[java-opensaml] branch main updated: IDP-2069 - Null Handling Task

Scott Cantor cantor.2 at osu.edu
Tue Mar 28 14:53:27 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=829baf4a79626f518ef3bc88617b16c2f72a98c7

The following commit(s) were added to refs/heads/main by this push:
     new 829baf4a7 IDP-2069 - Null Handling Task
829baf4a7 is described below

commit 829baf4a79626f518ef3bc88617b16c2f72a98c7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Mar 28 10:53:20 2023 -0400

    IDP-2069 - Null Handling Task
    
    https://shibboleth.atlassian.net/browse/IDP-2069
    
    Clean opensaml-security-impl.
    Annotation tweaks to X509Support.
---
 .../security/x509/PKIXValidationOptions.java       |  7 ++-
 .../org/opensaml/security/x509/X509Support.java    | 37 +++++--------
 .../security/x509/tls/CertificateNameOptions.java  | 37 ++++++-------
 .../impl/EvaluableCredentialCriteriaRegistry.java  |  2 +-
 .../impl/EvaluableUsageCredentialCriterion.java    |  6 +--
 ...aluableX509CertSelectorCredentialCriterion.java | 15 ++----
 .../EvaluableX509DigestCredentialCriterion.java    | 15 ++----
 ...aluableX509IssuerSerialCredentialCriterion.java | 13 ++---
 ...509SubjectKeyIdentifierCredentialCriterion.java | 10 ++--
 ...valuableX509SubjectNameCredentialCriterion.java | 10 ++--
 .../impl/AbstractChainingCredentialResolver.java   |  9 ++--
 ...bstractCriteriaFilteringCredentialResolver.java |  8 +--
 .../impl/CollectionCredentialResolver.java         |  4 +-
 .../impl/KeyStoreCredentialResolver.java           | 55 ++++++++++---------
 .../credential/impl/StaticCredentialResolver.java  |  2 +-
 .../BasicHttpClientSecurityParametersResolver.java | 25 +++++----
 .../impl/SecurityEnhancedTLSSocketFactory.java     |  8 +--
 .../impl/BaseClientCertAuthSecurityHandler.java    | 48 ++++++++++-------
 .../impl/BaseTrustEngineSecurityHandler.java       |  5 +-
 ...opulateHttpClientSecurityParametersHandler.java | 15 +++---
 .../security/trust/impl/ChainingTrustEngine.java   |  7 +--
 .../trust/impl/ExplicitKeyTrustEngine.java         | 13 ++---
 .../trust/impl/ExplicitKeyTrustEvaluator.java      |  6 ++-
 .../impl/ExplicitX509CertificateTrustEngine.java   | 13 ++---
 .../ExplicitX509CertificateTrustEvaluator.java     | 17 ++----
 .../trust/impl/TrustEngineX509TrustManager.java    |  3 +-
 .../impl/BasicX509CredentialNameEvaluator.java     | 21 ++++----
 .../x509/impl/CertPathPKIXTrustEvaluator.java      |  9 ++--
 .../impl/DummyX509CredentialNameEvaluator.java     |  3 +-
 .../x509/impl/KeyStoreX509CredentialAdapter.java   | 26 +++++----
 .../x509/impl/PKIXX509CredentialTrustEngine.java   | 27 ++++------
 .../StaticPKIXValidationInformationResolver.java   | 16 +++---
 .../impl/X509KeyManagerX509CredentialAdapter.java  | 12 ++---
 .../BasicClientTLSValidationConfiguration.java     |  4 +-
 ...BasicClientTLSValidationParametersResolver.java | 37 ++++++-------
 .../tls/impl/StaticX509CredentialKeyManager.java   | 19 +++----
 .../impl/ThreadLocalX509CredentialKeyManager.java  | 25 +++++----
 .../impl/ThreadLocalX509TrustEngineContext.java    | 12 ++---
 .../impl/ThreadLocalX509TrustEngineSupport.java    | 14 +++--
 .../x509/tls/impl/ThreadLocalX509TrustManager.java |  8 +--
 ...tTLSValidationConfigurationInitializerTest.java |  3 +-
 .../EvaluableEntityIDCredentialCriterionTest.java  | 14 +++--
 ...aluableKeyAlgorithmCredentialCriterionTest.java | 16 +++---
 .../EvaluableKeyLengthCredentialCriterionTest.java | 15 ++----
 .../EvaluableKeyNameCredentialCriterionTest.java   | 17 +++---
 .../EvaluablePublicKeyCredentialCriterionTest.java | 17 +++---
 .../EvaluableUsageCredentialCriterionTest.java     | 19 +++----
 ...bleX509CertSelectorCredentialCriterionTest.java | 10 ++--
 ...EvaluableX509DigestCredentialCriterionTest.java | 28 +++++-----
 ...bleX509IssuerSerialCredentialCriterionTest.java | 22 ++++----
 ...ubjectKeyIdentifierCredentialCriterionTest.java | 29 +++++-----
 ...ableX509SubjectNameCredentialCriterionTest.java | 22 ++++----
 .../impl/ChainingCredentialResolverTest.java       | 19 ++++---
 .../security/crypto/dh/tests/BaseDHTest.java       |  5 ++
 .../security/crypto/dh/tests/DHSupportTest.java    |  4 +-
 .../crypto/ec/curves/tests/NamedCurvesTest.java    | 55 ++++++++++---------
 .../crypto/ec/tests/BaseNamedCurveTest.java        |  5 ++
 .../security/crypto/ec/tests/ECSupportTest.java    | 23 ++++----
 .../ec/tests/EnhancedECParameterSpecTest.java      |  8 ++-
 .../crypto/ec/tests/NamedCurveRegistryTest.java    | 40 +++++++-------
 .../BasicHttpClientSecurityConfigurationTest.java  | 10 ++--
 ...icHttpClientSecurityParametersResolverTest.java | 28 +++++-----
 .../security/httpclient/impl/MockSSLSession.java   | 13 +++--
 .../security/httpclient/impl/MockSSLSocket.java    |  9 +++-
 .../httpclient/impl/MockTLSSocketFactory.java      | 21 ++++++--
 .../impl/SecurityEnhancedTLSSocketFactoryTest.java | 11 ++--
 ...ateHttpClientSecurityParametersHandlerTest.java | 63 ++++++++++++----------
 .../trust/impl/ChainingTrustEngineTest.java        | 16 +++---
 .../trust/impl/ExplicitKeyTrustEngineTest.java     |  1 +
 .../ExplicitX509CertificateTrustEngineTest.java    |  1 +
 .../impl/BasicX509CredentialNameEvaluatorTest.java |  1 +
 .../x509/impl/CertPathPKIXTrustEvaluatorTest.java  |  1 +
 .../impl/PKIXX509CredentialTrustEngineTest.java    |  1 +
 ...taticPKIXValidationInformationResolverTest.java |  1 +
 .../BasicClientTLSValidationConfigurationTest.java |  1 +
 ...cClientTLSValidationParametersResolverTest.java |  9 ++--
 .../tls/impl/ThreadLocalX509TrustManagerTest.java  | 35 ++++++++----
 77 files changed, 607 insertions(+), 609 deletions(-)

diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
index 7a18c41b3..b4ffa8672 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/PKIXValidationOptions.java
@@ -36,7 +36,7 @@ public class PKIXValidationOptions {
     private boolean processCredentialCRLs;
     
