    public void setTrustedNames(@Nullable @NonnullElements final Set<String> names) {
-        if (names != null) {
-            trustedNames = CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(names));
-        } else {
-            trustedNames = CollectionSupport.emptySet();
-        }
+    public void setTrustedNames(@Nullable final Set<String> names) {
+        trustedNames = processNames(names);
     }
     
     /** {@inheritDoc} */
@@ -107,5 +98,20 @@ public class TrustedNamesCriterion implements Criterion {
 
         return false;
     }
+    
+    /**
+     * Sanitize input names.
+     * 
+     * @param names input names
+     * 
+     * @return sanitized set
+     */
+    @Nonnull @NotLive @Unmodifiable private Set<String> processNames(@Nullable final Set<String> names) {
+        if (names != null) {
+            return CollectionSupport.copyToSet(StringSupport.normalizeStringCollection(names));
+        } else {
+            return CollectionSupport.emptySet();
+        }
+    }
 
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X500DNHandler.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X500DNHandler.java
index 697519f33..0124ba463 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X500DNHandler.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X500DNHandler.java
@@ -29,10 +29,10 @@ import net.shibboleth.shared.annotation.constraint.NotEmpty;
 public interface X500DNHandler {
     
     /** Specifies the string format specified in RFC 1779. */
-    @Nonnull @NotEmpty public static final String FORMAT_RFC1779 = X500Principal.RFC1779;
+    @Nonnull @NotEmpty static final String FORMAT_RFC1779 = X500Principal.RFC1779;
     
     /** Specifies the string format specified in RFC 2253. */
-    @Nonnull @NotEmpty public static final String FORMAT_RFC2253 = X500Principal.RFC2253;
+    @Nonnull @NotEmpty static final String FORMAT_RFC2253 = X500Principal.RFC2253;
     
     /**
      * Parse the string representation of a name and build a new principal instance.
@@ -42,7 +42,7 @@ public interface X500DNHandler {
      * 
      * @throws IllegalArgumentException if the name value can not be parsed by the implementation
      */
-    @Nonnull public X500Principal parse(@Nonnull final String name);
+    @Nonnull X500Principal parse(@Nonnull final String name);
     
     /**
      * Parse the ASN.1 DER encoding representation of a name and build a new principal instance.
@@ -52,7 +52,7 @@ public interface X500DNHandler {
      * 
      * @throws IllegalArgumentException if the name value can not be parsed by the implementation
      */
-    @Nonnull public X500Principal parse(@Nonnull final byte[] name);
+    @Nonnull X500Principal parse(@Nonnull final byte[] name);
     
     /**
      * Returns a string representation of the X.500 distinguished name using the default format
@@ -61,7 +61,7 @@ public interface X500DNHandler {
      * @param principal the principal name instance to serialize
      * @return the serialized string name
      */
-    @Nonnull public String getName(@Nonnull final X500Principal principal);
+    @Nonnull String getName(@Nonnull final X500Principal principal);
     
     /**
      * Returns a string representation of the X.500 distinguished name using the specified format.
@@ -75,7 +75,7 @@ public interface X500DNHandler {
      * 
      * @throws IllegalArgumentException if the specified format is not understood by the implementation
      */
-    @Nonnull public String getName(@Nonnull final X500Principal principal, @Nonnull final String format);
+    @Nonnull String getName(@Nonnull final X500Principal principal, @Nonnull final String format);
     
     /**
      * Returns the distinguished name in ASN.1 DER encoded form.
@@ -83,7 +83,7 @@ public interface X500DNHandler {
      * @param principal the principal name instance to serialize
      * @return the serialized name in ASN.1 DER encoded form
      */
-    @Nonnull public byte[] getEncoded(@Nonnull final X500Principal principal);
+    @Nonnull byte[] getEncoded(@Nonnull final X500Principal principal);
     
     /**
      * Clone the handler. Implementations which maintain instance-specific configuration data, etc,
@@ -91,6 +91,6 @@ public interface X500DNHandler {
      * 
      * @return the cloned handler
      */
-    @Nonnull public X500DNHandler clone();
+    @Nonnull X500DNHandler clone();
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Credential.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Credential.java
index ee179e6e8..481bd6f47 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Credential.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Credential.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 
@@ -45,7 +44,7 @@ public interface X509Credential extends Credential {
      * 
      * @return the public key certificate for the entity
      */
-    @Nonnull public X509Certificate getEntityCertificate();
+    @Nonnull X509Certificate getEntityCertificate();
 
     /**
      * Gets an immutable collection of certificates in the entity's trust chain. The entity certificate is contained
@@ -53,12 +52,13 @@ public interface X509Credential extends Credential {
      * 
      * @return entities certificate chain
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Collection<X509Certificate> getEntityCertificateChain();
+    @Nonnull @Unmodifiable @NotLive Collection<X509Certificate> getEntityCertificateChain();
 
     /**
      * Gets a collection of CRLs associated with the credential.
      * 
      * @return CRLs associated with the credential
      */
-    @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509CRL> getCRLs();
+    @Nullable @Unmodifiable @NotLive Collection<X509CRL> getCRLs();
+
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java
index f67fe7301..1f19877e7 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509DigestCriterion.java
@@ -117,8 +117,7 @@ public final class X509DigestCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof X509DigestCriterion) {
-            final X509DigestCriterion other = (X509DigestCriterion) obj;
+        if (obj instanceof X509DigestCriterion other) {
             return algorithm.equals(other.algorithm) && Arrays.equals(x509digest, other.x509digest);
         }
 
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java
index 42dc7fe93..828e830a8 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509IssuerSerialCriterion.java
@@ -112,8 +112,7 @@ public final class X509IssuerSerialCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof X509IssuerSerialCriterion) {
-            final X509IssuerSerialCriterion other = (X509IssuerSerialCriterion) obj;
+        if (obj instanceof X509IssuerSerialCriterion other) {
             return issuerName.equals(other.issuerName) && serialNumber.equals(other.serialNumber);
         }
 
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
index cdcd6e3ee..a3b88a623 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectKeyIdentifierCriterion.java
@@ -89,8 +89,8 @@ public final class X509SubjectKeyIdentifierCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof X509SubjectKeyIdentifierCriterion) {
-            return subjectKeyIdentifier.equals(((X509SubjectKeyIdentifierCriterion) obj).subjectKeyIdentifier);
+        if (obj instanceof X509SubjectKeyIdentifierCriterion other) {
+            return subjectKeyIdentifier.equals(other.subjectKeyIdentifier);
         }
 
         return false;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java
index 7c1b5839c..f14afa148 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509SubjectNameCriterion.java
@@ -83,8 +83,8 @@ public final class X509SubjectNameCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof X509SubjectNameCriterion) {
-            return subjectName.equals(((X509SubjectNameCriterion) obj).subjectName);
+        if (obj instanceof X509SubjectNameCriterion other) {
+            return subjectName.equals(other.subjectName);
         }
 
         return false;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
index 6750ede43..a947c4674 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
@@ -45,6 +45,8 @@ import javax.annotation.Nullable;
 import javax.security.auth.x500.X500Principal;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.DecodingException;
 import net.shibboleth.shared.logic.Constraint;
@@ -162,7 +164,7 @@ public class X509Support {
      * 
      * @return the common names that appear in the DN in the order they appear, or null if the given DN is null
      */
-    @Nonnull public static List<String> getCommonNames(@Nonnull final X500Principal dn) {
+    @Nonnull @Unmodifiable @NotLive public static List<String> getCommonNames(@Nonnull final X500Principal dn) {
 