     /** Default verification depth. */
-    private Integer defaultVerificationDepth;
+    @Nonnull private Integer defaultVerificationDepth;
 
     /** Constructor. */
     public PKIXValidationOptions() {
@@ -121,7 +121,7 @@ public class PKIXValidationOptions {
      * 
      * @return Returns the defaultVerificationDepth.
      */
-    public Integer getDefaultVerificationDepth() {
+    @Nonnull public Integer getDefaultVerificationDepth() {
         return defaultVerificationDepth;
     }
 
@@ -134,8 +134,7 @@ public class PKIXValidationOptions {
      * @param depth default verification depth to set
      */
     public void setDefaultVerificationDepth(@Nonnull final Integer depth) {
-        Constraint.isNotNull(depth, "Default verification depth cannot be null");
-        this.defaultVerificationDepth = depth;
+        defaultVerificationDepth = Constraint.isNotNull(depth, "Default verification depth cannot be null");
     }
 
 }
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
index a48479037..6750ede43 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/X509Support.java
@@ -132,11 +132,8 @@ public class X509Support {
      * @since 1.2
      */
     @Nullable public static X509Certificate determineEntityCertificate(
-            @Nullable final Collection<X509Certificate> certs, @Nullable final PrivateKey privateKey)
+            @Nonnull final Collection<X509Certificate> certs, @Nonnull final PrivateKey privateKey)
                     throws SecurityException {
-        if (certs == null || privateKey == null) {
-            return null;
-        }
 
         for (final X509Certificate certificate : certs) {
             try {
@@ -165,10 +162,7 @@ public class X509Support {
      * 
      * @return the common names that appear in the DN in the order they appear, or null if the given DN is null
      */
-    @Nullable public static List<String> getCommonNames(@Nullable final X500Principal dn) {
-        if (dn == null) {
-            return null;
-        }
+    @Nonnull public static List<String> getCommonNames(@Nonnull final X500Principal dn) {
 
         LOG.debug("Extracting CNs from the following DN: {}", dn.toString());
         final RDNSequence attrs = NameReader.readX500Principal(dn);
@@ -190,11 +184,8 @@ public class X509Support {
      * 
      * @return the alt names, of the given type, within the cert
      */
-    @Nullable public static List<?> getAltNames(@Nullable final X509Certificate certificate,
-            @Nullable final Integer[] nameTypes) {
-        if (certificate == null || nameTypes == null || nameTypes.length == 0) {
-            return null;
-        }
+    @Nonnull public static List<?> getAltNames(@Nonnull final X509Certificate certificate,
+            @Nonnull @NotEmpty final Integer[] nameTypes) {
 
         final List<Object> altNames = new LinkedList<>();
         final GeneralNameType[] types = new GeneralNameType[nameTypes.length];
@@ -224,19 +215,17 @@ public class X509Support {
      * 
      * @return list of subject names in the certificate
      */
-    @Nullable public static List<?> getSubjectNames(@Nullable final X509Certificate certificate,
-            @Nullable final Integer[] altNameTypes) {
+    @Nonnull public static List<?> getSubjectNames(@Nonnull final X509Certificate certificate,
+            @Nonnull @NotEmpty final Integer[] altNameTypes) {
         final List<Object> issuerNames = new LinkedList<>();
         
-        if (certificate != null) {
-            final List<String> entityCertCNs = X509Support.getCommonNames(certificate.getSubjectX500Principal());
-            if (entityCertCNs != null && !entityCertCNs.isEmpty()) {
-                issuerNames.add(entityCertCNs.get(0));
-            }
-            final List<?> entityAltNames = X509Support.getAltNames(certificate, altNameTypes);
-            if (entityAltNames != null) {
-                issuerNames.addAll(entityAltNames);
-            }
+        final List<String> entityCertCNs = X509Support.getCommonNames(certificate.getSubjectX500Principal());
+        if (entityCertCNs != null && !entityCertCNs.isEmpty()) {
+            issuerNames.add(entityCertCNs.get(0));
+        }
+        final List<?> entityAltNames = X509Support.getAltNames(certificate, altNameTypes);
+        if (entityAltNames != null) {
+            issuerNames.addAll(entityAltNames);
         }
 
         return issuerNames;
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
index a1094c519..9c24d3572 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/x509/tls/CertificateNameOptions.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.security.x509.tls;
 
-import java.util.Collections;
 import java.util.LinkedHashSet;
 import java.util.Set;
 
@@ -30,6 +29,8 @@ import org.opensaml.security.x509.X500DNHandler;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
+import net.shibboleth.shared.logic.Constraint;
 
 /**
  * Options for deriving message context issuer names from an client TLS X.509 certificate.
@@ -43,20 +44,20 @@ public class CertificateNameOptions implements Cloneable {
     private boolean evaluateSubjectCommonName;
 
     /** The set of types of subject alternative names evaluate as derived issuer entity ID names. */
-    private Set<Integer> subjectAltNames;
+    @Nonnull private Set<Integer> subjectAltNames;
 
     /**
      * Responsible for serializing X.500 names to strings from certificate-derived
      * {@link javax.security.auth.x500.X500Principal} instances.
      */
-    private X500DNHandler x500DNHandler;
+    @Nonnull private X500DNHandler x500DNHandler;
 
     /** The format specifier for serializing X.500 subject names to strings. */
-    private String x500SubjectDNFormat;
+    @Nonnull private String x500SubjectDNFormat;
 
     /** Constructor. */
     public CertificateNameOptions() {
-        subjectAltNames = Collections.emptySet();
+        subjectAltNames = CollectionSupport.emptySet();
         x500DNHandler = new InternalX500DNHandler();
         x500SubjectDNFormat = X500DNHandler.FORMAT_RFC2253;
     }
@@ -115,9 +116,9 @@ public class CertificateNameOptions implements Cloneable {
      */
     public void setSubjectAltNames(@Nullable @NonnullElements final Set<Integer> names) {
         if (names == null) {
-            subjectAltNames = Collections.emptySet();
+            subjectAltNames = CollectionSupport.emptySet();
         } else {
-            subjectAltNames = Set.copyOf(names);
+            subjectAltNames = CollectionSupport.copyToSet(names);
         }
     }
 