         LOG.debug("Extracting CNs from the following DN: {}", dn.toString());
         final RDNSequence attrs = NameReader.readX500Principal(dn);
@@ -184,7 +186,7 @@ public class X509Support {
      * 
      * @return the alt names, of the given type, within the cert
      */
-    @Nonnull public static List<?> getAltNames(@Nonnull final X509Certificate certificate,
+    @Nonnull @Unmodifiable @NotLive public static List<?> getAltNames(@Nonnull final X509Certificate certificate,
             @Nonnull @NotEmpty final Integer[] nameTypes) {
 
         final List<Object> altNames = new LinkedList<>();
@@ -215,7 +217,7 @@ public class X509Support {
      * 
      * @return list of subject names in the certificate
      */
-    @Nonnull public static List<?> getSubjectNames(@Nonnull final X509Certificate certificate,
+    @Nonnull @Unmodifiable @NotLive public static List<?> getSubjectNames(@Nonnull final X509Certificate certificate,
             @Nonnull @NotEmpty final Integer[] altNameTypes) {
         final List<Object> issuerNames = new LinkedList<>();
         
@@ -287,7 +289,8 @@ public class X509Support {
      * 
      * @since 1.2
      */
-    @Nonnull public static Collection<X509Certificate> decodeCertificates(@Nonnull final File certs)
+    @Nonnull @Unmodifiable @NotLive
+    public static Collection<X509Certificate> decodeCertificates(@Nonnull final File certs)
             throws CertificateException {
         Constraint.isNotNull(certs, "Input file cannot be null");
         if (!certs.exists()) {
@@ -314,7 +317,8 @@ public class X509Support {
      * 
      * @since 1.2
      */
-    @Nonnull public static Collection<X509Certificate> decodeCertificates(@Nonnull final InputStream certs)
+    @Nonnull @Unmodifiable @NotLive
+    public static Collection<X509Certificate> decodeCertificates(@Nonnull final InputStream certs)
             throws CertificateException {
         Constraint.isNotNull(certs, "Input Stream cannot be null");
         
@@ -336,7 +340,8 @@ public class X509Support {
      * 
      * @throws CertificateException thrown if the certificates cannot be decoded
      */
-    @Nonnull public static Collection<X509Certificate> decodeCertificates(@Nonnull final byte[] certs)
+    @Nonnull @Unmodifiable @NotLive
+    public static Collection<X509Certificate> decodeCertificates(@Nonnull final byte[] certs)
             throws CertificateException {
         try {
             return Arrays.asList(CertUtil.decodeCertificateChain(certs));
@@ -416,7 +421,8 @@ public class X509Support {
      * 
      * @since 1.2
      */
-    @Nonnull public static Collection<X509CRL> decodeCRLs(@Nonnull final File crls) throws CRLException{
+    @Nonnull @Unmodifiable @NotLive
+    public static Collection<X509CRL> decodeCRLs(@Nonnull final File crls) throws CRLException{
         Constraint.isNotNull(crls, "Input file cannot be null");
         if (!crls.exists()) {
             throw new CRLException("CRL file " + crls.getAbsolutePath() + " does not exist");
@@ -443,7 +449,8 @@ public class X509Support {
      * 
      * @since 1.2
      */
-    @Nonnull public static Collection<X509CRL> decodeCRLs(@Nonnull final InputStream crls) throws CRLException{
+    @Nonnull @Unmodifiable @NotLive
+    public static Collection<X509CRL> decodeCRLs(@Nonnull final InputStream crls) throws CRLException{
         Constraint.isNotNull(crls, "Input stream cannot be null");
         
         try {
@@ -464,7 +471,8 @@ public class X509Support {
      * 
      * @throws CRLException thrown if the CRLs can not be decoded
      */
-    @Nonnull public static Collection<X509CRL> decodeCRLs(@Nonnull final byte[] crls) throws CRLException {
+    @Nonnull @Unmodifiable @NotLive
+    public static Collection<X509CRL> decodeCRLs(@Nonnull final byte[] crls) throws CRLException {
         try {
             final CertificateFactory cf = CertificateFactory.getInstance("X.509");
             return (Collection<X509CRL>) cf.generateCRLs(new ByteArrayInputStream(crls));
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/package-info.java
index 7038d4cb0..630ad625c 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** X.509-based credential and trust classes. */
-package org.opensaml.security.x509;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.x509;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
index 9c24d3572..adbb30440 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 import org.opensaml.security.x509.InternalX500DNHandler;
 import org.opensaml.security.x509.X500DNHandler;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -104,7 +103,7 @@ public class CertificateNameOptions implements Cloneable {
      * 
      * @return Returns the subjectAltNames.
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<Integer> getSubjectAltNames() {
+    @Nonnull @NotLive @Unmodifiable public Set<Integer> getSubjectAltNames() {
         return subjectAltNames;
     }
     
@@ -114,7 +113,7 @@ public class CertificateNameOptions implements Cloneable {
      * 
      * @param names the set of types of subject alternative names
      */
-    public void setSubjectAltNames(@Nullable @NonnullElements final Set<Integer> names) {
+    public void setSubjectAltNames(@Nullable final Set<Integer> names) {
         if (names == null) {
             subjectAltNames = CollectionSupport.emptySet();
         } else {
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java
index 98b7604e5..0099313ea 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationConfigurationCriterion.java
@@ -21,7 +21,6 @@ import java.util.List;
 
 import javax.annotation.Nonnull;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -35,14 +34,14 @@ import net.shibboleth.shared.resolver.Criterion;
 public class ClientTLSValidationConfigurationCriterion implements Criterion {
     
     /** The list of configuration instances. */
-    @Nonnull @NonnullElements private List<ClientTLSValidationConfiguration> configs;
+    @Nonnull private List<ClientTLSValidationConfiguration> configs;
     
     /**
      * Constructor.
      *
      * @param configurations list of configuration instances
      */
-    public ClientTLSValidationConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
+    public ClientTLSValidationConfigurationCriterion(@Nonnull @NotEmpty final
             List<ClientTLSValidationConfiguration> configurations) {
         configs = CollectionSupport.copyToList(Constraint.isNotNull(configurations,
                 "List of configurations cannot be null"));
@@ -54,7 +53,7 @@ public class ClientTLSValidationConfigurationCriterion implements Criterion {
      *
      * @param configurations varargs array of configuration instances
      */
-    public ClientTLSValidationConfigurationCriterion(@Nonnull @NonnullElements @NotEmpty final
+    public ClientTLSValidationConfigurationCriterion(@Nonnull @NotEmpty final
             ClientTLSValidationConfiguration... configurations) {
         configs = CollectionSupport.listOf(Constraint.isNotNull(configurations,
                 "List of configurations cannot be null"));
@@ -65,8 +64,7 @@ public class ClientTLSValidationConfigurationCriterion implements Criterion {
      * Get the list of configuration instances.
      * @return the list of configuration instances
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable @NotEmpty
-    public List<ClientTLSValidationConfiguration> getConfigurations() {
+    @Nonnull @NotEmpty @NotLive @Unmodifiable public List<ClientTLSValidationConfiguration> getConfigurations() {
         return configs;
     }
     