@@ -127,7 +128,7 @@ public class CertificateNameOptions implements Cloneable {
      * 
      * @return Returns the x500DNHandler.
      */
-    public X500DNHandler getX500DNHandler() {
+    @Nonnull public X500DNHandler getX500DNHandler() {
         return x500DNHandler;
     }
 
@@ -137,11 +138,8 @@ public class CertificateNameOptions implements Cloneable {
      * 
      * @param handler the new x500DNHandler value.
      */
-    public void setX500DNHandler(final X500DNHandler handler) {
-        if (handler == null) {
-            throw new IllegalArgumentException("X500DNHandler may not be null");
-        }
-        x500DNHandler = handler;
+    public void setX500DNHandler(@Nonnull final X500DNHandler handler) {
+        x500DNHandler = Constraint.isNotNull(handler, "X500DNHandler cannot be null");
     }
     
     /**
@@ -149,7 +147,7 @@ public class CertificateNameOptions implements Cloneable {
      * 
      * @return Returns the x500SubjectDNFormat.
      */
-    public String getX500SubjectDNFormat() {
+    @Nonnull public String getX500SubjectDNFormat() {
         return x500SubjectDNFormat;
     }
 
@@ -158,8 +156,8 @@ public class CertificateNameOptions implements Cloneable {
      * 
      * @param format the new x500SubjectDNFormat value.
      */
-    public void setX500SubjectDNFormat(final String format) {
-        x500SubjectDNFormat = format;
+    public void setX500SubjectDNFormat(@Nonnull final String format) {
+        x500SubjectDNFormat = Constraint.isNotNull(format, "X.500 Subject DN Format cannot be null");
     }
     
     /** {@inheritDoc} */
@@ -173,12 +171,11 @@ public class CertificateNameOptions implements Cloneable {
         }
 
         clonedOptions.subjectAltNames = new LinkedHashSet<>();
-        clonedOptions.subjectAltNames.addAll(this.subjectAltNames);
+        clonedOptions.subjectAltNames.addAll(subjectAltNames);
 
-        clonedOptions.x500DNHandler = this.x500DNHandler.clone();
+        clonedOptions.x500DNHandler = x500DNHandler.clone();
 
         return clonedOptions;
     }
 
-}
-
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java
index dd1c5776d..6545b2c54 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableCredentialCriteriaRegistry.java
@@ -31,10 +31,10 @@ import javax.annotation.Nullable;
 import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
 import org.opensaml.security.SecurityException;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.Criterion;
 
 /**
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
index d79bd514b..066f4f757 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterion.java
@@ -22,12 +22,12 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.criteria.UsageCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating whether a credential contains a particular usage specifier.
@@ -36,10 +36,10 @@ public class EvaluableUsageCredentialCriterion extends AbstractTriStatePredicate
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableUsageCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableUsageCredentialCriterion.class);
 
     /** Base criteria. */
-    private final UsageType usage;
+    @Nonnull private final UsageType usage;
 
     /**
      * Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
index 87cd075bf..0efc0615e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterion.java
@@ -18,18 +18,17 @@
 package org.opensaml.security.credential.criteria.impl;
 
 import java.security.cert.X509CertSelector;
-import java.security.cert.X509Certificate;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating whether a credential's certificate meets the criteria
@@ -40,10 +39,10 @@ public class EvaluableX509CertSelectorCredentialCriterion extends AbstractTriSta
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableX509CertSelectorCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509CertSelectorCredentialCriterion.class);
 
     /** Base criteria. */
-    private final X509CertSelector certSelector;
+    @Nonnull private final X509CertSelector certSelector;
 
     /**
      * Constructor.
@@ -64,13 +63,7 @@ public class EvaluableX509CertSelectorCredentialCriterion extends AbstractTriSta
             return false;
         }
 
-        final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
-        if (entityCert == null) {
-            log.info("X509Credential did not contain an entity certificate, cannot evaluate X509CertSelector criteria");
-            return false;
-        }
-
-        return certSelector.match(entityCert);
+        return certSelector.match(((X509Credential) target).getEntityCertificate());
     }
     
     /** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
index 1156ba875..499922dd3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterion.java
@@ -29,6 +29,7 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.apache.commons.codec.binary.Hex;
@@ -36,7 +37,6 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509DigestCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 
 /**
@@ -47,13 +47,13 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableX509DigestCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509DigestCredentialCriterion.class);
     
     /** Digest algorithm. */
-    private final String algorithm;
+    @Nonnull private final String algorithm;
     
     /** X.509 certificate digest. */
-    private final byte[] x509digest;
+    @Nonnull private final byte[] x509digest;
 
     /**
      * Constructor.
@@ -74,8 +74,7 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
     public EvaluableX509DigestCredentialCriterion(@Nonnull final String alg, @Nonnull final byte[] digest) {
         x509digest = Constraint.isNotEmpty(digest, "X.509 digest cannot be null or empty");
         final String trimmed = StringSupport.trimOrNull(alg);
-        Constraint.isNotNull(trimmed, "Certificate digest algorithm cannot be null or empty");
-        algorithm = trimmed;
+        algorithm = Constraint.isNotNull(trimmed, "Certificate digest algorithm cannot be null or empty");
     }
 
     /** {@inheritDoc} */
@@ -89,10 +88,6 @@ public final class EvaluableX509DigestCredentialCriterion extends AbstractTriSta
         }
 
         final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
-        if (entityCert == null) {
-            log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
-            return false;
-        }
         
         try {
             final MessageDigest hasher = MessageDigest.getInstance(algorithm);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
index 7346997c9..906914885 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterion.java
@@ -26,12 +26,12 @@ import javax.security.auth.x500.X500Principal;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509IssuerSerialCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating whether a credential's certificate contains a particular
@@ -41,13 +41,13 @@ public class EvaluableX509IssuerSerialCredentialCriterion extends AbstractTriSta
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableX509IssuerSerialCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509IssuerSerialCredentialCriterion.class);
 
     /** Base criteria. */
-    private final X500Principal issuer;
+    @Nonnull private final X500Principal issuer;
 
     /** Base criteria. */
-    private final BigInteger serialNumber;
+    @Nonnull private final BigInteger serialNumber;
 
     /**
      * Constructor.
@@ -82,11 +82,6 @@ public class EvaluableX509IssuerSerialCredentialCriterion extends AbstractTriSta
         }
 
         final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
-        if (entityCert == null) {
-            log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
-            return false;
-        }
-        
         return issuer.equals(entityCert.getIssuerX500Principal()) && serialNumber.equals(entityCert.getSerialNumber());
     }
     
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
index ead0ffb7f..f505a5365 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterion.java
@@ -25,6 +25,7 @@ import javax.annotation.Nullable;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.apache.commons.codec.binary.Hex;
 import org.opensaml.security.credential.Credential;
@@ -32,7 +33,6 @@ import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509SubjectKeyIdentifierCriterion;
 import org.opensaml.security.x509.X509Support;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating whether a credential's certificate contains a particular
@@ -42,10 +42,10 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
         implements EvaluableCredentialCriterion {
     
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectKeyIdentifierCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectKeyIdentifierCredentialCriterion.class);
     
     /** Base criteria. */
-    private final byte[] ski;
+    @Nonnull private final byte[] ski;
     
     /**
      * Constructor.
@@ -77,10 +77,6 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterion extends Abstra
         }
         
         final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
-        if (entityCert == null) {
-            log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
-            return false;
-        }
         
         final byte[] credSKI = X509Support.getSubjectKeyIdentifier(entityCert);
         if (credSKI == null || credSKI.length == 0) {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
index 5a764a538..cc42615fa 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterion.java
@@ -25,12 +25,12 @@ import javax.security.auth.x500.X500Principal;
 
 import net.shibboleth.shared.logic.AbstractTriStatePredicate;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509SubjectNameCriterion;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Instance of evaluable credential criteria for evaluating whether a credential's certificate contains a particular
@@ -40,10 +40,10 @@ public class EvaluableX509SubjectNameCredentialCriterion extends AbstractTriStat
         implements EvaluableCredentialCriterion {
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectNameCredentialCriterion.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(EvaluableX509SubjectNameCredentialCriterion.class);
 
     /** Base criteria. */
-    private final X500Principal subjectName;
+    @Nonnull private final X500Principal subjectName;
 
     /**
      * Constructor.
@@ -74,10 +74,6 @@ public class EvaluableX509SubjectNameCredentialCriterion extends AbstractTriStat
         }
 
         final X509Certificate entityCert = ((X509Credential) target).getEntityCertificate();
-        if (entityCert == null) {
-            log.info("X509Credential did not contain an entity certificate, does not satisfy criteria");
-            return false;
-        }
 
         return subjectName.equals(entityCert.getSubjectX500Principal());
     }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
index 75d89a600..b3cfba4e8 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractChainingCredentialResolver.java
@@ -27,14 +27,15 @@ import javax.annotation.Nullable;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialResolver;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * An abstract implementation of {@link CredentialResolver} which chains together one or more underlying credential 
@@ -58,7 +59,7 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
      * @param credResolvers the list of chained credential resolvers
      */
     public AbstractChainingCredentialResolver(@Nonnull @NonnullElements final List<ResolverType> credResolvers) {
-        resolvers = List.copyOf(Constraint.isNotNull(credResolvers, "CredentialResolver list cannot be null"));
+        resolvers = CollectionSupport.copyToList(Constraint.isNotNull(credResolvers, "CredentialResolver list cannot be null"));
     }
 
     /**
@@ -85,10 +86,10 @@ public abstract class AbstractChainingCredentialResolver<ResolverType extends Cr
     public class CredentialIterable implements Iterable<Credential> {
 
         /** The chaining credential resolver which owns this instance. */
-        private AbstractChainingCredentialResolver<ResolverType> parent;
+        @Nonnull private AbstractChainingCredentialResolver<ResolverType> parent;
 
         /** The criteria set on which to base resolution. */
-        private CriteriaSet critSet;
+        @Nullable private CriteriaSet critSet;
 
         /**
          * Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java
index ba4963c88..2dd612a44 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/AbstractCriteriaFilteringCredentialResolver.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.security.credential.impl;
 
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 import java.util.function.Predicate;
@@ -25,6 +24,7 @@ import java.util.function.Predicate;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.PredicateSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.Criterion;
@@ -53,7 +53,6 @@ public abstract class AbstractCriteriaFilteringCredentialResolver extends Abstra
      * Constructor.
      */
     public AbstractCriteriaFilteringCredentialResolver() {
-        super();
         satisfyAllPredicates = true;
     }
 
@@ -113,13 +112,14 @@ public abstract class AbstractCriteriaFilteringCredentialResolver extends Abstra
      * @throws ResolverException thrown if there is an error obtaining an instance of EvaluableCredentialCriterion
      *                           from the EvaluableCredentialCriteriaRegistry
      */
-    private Set<Predicate<Credential>> getPredicates(@Nullable final CriteriaSet criteriaSet)
+    @Nonnull private Set<Predicate<Credential>> getPredicates(@Nullable final CriteriaSet criteriaSet)
             throws ResolverException {
         if (criteriaSet == null) {
-            return Collections.emptySet();
+            return CollectionSupport.emptySet();
         }
         final Set<Predicate<Credential>> predicates = new HashSet<>(criteriaSet.size());
         for (final Criterion criteria : criteriaSet) {
+            assert criteria != null;
             if (criteria instanceof EvaluableCredentialCriterion) {
                 predicates.add((EvaluableCredentialCriterion) criteria);
             } else {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
index 5d0f6f247..37008f694 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/CollectionCredentialResolver.java
@@ -42,7 +42,7 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class CollectionCredentialResolver extends AbstractCriteriaFilteringCredentialResolver {
     
     /** The collection of credentials which is the underlying store for the resolver. */
-    private final Collection<Credential> collection;
+    @Nonnull private final Collection<Credential> collection;
     
     /**
      * Constructor.
@@ -51,7 +51,6 @@ public class CollectionCredentialResolver extends AbstractCriteriaFilteringCrede
      *
      */
     public CollectionCredentialResolver() {
-        super();
         collection = new ArrayList<>();
     }
     
@@ -61,7 +60,6 @@ public class CollectionCredentialResolver extends AbstractCriteriaFilteringCrede
      * @param credentials the credential collection which is the backing store for the resolver
      */
     public CollectionCredentialResolver(@Nonnull final Collection<Credential> credentials) {
-        super();
         collection = credentials;
     }
     
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
index d30a5048c..43c6d3bb4 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java
@@ -25,13 +25,14 @@ import java.security.UnrecoverableEntryException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -43,7 +44,6 @@ import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * A {@link org.opensaml.security.credential.CredentialResolver} that extracts {@link Credential}'s from a key store.
@@ -56,16 +56,16 @@ import org.slf4j.LoggerFactory;
 public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredentialResolver {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(KeyStoreCredentialResolver.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(KeyStoreCredentialResolver.class);
 
     /** Key store credentials are retrieved from. */
-    private final KeyStore keyStore;
+    @Nonnull private final KeyStore keyStore;
 
     /** Passwords for keys. The key must be the entityID, the value the password. */
-    private final Map<String, String> keyPasswords;
+    @Nonnull private final Map<String, String> keyPasswords;
 