@@ -97,8 +95,8 @@ public class ClientTLSValidationConfigurationCriterion implements Criterion {
             return false;
         }
 
-        if (obj instanceof ClientTLSValidationConfigurationCriterion) {
-            return configs.equals(((ClientTLSValidationConfigurationCriterion) obj).getConfigurations());
+        if (obj instanceof ClientTLSValidationConfigurationCriterion other) {
+            return configs.equals(other.getConfigurations());
         }
 
         return false;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParameters.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParameters.java
index 630828ae4..67e3d4caf 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParameters.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParameters.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.security.x509.tls;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.security.trust.TrustEngine;
@@ -46,9 +47,14 @@ public class ClientTLSValidationParameters {
      * Set a {@link TrustEngine} instance used to validate a client TLS {@link X509Credential}.
      * 
      * @param engine a trust engine instance, may be null
+     * 
+     * @return this object
      */
-    public void setX509TrustEngine(@Nullable final TrustEngine<? super X509Credential> engine) {
+    @Nonnull public ClientTLSValidationParameters setX509TrustEngine(
+            @Nullable final TrustEngine<? super X509Credential> engine) {
         x509TrustEngine = engine;
+        
+        return this;
     }
 
     /**
@@ -64,9 +70,14 @@ public class ClientTLSValidationParameters {
      * Set a {@link CertificateNameOptions} instance to use when evaluating a client TLS {@link X509Credential}.
      * 
      * @param options an options instance, may be null
+     * 
+     * @return this;
      */
-    public void setCertificateNameOptions(@Nullable final CertificateNameOptions options) {
+    @Nonnull public ClientTLSValidationParameters setCertificateNameOptions(
+            @Nullable final CertificateNameOptions options) {
         certificateNameOptions = options;
+        
+        return this;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java
index 9dba1f958..886c90b0b 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/ClientTLSValidationParametersResolver.java
@@ -23,7 +23,6 @@ import net.shibboleth.shared.resolver.Resolver;
 /**
  * An interface for components which resolve {@link ClientTLSValidationParameters} based on a {@link CriteriaSet}.
  */
-public interface ClientTLSValidationParametersResolver 
-    extends Resolver<ClientTLSValidationParameters, CriteriaSet> {
+public interface ClientTLSValidationParametersResolver extends Resolver<ClientTLSValidationParameters, CriteriaSet> {
 
 }
\ No newline at end of file
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/package-info.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/package-info.java
index 6afa4c309..aef449337 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/package-info.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** TLS security functionality. */
-package org.opensaml.security.x509.tls;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.x509.tls;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/config/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/config/impl/package-info.java
index abcf447da..3c2aab260 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/config/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/config/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Security configuration implementation classes.
  */
-package org.opensaml.security.config.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.config.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterion.java
index b3e59ed18..655e22e9e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterion.java
@@ -22,12 +22,12 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.opensaml.core.criterion.EntityIdCriterion;
 import org.opensaml.security.credential.Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
@@ -38,10 +38,10 @@ public class EvaluableEntityIDCredentialCriterion extends AbstractTriStatePredic
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableEntityIDCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableEntityIDCredentialCriterion.class);
 
     /** Base criteria. */
-    private final String entityID;
+    @Nonnull private final String entityID;
 
     /**
      * Constructor.
@@ -59,9 +59,7 @@ public class EvaluableEntityIDCredentialCriterion extends AbstractTriStatePredic
      */
     public EvaluableEntityIDCredentialCriterion(@Nonnull final String entity) {
         final String trimmed = StringSupport.trimOrNull(entity);
-        Constraint.isNotNull(trimmed, "EntityID criteria cannot be null or empty");
-
-        entityID = trimmed;
+        entityID = Constraint.isNotNull(trimmed, "EntityID criteria cannot be null or empty");
     }
 
     /** {@inheritDoc} */
@@ -100,8 +98,8 @@ public class EvaluableEntityIDCredentialCriterion extends AbstractTriStatePredic
             return false;
         }
 
-        if (obj instanceof EvaluableEntityIDCredentialCriterion) {
-            return entityID.equals(((EvaluableEntityIDCredentialCriterion) obj).entityID);
+        if (obj instanceof EvaluableEntityIDCredentialCriterion other) {
+            return entityID.equals(other.entityID);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterion.java
index 4e9402001..8226ffad9 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterion.java
@@ -24,12 +24,12 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.criteria.KeyAlgorithmCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating the credential key algorithm.
@@ -38,10 +38,10 @@ public class EvaluableKeyAlgorithmCredentialCriterion extends AbstractTriStatePr
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableKeyAlgorithmCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableKeyAlgorithmCredentialCriterion.class);
 
     /** Base criteria. */
-    private final String keyAlgorithm;
+    @Nonnull private final String keyAlgorithm;
 
     /**
      * Constructor.
@@ -59,9 +59,7 @@ public class EvaluableKeyAlgorithmCredentialCriterion extends AbstractTriStatePr
      */
     public EvaluableKeyAlgorithmCredentialCriterion(@Nonnull final String newKeyAlgorithm) {
         final String trimmed = StringSupport.trimOrNull(newKeyAlgorithm);
-        Constraint.isNotNull(trimmed, "Key algorithm cannot be null or empty");
-
-        keyAlgorithm = trimmed;
+        keyAlgorithm = Constraint.isNotNull(trimmed, "Key algorithm cannot be null or empty");
     }
 
     /** {@inheritDoc} */
@@ -129,8 +127,8 @@ public class EvaluableKeyAlgorithmCredentialCriterion extends AbstractTriStatePr
             return false;
         }
 
-        if (obj instanceof EvaluableKeyAlgorithmCredentialCriterion) {
-            return keyAlgorithm.equals(((EvaluableKeyAlgorithmCredentialCriterion) obj).keyAlgorithm);
+        if (obj instanceof EvaluableKeyAlgorithmCredentialCriterion other) {
+            return keyAlgorithm.equals(other.keyAlgorithm);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterion.java
index f7c1f5017..5c5e09bed 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterion.java
@@ -24,12 +24,12 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.criteria.KeyLengthCriterion;
 import org.opensaml.security.crypto.KeySupport;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating the credential key length.
@@ -38,10 +38,10 @@ public class EvaluableKeyLengthCredentialCriterion extends AbstractTriStatePredi
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableKeyLengthCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableKeyLengthCredentialCriterion.class);
 