     /** Usage type of all keys in the store. */
-    private final UsageType keystoreUsage;
+    @Nonnull private final UsageType keystoreUsage;
 
     /**
      * Constructor.
@@ -110,10 +110,11 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
     @Nonnull protected Iterable<Credential> resolveFromSource(@Nullable final CriteriaSet criteriaSet)
             throws ResolverException {
 
-        checkCriteriaRequirements(criteriaSet);
+        ;
 
-        final String entityID = criteriaSet.get(EntityIdCriterion.class).getEntityId();
-        final UsageCriterion usageCriteria = criteriaSet.get(UsageCriterion.class);
+        final String entityID = checkCriteriaRequirements(criteriaSet).getEntityId();
+        
+        final UsageCriterion usageCriteria = criteriaSet != null ? criteriaSet.get(UsageCriterion.class) : null;
         final UsageType usage;
         if (usageCriteria != null) {
             usage = usageCriteria.getUsage();
@@ -123,7 +124,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
         if (!matchUsage(keystoreUsage, usage)) {
             log.debug("Specified usage criteria {} does not match keystore usage {}", usage, keystoreUsage);
             log.debug("Can not resolve credentials from this keystore");
-            return Collections.emptySet();
+            return CollectionSupport.emptySet();
         }
 
         KeyStore.PasswordProtection keyPassword = null;
@@ -146,23 +147,30 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
 
         if (keyStoreEntry == null) {
             log.debug("Keystore entry for entityID (keystore alias) {} does not exist", entityID);
-            return Collections.emptySet();
+            return CollectionSupport.emptySet();
         }
 
         final Credential credential = buildCredential(keyStoreEntry, entityID, keystoreUsage);
-        return Collections.singleton(credential);
+        return CollectionSupport.singleton(credential);
     }
 
     /**
      * Check that required credential criteria are available.
      * 
      * @param criteriaSet the credential criteria set to evaluate
+     * 
+     * @return the required {@link EntityIdCriterion}. 
      */
-    protected void checkCriteriaRequirements(@Nullable final CriteriaSet criteriaSet) {
-        if (criteriaSet == null || criteriaSet.get(EntityIdCriterion.class) == null) {
+    @Nonnull protected EntityIdCriterion checkCriteriaRequirements(@Nullable final CriteriaSet criteriaSet) {
+        
+        final EntityIdCriterion criterion = criteriaSet != null ? criteriaSet.get(EntityIdCriterion.class) : null;
+        
+        if (criterion == null) {
             log.error("EntityIDCriterion was not specified in the criteria set, resolution cannot be attempted");
             throw new IllegalArgumentException("No EntityIDCriterion was available in criteria set");
         }
+        
+        return criterion;
     }
 
     /**
@@ -193,13 +201,12 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
 
         log.debug("Building credential from keystore entry for entityID {}, usage type {}", entityID, usage);
 
-        if (keyStoreEntry instanceof KeyStore.PrivateKeyEntry) {
-            return processPrivateKeyEntry((KeyStore.PrivateKeyEntry) keyStoreEntry, entityID, keystoreUsage);
-        } else if (keyStoreEntry instanceof KeyStore.TrustedCertificateEntry) {
-            return processTrustedCertificateEntry((KeyStore.TrustedCertificateEntry) keyStoreEntry, entityID,
-                    keystoreUsage);
-        } else if (keyStoreEntry instanceof KeyStore.SecretKeyEntry) {
-            return processSecretKeyEntry((KeyStore.SecretKeyEntry) keyStoreEntry, entityID, keystoreUsage);
+        if (keyStoreEntry instanceof KeyStore.PrivateKeyEntry entry) {
+            return processPrivateKeyEntry(entry, entityID, keystoreUsage);
+        } else if (keyStoreEntry instanceof KeyStore.TrustedCertificateEntry entry) {
+            return processTrustedCertificateEntry(entry, entityID, keystoreUsage);
+        } else if (keyStoreEntry instanceof KeyStore.SecretKeyEntry entry) {
+            return processSecretKeyEntry(entry, entityID, keystoreUsage);
         } else {
             throw new ResolverException("KeyStore entry was of an unsupported type: "
                     + keyStoreEntry.getClass().getName());
@@ -214,7 +221,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
      * @param usage the usage type to set
      * @return new X509Credential instance
      */
-    protected X509Credential processTrustedCertificateEntry(
+    @Nonnull protected X509Credential processTrustedCertificateEntry(
             @Nonnull final KeyStore.TrustedCertificateEntry trustedCertEntry, @Nonnull final String entityID,
             @Nonnull final UsageType usage) {
 
@@ -241,7 +248,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
      * @param usage the usage type to set
      * @return new X509Credential instance
      */
-    protected X509Credential processPrivateKeyEntry(@Nonnull final KeyStore.PrivateKeyEntry privateKeyEntry,
+    @Nonnull protected X509Credential processPrivateKeyEntry(@Nonnull final KeyStore.PrivateKeyEntry privateKeyEntry,
             @Nonnull final String entityID, @Nonnull final UsageType usage) {
 
         log.debug("Processing PrivateKeyEntry from keystore");
@@ -265,7 +272,7 @@ public class KeyStoreCredentialResolver extends AbstractCriteriaFilteringCredent
      * @param usage the usage type to set
      * @return new Credential instance
      */
-    protected Credential processSecretKeyEntry(@Nonnull final SecretKeyEntry secretKeyEntry,
+    @Nonnull protected Credential processSecretKeyEntry(@Nonnull final SecretKeyEntry secretKeyEntry,
             @Nonnull final String entityID, @Nonnull final UsageType usage) {
         log.debug("Processing SecretKeyEntry from keystore");
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
index 3a371fceb..e1a7a5ba6 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/StaticCredentialResolver.java
@@ -43,7 +43,7 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class StaticCredentialResolver extends AbstractCredentialResolver {
     
     /** List of credentials held by this resolver. */
-    private List<Credential> creds;
+    @Nonnull private final List<Credential> creds;
     
     /**
      * Constructor.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
index 326dba3a5..2942f26b9 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolver.java
@@ -18,10 +18,10 @@
 package org.opensaml.security.httpclient.impl;
 
 import java.security.Key;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.opensaml.security.credential.CredentialSupport;
 import org.opensaml.security.httpclient.HttpClientSecurityConfiguration;
@@ -34,6 +34,7 @@ import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.ObjectSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
@@ -55,20 +56,23 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
     private Logger log = LoggerFactory.getLogger(BasicHttpClientSecurityParametersResolver.class);
 
     /** {@inheritDoc} */
-    public Iterable<HttpClientSecurityParameters> resolve(@Nonnull final CriteriaSet criteria) 
+    @Nonnull public Iterable<HttpClientSecurityParameters> resolve(@Nullable final CriteriaSet criteria) 
             throws ResolverException {
         
         final HttpClientSecurityParameters params = resolveSingle(criteria);
         if (params != null) {
-            return Collections.singletonList(params);
+            return CollectionSupport.singletonList(params);
         } else {
-            return Collections.emptyList();
+            return CollectionSupport.emptyList();
         }
     }
 
     /** {@inheritDoc} */
-    public HttpClientSecurityParameters resolveSingle(@Nonnull final CriteriaSet criteria) throws ResolverException {
+    @Nullable public HttpClientSecurityParameters resolveSingle(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
         Constraint.isNotNull(criteria, "CriteriaSet was null");
+        assert criteria != null;
+        
         Constraint.isNotNull(criteria.get(HttpClientSecurityConfigurationCriterion.class), 
                 "Resolver requires an instance of HttpClientSecurityConfigurationCriterion");
         
@@ -93,8 +97,10 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
     protected void resolveAndPopulateParams(@Nonnull final HttpClientSecurityParameters params, 
             @Nonnull final CriteriaSet criteria) {
         
-        final List<HttpClientSecurityConfiguration> configs = 
-                criteria.get(HttpClientSecurityConfigurationCriterion.class).getConfigurations();
+        final HttpClientSecurityConfigurationCriterion httpCriterion =
+                criteria.get(HttpClientSecurityConfigurationCriterion.class);
+        assert httpCriterion != null;
+        final List<HttpClientSecurityConfiguration> configs = httpCriterion.getConfigurations();
         
         for (final HttpClientSecurityConfiguration config : configs) {
             params.setClientTLSCredential(ObjectSupport.firstNonNull(params.getClientTLSCredential(), 
@@ -113,8 +119,9 @@ public class BasicHttpClientSecurityParametersResolver implements HttpClientSecu
                     config.isServerTLSFailureFatal()));
         }
         
-        if (criteria.contains(TLSCriteriaSetCriterion.class)) {
-            params.setTLSCriteriaSet(criteria.get(TLSCriteriaSetCriterion.class).getCriteria());
+        final TLSCriteriaSetCriterion tlsCriterion = criteria.get(TLSCriteriaSetCriterion.class);
+        if (tlsCriterion != null) {
+            params.setTLSCriteriaSet(tlsCriterion.getCriteria());
         }
     }
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
index 79a371696..97246aea8 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactory.java
@@ -44,10 +44,10 @@ import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustEngineContext;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustEngineSupport;
 import org.opensaml.security.x509.tls.impl.ThreadLocalX509TrustManager;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.httpclient.HttpClientSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 /**
@@ -110,15 +110,15 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 public class SecurityEnhancedTLSSocketFactory implements LayeredConnectionSocketFactory {
     
     /** Instance of {@link ThreadLocalClientTLSCredentialHandler} to use.  */
-    private static final ThreadLocalServerTLSHandler SERVER_TLS_HANDLER =
+    @Nonnull private static final ThreadLocalServerTLSHandler SERVER_TLS_HANDLER =
             new ThreadLocalServerTLSHandler();
 
     /** Instance of {@link ThreadLocalClientTLSCredentialHandler} to use.  */
-    private static final ThreadLocalClientTLSCredentialHandler CLIENT_TLS_HANDLER =
+    @Nonnull private static final ThreadLocalClientTLSCredentialHandler CLIENT_TLS_HANDLER =
             new ThreadLocalClientTLSCredentialHandler();
 
     /** Logger. */
-    private final Logger log = LoggerFactory.getLogger(SecurityEnhancedTLSSocketFactory.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(SecurityEnhancedTLSSocketFactory.class);
     
     /** The HttpClient socket factory instance wrapped by this implementation. */
     @Nonnull private LayeredConnectionSocketFactory wrappedFactory;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
index 5153d0a28..529ac462a 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseClientCertAuthSecurityHandler.java
@@ -37,8 +37,8 @@ import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509Support;
 import org.opensaml.security.x509.tls.CertificateNameOptions;
+import org.opensaml.security.x509.tls.ClientTLSValidationParameters;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
@@ -48,6 +48,7 @@ import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.codec.Base64Support;
 import net.shibboleth.shared.codec.EncodingException;
 import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.NonnullSupplier;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
@@ -157,10 +158,13 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
             @Nonnull final MessageContext messageContext) {
         final ClientTLSSecurityParametersContext secContext = 
                 messageContext.getSubcontext(ClientTLSSecurityParametersContext.class);
-        if (secContext == null || secContext.getValidationParameters() == null)  {
-            return null;
+        
+        final ClientTLSValidationParameters params = secContext != null ? secContext.getValidationParameters() : null;
+        if (params != null) {
+            return params.getX509TrustEngine();
         }
-        return secContext.getValidationParameters().getX509TrustEngine();
+        
+        return null;
     }
 
     /** {@inheritDoc} */
@@ -178,11 +182,12 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
                     getLogPrefix());
             return false;
         }
-        if (secContext == null || secContext.getValidationParameters() == null 
-                || secContext.getValidationParameters().getCertificateNameOptions() == null)  {
+        
+        final ClientTLSValidationParameters params = secContext != null ? secContext.getValidationParameters() : null;
+        if (params == null || params.getCertificateNameOptions() == null)  {
             throw new MessageHandlerException("CertificateNameOptions was not available from the MessageContext");
         }
-        certNameOptions = secContext.getValidationParameters().getCertificateNameOptions();
+        certNameOptions = params.getCertificateNameOptions();
         
         return true;
     }
@@ -315,6 +320,7 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
 
         final CriteriaSet criteriaSet = new CriteriaSet();
         if (!Strings.isNullOrEmpty(entityID)) {
+            assert entityID != null;
             criteriaSet.add(new EntityIdCriterion(entityID));
         }
 
@@ -375,26 +381,29 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
      * @throws MessageHandlerException thrown if there is error during processing
      */
     @Nullable protected String evaluateCertificateNameDerivedPresenters(
-            @Nullable final X509Credential requestCredential, @Nonnull final MessageContext messageContext)
+            @Nonnull final X509Credential requestCredential, @Nonnull final MessageContext messageContext)
                     throws MessageHandlerException {
 
         String candidatePresenter = null;
 
-        if (getCertificateNameOptions().evaluateSubjectDN()) {
+        final CertificateNameOptions localOptions = certNameOptions;
+        assert localOptions != null;
+        
+        if (localOptions.evaluateSubjectDN()) {
             candidatePresenter = evaluateSubjectDN(requestCredential, messageContext);
             if (candidatePresenter != null) {
                 return candidatePresenter;
             }
         }
 
-        if (!getCertificateNameOptions().getSubjectAltNames().isEmpty()) {
+        if (!localOptions.getSubjectAltNames().isEmpty()) {
             candidatePresenter = evaluateSubjectAltNames(requestCredential, messageContext);
             if (candidatePresenter != null) {
                 return candidatePresenter;
             }
         }
 