     /** Base criteria. */
-    private final Integer keyLength;
+    private final int keyLength;
 
     /**
      * Constructor.
@@ -57,8 +57,8 @@ public class EvaluableKeyLengthCredentialCriterion extends AbstractTriStatePredi
      * 
      * @param newKeyLength the criteria value which is the basis for evaluation
      */
-    public EvaluableKeyLengthCredentialCriterion(@Nonnull final Integer newKeyLength) {
-        keyLength = Constraint.isNotNull(newKeyLength, "Key length cannot be null");
+    public EvaluableKeyLengthCredentialCriterion(final int newKeyLength) {
+        keyLength = newKeyLength;
     }
 
     /** {@inheritDoc} */
@@ -80,7 +80,7 @@ public class EvaluableKeyLengthCredentialCriterion extends AbstractTriStatePredi
             return isUnevaluableSatisfies();
         }
 
-        return keyLength.equals(length);
+        return keyLength == length;
     }
 
     /**
@@ -113,7 +113,7 @@ public class EvaluableKeyLengthCredentialCriterion extends AbstractTriStatePredi
 
     /** {@inheritDoc} */
     public int hashCode() {
-        return keyLength.hashCode();
+        return Integer.valueOf(keyLength).hashCode();
     }
 
     /** {@inheritDoc} */
@@ -126,11 +126,11 @@ public class EvaluableKeyLengthCredentialCriterion extends AbstractTriStatePredi
             return false;
         }
 
-        if (obj instanceof EvaluableKeyLengthCredentialCriterion) {
-            return keyLength.equals(((EvaluableKeyLengthCredentialCriterion) obj).keyLength);
+        if (obj instanceof EvaluableKeyLengthCredentialCriterion other) {
+            return keyLength == other.keyLength;
         }
 
         return false;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterion.java
index b5b439328..f28f51508 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterion.java
@@ -22,12 +22,12 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.criteria.KeyNameCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 
 /**
@@ -37,10 +37,10 @@ public class EvaluableKeyNameCredentialCriterion extends AbstractTriStatePredica
         implements EvaluableCredentialCriterion {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableKeyNameCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableKeyNameCredentialCriterion.class);
     
     /** Base criteria. */
-    private final String keyName;
+    @Nonnull private final String keyName;
     
     /**
      * Constructor.
@@ -58,9 +58,7 @@ public class EvaluableKeyNameCredentialCriterion extends AbstractTriStatePredica
      */
     public EvaluableKeyNameCredentialCriterion(@Nonnull final String newKeyName) {
         final String trimmed = StringSupport.trimOrNull(newKeyName);
-        Constraint.isNotNull(trimmed, "Key name cannot be null or empty");
-
-        keyName = trimmed;
+        keyName = Constraint.isNotNull(trimmed, "Key name cannot be null or empty");
     }
 
     /** {@inheritDoc} */
@@ -100,8 +98,8 @@ public class EvaluableKeyNameCredentialCriterion extends AbstractTriStatePredica
             return false;
         }
 
-        if (obj instanceof EvaluableKeyNameCredentialCriterion) {
-            return keyName.equals(((EvaluableKeyNameCredentialCriterion) obj).keyName);
+        if (obj instanceof EvaluableKeyNameCredentialCriterion other) {
+            return keyName.equals(other.keyName);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterion.java
index af33859ee..51ed708df 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterion.java
@@ -24,11 +24,11 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.criteria.PublicKeyCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating whether a credential contains a particular
@@ -38,10 +38,10 @@ public class EvaluablePublicKeyCredentialCriterion extends AbstractTriStatePredi
         implements EvaluableCredentialCriterion {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluablePublicKeyCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluablePublicKeyCredentialCriterion.class);
     
     /** Base criteria. */
-    private final PublicKey publicKey;
+    @Nonnull private final PublicKey publicKey;
     
     /**
      * Constructor.
@@ -101,8 +101,8 @@ public class EvaluablePublicKeyCredentialCriterion extends AbstractTriStatePredi
             return false;
         }
 
-        if (obj instanceof EvaluablePublicKeyCredentialCriterion) {
-            return publicKey.equals(((EvaluablePublicKeyCredentialCriterion) obj).publicKey);
+        if (obj instanceof EvaluablePublicKeyCredentialCriterion other) {
+            return publicKey.equals(other.publicKey);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
index 066f4f757..e927986a4 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
@@ -113,8 +113,8 @@ public class EvaluableUsageCredentialCriterion extends AbstractTriStatePredicate
             return false;
         }
 
-        if (obj instanceof EvaluableUsageCredentialCriterion) {
-            return usage.equals(((EvaluableUsageCredentialCriterion) obj).usage);
+        if (obj instanceof EvaluableUsageCredentialCriterion other) {
+            return usage.equals(other.usage);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
index 0efc0615e..a81231a3e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
@@ -90,8 +90,8 @@ public class EvaluableX509CertSelectorCredentialCriterion extends AbstractTriSta
             return false;
         }
 
-        if (obj instanceof EvaluableX509CertSelectorCredentialCriterion) {
-            return certSelector.equals(((EvaluableX509CertSelectorCredentialCriterion) obj).certSelector);
+        if (obj instanceof EvaluableX509CertSelectorCredentialCriterion other) {
+            return certSelector.equals(other.certSelector);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
index 499922dd3..24a473d4b 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
@@ -131,8 +131,7 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
             return false;
         }
 
-        if (obj instanceof EvaluableX509DigestCredentialCriterion) {
-            final EvaluableX509DigestCredentialCriterion other = (EvaluableX509DigestCredentialCriterion) obj;
+        if (obj instanceof EvaluableX509DigestCredentialCriterion other) {
             return algorithm.equals(other.algorithm) && Arrays.equals(x509digest, other.x509digest);
         }
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
index 906914885..27938ee0f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
@@ -114,9 +114,7 @@ public class EvaluableX509IssuerSerialCredentialCriterion extends AbstractTriSta
             return false;
         }
 
-        if (obj instanceof EvaluableX509IssuerSerialCredentialCriterion) {
-            final EvaluableX509IssuerSerialCredentialCriterion other =
-                    (EvaluableX509IssuerSerialCredentialCriterion) obj;
+        if (obj instanceof EvaluableX509IssuerSerialCredentialCriterion other) {
             return issuer.equals(other.issuer) && serialNumber.equals(other.serialNumber);
         }
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
index f505a5365..79b6c0021 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
@@ -42,7 +42,8 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
         implements EvaluableCredentialCriterion {
     
     /** Logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectKeyIdentifierCredentialCriterion.class);
+    @Nonnull private final Logger log =
+            LoggerFactory.getLogger(EvaluableX509SubjectKeyIdentifierCredentialCriterion.class);
     
     /** Base criteria. */
     @Nonnull private final byte[] ski;
@@ -111,8 +112,8 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
             return false;
         }
 