-        if (getCertificateNameOptions().evaluateSubjectCommonName()) {
+        if (localOptions.evaluateSubjectCommonName()) {
             candidatePresenter = evaluateSubjectCommonName(requestCredential, messageContext);
             if (candidatePresenter != null) {
                 return candidatePresenter;
@@ -472,7 +481,8 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
 
         log.debug("{} Evaluating client cert by deriving presenter from subject alt names", getLogPrefix());
         final X509Certificate certificate = requestCredential.getEntityCertificate();
-        for (final Integer altNameType : getCertificateNameOptions().getSubjectAltNames()) {
+        assert certNameOptions != null;
+        for (final Integer altNameType : certNameOptions.getSubjectAltNames()) {
             log.debug("{} Evaluating alt names of type: {}", getLogPrefix(), altNameType.toString());
             final List<String> altNames = getAltNames(certificate, altNameType);
             for (final String altName : altNames) {
@@ -511,16 +521,16 @@ public abstract class BaseClientCertAuthSecurityHandler extends BaseTrustEngineS
      * @return the subject name
      */
     @Nullable protected String getSubjectName(@Nonnull final X509Certificate cert) {
-        if (cert == null) {
-            return null;
-        }
+        final CertificateNameOptions localOptions = certNameOptions;
+        assert localOptions != null;
+
         String name = null;
-        if (!Strings.isNullOrEmpty(getCertificateNameOptions().getX500SubjectDNFormat())) {
+        if (!Strings.isNullOrEmpty(localOptions.getX500SubjectDNFormat())) {
             name =
-                    getCertificateNameOptions().getX500DNHandler().getName(cert.getSubjectX500Principal(),
-                            getCertificateNameOptions().getX500SubjectDNFormat());
+                    localOptions.getX500DNHandler().getName(cert.getSubjectX500Principal(),
+                            localOptions.getX500SubjectDNFormat());
         } else {
-            name = getCertificateNameOptions().getX500DNHandler().getName(cert.getSubjectX500Principal());
+            name = localOptions.getX500DNHandler().getName(cert.getSubjectX500Principal());
         }
         log.debug("{} Extracted subject name from certificate: {}", getLogPrefix(), name);
         return name;
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
index 1905146e5..dd723462e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/BaseTrustEngineSecurityHandler.java
@@ -26,8 +26,8 @@ import org.opensaml.messaging.handler.MessageHandlerException;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.trust.TrustEngine;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 /**
@@ -124,7 +124,8 @@ public abstract class BaseTrustEngineSecurityHandler<TokenType> extends Abstract
     protected boolean evaluate(@Nonnull final TokenType token, @Nullable final CriteriaSet criteriaSet)
             throws MessageHandlerException {
         try {
-            return getTrustEngine().validate(token, criteriaSet);
+            assert trustEngine != null;
+            return trustEngine.validate(token, criteriaSet);
         } catch (final SecurityException e) {
             log.error("{} There was an error evaluating the request's token using the trust engine: {}", getLogPrefix(),
                     e.getMessage());
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
index 42d1ff79d..d4175dc9c 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandler.java
@@ -17,7 +17,6 @@
 
 package org.opensaml.security.messaging.impl;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.function.Function;
 import java.util.function.Predicate;
@@ -37,11 +36,12 @@ import org.opensaml.security.httpclient.TLSCriteriaSetCriterion;
 import org.opensaml.security.httpclient.impl.BasicHttpClientSecurityConfiguration;
 import org.opensaml.security.messaging.HttpClientSecurityContext;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -155,7 +155,7 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
                     // is semi-required (depending on usage), and that can't be defaulted anyway.
                     //
                     // Just return an empty instance to satisfy contract requirements.
-                    return Collections.<HttpClientSecurityConfiguration>singletonList(
+                    return CollectionSupport.singletonList(
                             new BasicHttpClientSecurityConfiguration());
                 }
             };
@@ -206,8 +206,9 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
         
         final CriteriaSet criteria = new CriteriaSet(new HttpClientSecurityConfigurationCriterion(configs));
         
-        if (paramsCtx.getTLSCriteriaSetStrategy() != null) {
-            final CriteriaSet tlsCriteriaSet = paramsCtx.getTLSCriteriaSetStrategy().apply(messageContext); 
+        final Function<MessageContext,CriteriaSet> criteriaStrategy = paramsCtx.getTLSCriteriaSetStrategy();
+        if (criteriaStrategy != null) {
+            final CriteriaSet tlsCriteriaSet = criteriaStrategy.apply(messageContext); 
             if (tlsCriteriaSet  != null) {
                 criteria.add(new TLSCriteriaSetCriterion(tlsCriteriaSet));
             }
@@ -234,9 +235,9 @@ public class PopulateHttpClientSecurityParametersHandler extends AbstractMessage
      * @param params the parameters to process
      */
     protected void postProcessParams(@Nonnull final MessageContext messageContext, 
-            @Nonnull final HttpClientSecurityParameters params) {
+            @Nullable final HttpClientSecurityParameters params) {
         
-        if (clientTLSPredicate != null) { 
+        if (params != null && clientTLSPredicate != null) { 
             if (!clientTLSPredicate.test(messageContext)) {
                 log.debug("Configured client TLS predicate indicates to exclude client TLS credential");
                 params.setClientTLSCredential(null);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
index e60e3cd88..6fb2db23d 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ChainingTrustEngine.java
@@ -25,13 +25,14 @@ import javax.annotation.Nullable;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.trust.TrustEngine;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 /**
@@ -46,7 +47,7 @@ public class ChainingTrustEngine<TokenType> implements TrustEngine<TokenType> {
     @Nonnull private final Logger log = LoggerFactory.getLogger(ChainingTrustEngine.class);
 
     /** The chain of subordinate trust engines. */
-    @Nonnull @NonnullElements private List<TrustEngine<? super TokenType>> engines;
+    @Nonnull private List<TrustEngine<? super TokenType>> engines;
 
     /** 
      * Constructor.
@@ -55,7 +56,7 @@ public class ChainingTrustEngine<TokenType> implements TrustEngine<TokenType> {
      */
     public ChainingTrustEngine(
             @Nonnull @NonnullElements @ParameterName(name="chain") final List<TrustEngine<? super TokenType>> chain) {
-        engines = List.copyOf(Constraint.isNotNull(chain, "TrustEngine list cannot be null"));
+        engines = CollectionSupport.copyToList(Constraint.isNotNull(chain, "TrustEngine list cannot be null"));
     }
 
     /**
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java
index cb9b50652..b13fde70e 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngine.java
@@ -25,10 +25,10 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.CredentialResolver;
 import org.opensaml.security.trust.TrustedCredentialTrustEngine;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -42,13 +42,13 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class ExplicitKeyTrustEngine implements TrustedCredentialTrustEngine<Credential> {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEngine.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEngine.class);
 