-        if (obj instanceof EvaluableX509SubjectKeyIdentifierCredentialCriterion) {
-            return ski.equals(((EvaluableX509SubjectKeyIdentifierCredentialCriterion) obj).ski);
+        if (obj instanceof EvaluableX509SubjectKeyIdentifierCredentialCriterion other) {
+            return ski.equals(other.ski);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
index cc42615fa..6a2767600 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
@@ -102,8 +102,8 @@ public class EvaluableX509SubjectNameCredentialCriterion extends AbstractTriStat
             return false;
         }
 
-        if (obj instanceof EvaluableX509SubjectNameCredentialCriterion) {
-            return subjectName.equals(((EvaluableX509SubjectNameCredentialCriterion) obj).subjectName);
+        if (obj instanceof EvaluableX509SubjectNameCredentialCriterion other) {
+            return subjectName.equals(other.subjectName);
         }
 
         return false;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/package-info.java
index c8e510b7a..524b1dbaa 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/package-info.java
@@ -24,4 +24,7 @@
  * particular implementation of EvaluableCredentialCriterion which should be used to evaluate a given
  * (non-evaluable) {@link net.shibboleth.shared.resolver.Criterion} against a Credential.</p>
  */
-package org.opensaml.security.credential.criteria.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.credential.criteria.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
index b3cfba4e8..617be3d1e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
@@ -24,7 +24,6 @@ import java.util.NoSuchElementException;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -51,15 +50,16 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
     @Nonnull private final Logger log = LoggerFactory.getLogger(ChainingCredentialResolver.class);
 
     /** List of credential resolvers in the chain. */
-    @Nonnull @NonnullElements private List<ResolverType> resolvers;
+    @Nonnull private List<ResolverType> resolvers;
 
     /**
      * Constructor.
      * 
      * @param credResolvers the list of chained credential resolvers
      */
-    public AbstractChainingCredentialResolver(@Nonnull @NonnullElements final List<ResolverType> credResolvers) {
-        resolvers = CollectionSupport.copyToList(Constraint.isNotNull(credResolvers, "CredentialResolver list cannot be null"));
+    public AbstractChainingCredentialResolver(@Nonnull final List<ResolverType> credResolvers) {
+        resolvers = CollectionSupport.copyToList(
+                Constraint.isNotNull(credResolvers, "CredentialResolver list cannot be null"));
     }
 
     /**
@@ -67,7 +67,7 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
      * 
      * @return the list of credential resolvers in the chain
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<ResolverType> getResolverChain() {
+    @Nonnull @Unmodifiable @NotLive public List<ResolverType> getResolverChain() {
         return resolvers;
     }
 
@@ -120,13 +120,13 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
         @Nonnull private final Logger log = LoggerFactory.getLogger(CredentialIterator.class);
 
         /** The chaining credential resolver which owns this instance. */
-        private AbstractChainingCredentialResolver<ResolverType> parent;
+        @Nonnull private AbstractChainingCredentialResolver<ResolverType> parent;
 
         /** The criteria set on which to base resolution. */
-        private CriteriaSet critSet;
+        @Nullable private CriteriaSet critSet;
 
         /** The iterator over resolvers in the chain. */
-        private Iterator<ResolverType> resolverIterator;
+        @Nonnull private final Iterator<ResolverType> resolverIterator;
 
         /** The iterator over Credential instances from the current resolver. */
         private Iterator<Credential> credentialIterator;
@@ -135,7 +135,7 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
         private CredentialResolver currentResolver;
 
         /** The next credential that is safe to return. */
-        private Credential nextCredential;
+        @Nullable private Credential nextCredential;
 
         /**
          * Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/ChainingCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/ChainingCredentialResolver.java
index f79c9df98..141024ef5 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/ChainingCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/ChainingCredentialResolver.java
@@ -38,4 +38,4 @@ public class ChainingCredentialResolver extends AbstractChainingCredentialResolv
         super(resolverChain);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
index 37008f694..e75d131b5 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -68,12 +69,12 @@ public class CollectionCredentialResolver extends AbstractCriteriaFilteringCrede
      * 
      * @return the credential collection backing store
      */
-    @Nonnull public Collection<Credential> getCollection() {
+    @Nonnull @Live public Collection<Credential> getCollection() {
         return collection;
     }
 
     /** {@inheritDoc} */
-    @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
+    @Nonnull @Live protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
             throws ResolverException {
         return collection;
     }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
index 43c6d3bb4..8e70c637d 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
@@ -110,8 +110,6 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
     @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
             throws ResolverException {
 
-        ;
-
         final String entityID = checkCriteriaRequirements(criteriaSet).getEntityId();
         
         final UsageCriterion usageCriteria = criteriaSet != null ? criteriaSet.get(UsageCriterion.class) : null;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
index e1a7a5ba6..757835e6c 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
@@ -17,21 +17,22 @@
 
 package org.opensaml.security.credential.impl;
 
-import java.util.ArrayList;
 import java.util.List;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialResolver;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
 /**
- * Simple implementation of {@link org.opensaml.security.credential.CredentialResolver} which just stores
+ * Simple implementation of {@link CredentialResolver} which just stores
  * and returns a static set of credentials.
  * 
  * <p>
@@ -53,7 +54,7 @@ public class StaticCredentialResolver extends AbstractCredentialResolver {
     public StaticCredentialResolver(@Nonnull @ParameterName(name="credentials") final List<Credential> credentials) {
         Constraint.isNotNull(credentials, "Input credentials list cannot be null");
         
-        creds = new ArrayList<>(credentials);
+        creds = CollectionSupport.copyToList(credentials);
     }
     
     /**
@@ -64,8 +65,7 @@ public class StaticCredentialResolver extends AbstractCredentialResolver {
     public StaticCredentialResolver(@Nonnull @ParameterName(name="credential") final Credential credential) {
         Constraint.isNotNull(credential, "Input credential cannot be null");
         
-        creds = new ArrayList<>();
-        creds.add(credential);
+        creds = CollectionSupport.singletonList(credential);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/package-info.java
index 0f5bc213d..91047940b 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** {@link org.opensaml.security.credential.CredentialResolver} implementation classes. */
-package org.opensaml.security.credential.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.credential.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
index 4a79ff22f..bdb071c1e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfiguration.java
@@ -17,10 +17,10 @@
 
 package org.opensaml.security.httpclient.impl;
 
-import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.net.ssl.HostnameVerifier;
 
@@ -32,6 +32,7 @@ import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
 import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.X509Credential;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.StringSupport;
 
 /**
@@ -74,9 +75,14 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * Set an instance of {@link CredentialsProvider} used for authentication by the HttpClient instance.
      * 
      * @param provider the credentials provider
+     * 
+     * @return this object
      */
-    public void setCredentialsProvider(@Nullable final CredentialsProvider provider) {
+    @Nonnull public BasicHttpClientSecurityConfiguration setCredentialsProvider(
+            @Nullable final CredentialsProvider provider) {
         credentialsProvider = provider;
+        
+        return this;
     }
     
     /**
@@ -91,9 +97,14 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * provide an instance of {@link CredentialsProvider} via {@link #setCredentialsProvider(CredentialsProvider)}.</p>
      * 
      * @param credentials the username and password credentials
+     * 
+     * @return this object
      */
-    public void setBasicCredentials(@Nullable final UsernamePasswordCredentials credentials) {
+    @Nonnull public BasicHttpClientSecurityConfiguration setBasicCredentials(
+            @Nullable final UsernamePasswordCredentials credentials) {
         setBasicCredentialsWithScope(credentials, null);
+        
+        return this;
     }
     
     /**
@@ -110,9 +121,11 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * 
      * @param credentials the username and password credentials
      * @param scope the HTTP client auth scope with which to scope the credentials, may be null
+     * 
+     * @return this object
      */
-    public void setBasicCredentialsWithScope(@Nullable final UsernamePasswordCredentials credentials,
-            @Nullable final AuthScope scope) {
+    @Nonnull public BasicHttpClientSecurityConfiguration setBasicCredentialsWithScope(
+            @Nullable final UsernamePasswordCredentials credentials, @Nullable final AuthScope scope) {
 
         if (credentials != null) {
             AuthScope authScope = scope;
@@ -126,6 +139,7 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
             credentialsProvider = null;
         }
 
+        return this;
     }
     
     /**
@@ -141,9 +155,14 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * Sets the optional trust engine used in evaluating server TLS credentials.
      * 
      * @param engine the trust engine instance to use
+     * 
+     * @return this object
      */
-    public void setTLSTrustEngine(@Nullable final TrustEngine<? super X509Credential> engine) {
+    @Nonnull public BasicHttpClientSecurityConfiguration setTLSTrustEngine(
+            @Nullable final TrustEngine<? super X509Credential> engine) {
         tlsTrustEngine = engine;
+        
+        return this;
     }
 
     /**
@@ -159,12 +178,17 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * Set the optional list of TLS protocols. 
      * 
      * @param protocols the TLS protocols or null
+     * 
+     * @return this object
      */
-    public void setTLSProtocols(@Nullable final Collection<String> protocols) {
-        tlsProtocols = new ArrayList<>(StringSupport.normalizeStringCollection(protocols));
+    @Nonnull public BasicHttpClientSecurityConfiguration setTLSProtocols(
+            @Nullable final Collection<String> protocols) {
+        tlsProtocols = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(protocols));
         if (tlsProtocols.isEmpty()) {
             tlsProtocols = null;
         }
+        
+        return this;
     }
 
     /**
@@ -180,12 +204,17 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * Set the optional list of TLS cipher suites.
      * 
      * @param cipherSuites the TLS cipher suites, or null
+     * 
+     * @return this object
      */
-    public void setTLSCipherSuites(@Nullable final Collection<String> cipherSuites) {
-        tlsCipherSuites = new ArrayList<>(StringSupport.normalizeStringCollection(cipherSuites));
+    @Nonnull public BasicHttpClientSecurityConfiguration setTLSCipherSuites(
+            @Nullable final Collection<String> cipherSuites) {
+        tlsCipherSuites = CollectionSupport.copyToList(StringSupport.normalizeStringCollection(cipherSuites));
         if (tlsCipherSuites.isEmpty()) {
             tlsCipherSuites = null;
         }
+        
+        return this;
     }
 
     /**
@@ -201,9 +230,14 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * Set the optional hostname verifier.
      * 
      * @param verifier the hostname verifier, or null
+     * 
+     * @return this object
      */
-    public void setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
+    @Nonnull public BasicHttpClientSecurityConfiguration setHostnameVerifier(
+            @Nullable final HostnameVerifier verifier) {
         hostnameVerifier = verifier;
+        
+        return this;
     }
 
     /**
@@ -219,9 +253,14 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * Set the optional client TLS credential.
      * 
      * @param credential the client TLS credential, or null
+     * 
+     * @return this object
      */
-    public void setClientTLSCredential(@Nullable final X509Credential credential) {
+    @Nonnull public BasicHttpClientSecurityConfiguration setClientTLSCredential(
+            @Nullable final X509Credential credential) {
         clientTLSCredential = credential;
+        
+        return this;
     }
     
     /**
@@ -251,9 +290,12 @@ public class BasicHttpClientSecurityConfiguration implements HttpClientSecurityC
      * 
      * @param flag true if fatal, false if non-fatal, null if not explicitly configured
      * 
+     * @return this object
      */
-    public void setServerTLSFailureFatal(@Nullable final Boolean flag) {
-        this.serverTLSFailureFatal = flag ;
+    @Nonnull public BasicHttpClientSecurityConfiguration setServerTLSFailureFatal(@Nullable final Boolean flag) {
+        serverTLSFailureFatal = flag ;
+        
+        return this;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
index 239208a79..0cbd339f6 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
@@ -32,10 +32,10 @@ import org.opensaml.security.httpclient.TLSCriteriaSetCriterion;
 import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.ObjectSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -53,7 +53,7 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class BasicHttpClientSecurityParametersResolver implements HttpClientSecurityParametersResolver {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(BasicHttpClientSecurityParametersResolver.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(BasicHttpClientSecurityParametersResolver.class);
 
     /** {@inheritDoc} */
     @Nonnull public Iterable<HttpClientSecurityParameters> resolve(@Nullable final CriteriaSet criteria) 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 44254e6ea..d73ef9b8f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -140,7 +140,7 @@ public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocket
 
 // CheckStyle: ParameterNumber OFF
     /** {@inheritDoc} */
-    public Socket connectSocket(TimeValue connectTimeout, final Socket sock, final HttpHost host,
+    public Socket connectSocket(final TimeValue connectTimeout, final Socket sock, final HttpHost host,
             final InetSocketAddress remoteAddress, final InetSocketAddress localAddress,
             final HttpContext context) throws IOException {
         
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalClientTLSCredentialHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalClientTLSCredentialHandler.java
index a8f33c0b6..26b1b6c64 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalClientTLSCredentialHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalClientTLSCredentialHandler.java
@@ -25,9 +25,9 @@ import org.apache.hc.client5.http.protocol.HttpClientContext;
 import org.apache.hc.core5.http.ClassicHttpRequest;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509CredentialContext;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.httpclient.HttpClientContextHandler;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An implementation of {@link HttpClientContextHandler} which clears the thread local client TLS credential
@@ -36,7 +36,7 @@ import net.shibboleth.shared.httpclient.HttpClientContextHandler;
 public class ThreadLocalClientTLSCredentialHandler implements HttpClientContextHandler {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(ThreadLocalClientTLSCredentialHandler.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ThreadLocalClientTLSCredentialHandler.class);
 
     /** {@inheritDoc} */
     public void invokeBefore(@Nonnull final HttpClientContext context, @Nonnull final ClassicHttpRequest request)
@@ -52,4 +52,4 @@ public class ThreadLocalClientTLSCredentialHandler implements HttpClientContextH
         ThreadLocalX509CredentialContext.clearCurrent();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalServerTLSHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalServerTLSHandler.java
index 5cc2f922c..120432856 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalServerTLSHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/ThreadLocalServerTLSHandler.java
@@ -26,9 +26,9 @@ import org.apache.hc.core5.http.ClassicHttpRequest;
 import org.opensaml.security.httpclient.HttpClientSecurityConstants;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustEngineContext;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.httpclient.HttpClientContextHandler;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An implementation of {@link HttpClientContextHandler} which handles cleanup and transfer of
@@ -37,7 +37,7 @@ import net.shibboleth.shared.httpclient.HttpClientContextHandler;
 public class ThreadLocalServerTLSHandler implements HttpClientContextHandler {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(ThreadLocalServerTLSHandler.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ThreadLocalServerTLSHandler.class);
 
     /** {@inheritDoc} */
     public void invokeBefore(@Nonnull final HttpClientContext context, @Nonnull final ClassicHttpRequest request)
@@ -59,4 +59,4 @@ public class ThreadLocalServerTLSHandler implements HttpClientContextHandler {
         ThreadLocalX509TrustEngineContext.clearCurrent();
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/package-info.java
index f355e3c14..6a52070f6 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Security implementation support for Apache HttpClient. */
-package org.opensaml.security.httpclient.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.httpclient.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
index 529ac462a..ed74acaa3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
@@ -106,7 +106,7 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
      * 
      * @return current HTTP request
      */
-    @Nullable public HttpServletRequest getHttpServletRequest() {
+    @NonnullAfterInit public HttpServletRequest getHttpServletRequest() {
         if (httpServletRequestSupplier == null) {
             return null;
         }
@@ -118,7 +118,7 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
      *
      * @return current HTTP request
      */
-    @Nullable public NonnullSupplier<HttpServletRequest> getHttpServletRequestSupplier() {
+    @NonnullAfterInit public NonnullSupplier<HttpServletRequest> getHttpServletRequestSupplier() {
         return httpServletRequestSupplier;
     }
 
@@ -561,4 +561,4 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
         return names;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
index dd723462e..f7fa1f637 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
@@ -27,6 +27,7 @@ import org.opensaml.security.SecurityException;
 import org.opensaml.security.trust.TrustEngine;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NonnullBeforeExec;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -41,14 +42,14 @@ public abstract class BaseTrustEngineSecurityHandler<TokenType> extends Abstract
     @Nonnull private final Logger log = LoggerFactory.getLogger(BaseTrustEngineSecurityHandler.class);
 
     /** Trust engine used to verify the particular token type. */
-    @Nullable private TrustEngine<? super TokenType> trustEngine;
+    @NonnullBeforeExec private TrustEngine<? super TokenType> trustEngine;
 
     /**
      * Gets the trust engine used to validate the untrusted token.
      * 
      * @return trust engine used to validate the untrusted token
      */
-    @Nullable protected TrustEngine<? super TokenType> getTrustEngine() {
+    @NonnullBeforeExec protected TrustEngine<? super TokenType> getTrustEngine() {
         return trustEngine;
     }
 
@@ -124,7 +125,6 @@ public abstract class BaseTrustEngineSecurityHandler<TokenType> extends Abstract
     protected boolean evaluate(@Nonnull final TokenType token, @Nullable final CriteriaSet criteriaSet)
             throws MessageHandlerException {
         try {
-            assert trustEngine != null;
             return trustEngine.validate(token, criteriaSet);
         } catch (final SecurityException e) {
             log.error("{} There was an error evaluating the request's token using the trust engine: {}", getLogPrefix(),
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/package-info.java
index 03b321ce2..a58f59ebd 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** Message handler implementations.  */
-package org.opensaml.security.messaging.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.messaging.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
index 6fb2db23d..e436ac7f1 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
@@ -27,7 +27,6 @@ import org.opensaml.security.trust.TrustEngine;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -54,8 +53,7 @@ public class ChainingTrustEngine<TokenType> implements TrustEngine<TokenType> {
      * 
      * @param chain the list of trust engines in the chain
      */
-    public ChainingTrustEngine(
-            @Nonnull @NonnullElements @ParameterName(name="chain") final List<TrustEngine<? super TokenType>> chain) {
+    public ChainingTrustEngine(@Nonnull @ParameterName(name="chain") final List<TrustEngine<? super TokenType>> chain) {
         engines = CollectionSupport.copyToList(Constraint.isNotNull(chain, "TrustEngine list cannot be null"));
     }
 
@@ -64,7 +62,7 @@ public class ChainingTrustEngine<TokenType> implements TrustEngine<TokenType> {
      * 
      * @return the modifiable list of trust engines in the chain
      */
-    @Nonnull  @NonnullElements @Unmodifiable @NotLive public List<TrustEngine<? super TokenType>> getChain() {
+    @Nonnull @Unmodifiable @NotLive public List<TrustEngine<? super TokenType>> getChain() {
         return engines;
     }
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/package-info.java
index a7eaffaef..77914225a 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** {@link org.opensaml.security.trust.TrustEngine} implementation classes. */
-package org.opensaml.security.trust.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.trust.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java
index 566adb42e..7e9cd8c2a 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicPKIXValidationInformation.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 import org.opensaml.security.x509.PKIXValidationInformation;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -37,10 +36,10 @@ import net.shibboleth.shared.collection.CollectionSupport;
 public class BasicPKIXValidationInformation implements PKIXValidationInformation {
 
     /** Certs used as the trust anchors. */
-    @Nullable @NonnullElements private final Collection<X509Certificate> trustAnchors;
+    @Nullable private final Collection<X509Certificate> trustAnchors;
 
     /** CRLs used during validation. */
-    @Nullable @NonnullElements private final Collection<X509CRL> trustedCRLs;
+    @Nullable private final Collection<X509CRL> trustedCRLs;
 
     /** Max verification depth during PKIX validation. */
     @Nullable private final Integer verificationDepth;
@@ -53,9 +52,9 @@ public class BasicPKIXValidationInformation implements PKIXValidationInformation
      * @param depth max verification path depth
      */
     public BasicPKIXValidationInformation(
-            @Nullable @NonnullElements @ParameterName(name="anchors") final Collection<X509Certificate> anchors,
-            @Nullable @NonnullElements @ParameterName(name="crls") final Collection<X509CRL> crls,
-            @Nullable @NonnullElements @ParameterName(name="depth") final Integer depth) {
+            @Nullable @ParameterName(name="anchors") final Collection<X509Certificate> anchors,
+            @Nullable @ParameterName(name="crls") final Collection<X509CRL> crls,
+            @Nullable @ParameterName(name="depth") final Integer depth) {
 
         verificationDepth = depth;
         trustAnchors = anchors != null ? CollectionSupport.copyToList(anchors) : null;
@@ -63,12 +62,12 @@ public class BasicPKIXValidationInformation implements PKIXValidationInformation
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
+    @Nullable @Unmodifiable @NotLive public Collection<X509CRL> getCRLs() {
         return trustedCRLs;
     }
 
     /** {@inheritDoc} */
-    @Nullable @NonnullElements @Unmodifiable @NotLive public Collection<X509Certificate> getCertificates() {
+    @Nullable @Unmodifiable @NotLive public Collection<X509Certificate> getCertificates() {
         return trustAnchors;
     }
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
index 167692b61..7dc7155a8 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
@@ -25,7 +25,6 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.security.auth.x500.X500Principal;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -129,7 +128,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
      * 
      * @param nameTypes the new set of alt name identifiers
      */
-    public void setSubjectAltNameTypes(@Nullable @NonnullElements final Set<Integer> nameTypes) {
+    public void setSubjectAltNameTypes(@Nullable final Set<Integer> nameTypes) {
         if (nameTypes == null) {
             subjectAltNameTypes = CollectionSupport.emptySet();
         } else {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
index 5062899c3..c3e4df669 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXValidationOptions.java
@@ -24,7 +24,6 @@ import javax.annotation.Nullable;
 
 import org.opensaml.security.x509.PKIXValidationOptions;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -159,7 +158,7 @@ public class CertPathPKIXValidationOptions extends PKIXValidationOptions {
      * 
      * @return Returns the initialPolicies set.
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public Set<String> getInitialPolicies() {
+    @Nonnull @Unmodifiable @NotLive public Set<String> getInitialPolicies() {
         return initialPolicies;
     }
 
@@ -170,7 +169,7 @@ public class CertPathPKIXValidationOptions extends PKIXValidationOptions {
      * 
      * @param newPolicies the initial set of policy identifiers (OID strings)
      */
-    public void setInitialPolicies(@Nullable @NonnullElements final Set<String> newPolicies) {
+    public void setInitialPolicies(@Nullable final Set<String> newPolicies) {
         initialPolicies = newPolicies != null ? CollectionSupport.copyToSet(newPolicies) : CollectionSupport.emptySet();
     }
     
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
index dfeaa82bf..345ae83fc 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
@@ -31,7 +31,6 @@ import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -168,7 +167,7 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
      *          against trusted names or validation information
      */
     protected boolean validate(@Nonnull final X509Credential untrustedX509Credential,
-            @Nullable @NonnullElements final Set<String> trustedNames,
+            @Nullable final Set<String> trustedNames,
             @Nonnull final Iterable<PKIXValidationInformation> validationInfoSet) throws SecurityException {
         
         log.debug("Beginning PKIX validation using trusted validation information");
@@ -204,7 +203,7 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
      * @return true if evaluation is successful, false otherwise
      * @throws SecurityException thrown if there is an error evaluation the credential
      */
-    protected boolean checkNames(@Nullable @NonnullElements final Set<String> trustedNames,
+    protected boolean checkNames(@Nullable final Set<String> trustedNames,
             @Nonnull final X509Credential untrustedCredential)  throws SecurityException {
         
         if (credNameEvaluator == null) {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
index 0431346bf..04246d478 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.security.x509.impl;
 
-import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -77,13 +76,13 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
             @Nullable @ParameterName(name="names") final Set<String> names,
             @ParameterName(name="supportDynamicNames") final boolean supportDynamicNames) {
         if (info != null) {
-            pkixInfo = new ArrayList<>(info);
+            pkixInfo = CollectionSupport.copyToList(info);
         } else {
             pkixInfo = CollectionSupport.emptyList();
         }
 
         if (names != null) {
-            trustedNames = new HashSet<>(names);
+            trustedNames = CollectionSupport.copyToSet(names);
         } else {
             trustedNames = CollectionSupport.emptySet();
         }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java
index 655eebefe..f5ff26f2c 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509CredentialNameEvaluator.java
@@ -25,8 +25,6 @@ import javax.annotation.Nullable;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.x509.X509Credential;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
-
 /**
  * Interface for classes which evaluate an {@link X509Credential} against a 
  * supplied set of trusted names.
@@ -46,7 +44,7 @@ public interface X509CredentialNameEvaluator {
      * 
      * @throws SecurityException thrown if there is an error during name evaluation
      */
-    boolean evaluate(@Nonnull final X509Credential credential,
-            @Nullable @NonnullElements final Set<String> trustedNames) throws SecurityException;
+    boolean evaluate(@Nonnull final X509Credential credential, @Nullable final Set<String> trustedNames)
+            throws SecurityException;
     
 }
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/package-info.java
index 210019009..dccd4b4d5 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/package-info.java
@@ -16,4 +16,7 @@
  */
 
 /** {@link org.opensaml.security.trust.TrustEngine} implementation classes related to PKIX. */
-package org.opensaml.security.x509.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.x509.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
index 16d3f2594..a756f3e21 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
@@ -17,6 +17,7 @@
 
 package org.opensaml.security.x509.tls.impl;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.opensaml.security.trust.TrustEngine;
@@ -44,9 +45,14 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
      * Set a {@link TrustEngine} instance used to validate a client TLS {@link X509Credential}.
      * 
      * @param engine a trust engine instance, may be null
+     * 
+     * @return this object
      */
-    public void setX509TrustEngine(@Nullable final TrustEngine<? super X509Credential> engine) {
+    @Nonnull public BasicClientTLSValidationConfiguration setX509TrustEngine(
+            @Nullable final TrustEngine<? super X509Credential> engine) {
         x509TrustEngine = engine;
+        
+        return this;
     }
 
     /** {@inheritDoc} */
@@ -58,9 +64,14 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
      * Set a {@link CertificateNameOptions} instance to use when evaluating a client TLS {@link X509Credential}.
      * 
      * @param options an options instance, may be null
+     * 
+     * @return this object
      */
-    public void setCertificateNameOptions(@Nullable final CertificateNameOptions options) {
+    @Nonnull public BasicClientTLSValidationConfiguration setCertificateNameOptions(
+            @Nullable final CertificateNameOptions options) {
         certificateNameOptions = options;
+        
+        return this;
     }
 
 }
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
index 9709ec8d3..987c3f64f 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
@@ -58,6 +58,8 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
     /** {@inheritDoc} */
     @Nullable public ClientTLSValidationParameters resolveSingle(@Nullable final CriteriaSet criteria)
             throws ResolverException {
+        
+        // TODO: log and return null?
         final CriteriaSet localCriteria = Constraint.isNotNull(criteria, "CriteriaSet was null");
         
         final ClientTLSValidationParameters params = new ClientTLSValidationParameters();
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialContext.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialContext.java
index ca1f68476..0d9124f50 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialContext.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialContext.java
@@ -31,7 +31,7 @@ import net.shibboleth.shared.logic.Constraint;
 public final class ThreadLocalX509CredentialContext {
 
     /** ThreadLocal storage for credential. */
-    private static ThreadLocal<X509Credential> currentCredential = new ThreadLocal<>();
+    @Nonnull private static ThreadLocal<X509Credential> currentCredential = new ThreadLocal<>();
 
     /** Constructor. */
     private ThreadLocalX509CredentialContext() {
@@ -73,4 +73,4 @@ public final class ThreadLocalX509CredentialContext {
         return currentCredential.get();
     }
     
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/package-info.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/package-info.java
index abf23eae8..60bdbcee1 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/package-info.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementation classes for client TLS security.
  */
-package org.opensaml.security.x509.tls.impl;
\ No newline at end of file
+ at NonnullElements
+package org.opensaml.security.x509.tls.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list