     /** Resolver used for resolving trusted credentials. */
-    private final CredentialResolver credentialResolver;
+    @Nonnull private final CredentialResolver credentialResolver;
 
     /** Trust evaluator. */
-    private final ExplicitKeyTrustEvaluator trustEvaluator;
+    @Nonnull private final ExplicitKeyTrustEvaluator trustEvaluator;
 
     /**
      * Constructor.
@@ -72,11 +72,6 @@ public class ExplicitKeyTrustEngine implements TrustedCredentialTrustEngine<Cred
     public boolean validate(@Nonnull final Credential untrustedCredential,
             @Nullable final CriteriaSet trustBasisCriteria) throws SecurityException {
 
-        if (untrustedCredential == null) {
-            log.error("Credential was null, unable to perform validation");
-            return false;
-        }
-
         log.debug("Attempting to validate untrusted credential");
         try {
             final Iterable<Credential> trustedCredentials = getCredentialResolver().resolve(trustBasisCriteria);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java
index 71c6ee2d8..cacd66815 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEvaluator.java
@@ -23,7 +23,8 @@ import javax.annotation.Nonnull;
 
 import org.opensaml.security.credential.Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Auxillary trust evaluator for evaluating an untrusted key or credential against a trusted key or credential. Trust is
@@ -33,7 +34,7 @@ import org.slf4j.LoggerFactory;
 public class ExplicitKeyTrustEvaluator {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEvaluator.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitKeyTrustEvaluator.class);
 
     /**
      * Evaluate trust.
@@ -109,6 +110,7 @@ public class ExplicitKeyTrustEvaluator {
             @Nonnull final Iterable<Credential> trustedCredentials) {
 
         for (final Credential trustedCredential : trustedCredentials) {
+            assert trustedCredential != null;
             if (validate(untrustedCredential, trustedCredential)) {
                 return true;
             }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java
index 6f0ffd1fc..387c3dd90 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngine.java
@@ -26,10 +26,10 @@ import org.opensaml.security.credential.CredentialResolver;
 import org.opensaml.security.trust.TrustedCredentialTrustEngine;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -44,13 +44,13 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class ExplicitX509CertificateTrustEngine implements TrustedCredentialTrustEngine<X509Credential> {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEngine.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEngine.class);
 
     /** Resolver used for resolving trusted credentials. */
-    private final CredentialResolver credentialResolver;
+    @Nonnull private final CredentialResolver credentialResolver;
 
     /** Trust evaluator. */
-    private final ExplicitX509CertificateTrustEvaluator trustEvaluator;
+    @Nonnull private final ExplicitX509CertificateTrustEvaluator trustEvaluator;
 
     /**
      * Constructor.
@@ -75,11 +75,6 @@ public class ExplicitX509CertificateTrustEngine implements TrustedCredentialTrus
     public boolean validate(@Nonnull final X509Credential untrustedCredential,
             @Nullable final CriteriaSet trustBasisCriteria) throws SecurityException {
 
-        if (untrustedCredential == null) {
-            log.error("X.509 credential was null, unable to perform validation");
-            return false;
-        }
-
         log.debug("Attempting to validate untrusted credential");
         try {
             final Iterable<Credential> trustedCredentials = getCredentialResolver().resolve(trustBasisCriteria);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java
index c36cacc24..5699ba9b0 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEvaluator.java
@@ -24,7 +24,8 @@ import javax.annotation.Nonnull;
 import org.opensaml.security.credential.Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * Auxillary trust evaluator for evaluating an untrusted X509 certificate or credential against a trusted certificate or
@@ -35,7 +36,7 @@ import org.slf4j.LoggerFactory;
 public class ExplicitX509CertificateTrustEvaluator {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEvaluator.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(ExplicitX509CertificateTrustEvaluator.class);
 
     /**
      * Evaluate trust.
@@ -77,17 +78,7 @@ public class ExplicitX509CertificateTrustEvaluator {
     public boolean validate(@Nonnull final X509Credential untrustedCredential,
             @Nonnull final X509Credential trustedCredential) {
 
-        final X509Certificate untrustedCertificate = untrustedCredential.getEntityCertificate();
-        final X509Certificate trustedCertificate = trustedCredential.getEntityCertificate();
-        if (untrustedCertificate == null) {
-            log.debug("Untrusted credential contained no entity certificate, unable to evaluate");
-            return false;
-        } else if (trustedCertificate == null) {
-            log.debug("Trusted credential contained no entity certificate, unable to evaluate");
-            return false;
-        }
-
-        if (validate(untrustedCertificate, trustedCertificate)) {
+        if (validate(untrustedCredential.getEntityCertificate(), trustedCredential.getEntityCertificate())) {
             log.debug("Successfully validated untrusted credential against trusted certificate");
             return true;
         }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java
index 73d7bdb7f..701d145dc 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/trust/impl/TrustEngineX509TrustManager.java
@@ -33,8 +33,8 @@ import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 /**
@@ -98,6 +98,7 @@ public class TrustEngineX509TrustManager implements X509TrustManager {
         }
         
         try {
+            assert tlsTrustEngine != null;
             if (tlsTrustEngine.validate(credential, criteriaSet)) {
                 log.debug("Credential evaluated as trusted");
             } else {
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
index 5d36fde01..167692b61 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluator.java
@@ -18,9 +18,6 @@
 package org.opensaml.security.x509.impl;
 
 import java.security.cert.X509Certificate;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
@@ -31,7 +28,9 @@ import javax.security.auth.x500.X500Principal;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.x509.InternalX500DNHandler;
@@ -39,7 +38,6 @@ import org.opensaml.security.x509.X500DNHandler;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509Support;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import com.google.common.base.Strings;
 
@@ -73,7 +71,7 @@ import com.google.common.base.Strings;
 public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvaluator {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(BasicX509CredentialNameEvaluator.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(BasicX509CredentialNameEvaluator.class);
 
     /** Flag as to whether to perform name checking using credential's subject alt names. */
     private boolean checkSubjectAltNames;
@@ -85,10 +83,10 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
     private boolean checkSubjectDN;
 
     /** The set of types of subject alternative names to process. */
-    private Set<Integer> subjectAltNameTypes;
+    @Nonnull private Set<Integer> subjectAltNameTypes;
 
     /** Responsible for parsing and serializing X.500 names to/from {@link X500Principal} instances. */
-    private X500DNHandler x500DNHandler;
+    @Nonnull private X500DNHandler x500DNHandler;
 
     /** Constructor. */
     public BasicX509CredentialNameEvaluator() {
@@ -99,7 +97,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
         setCheckSubjectAltNames(true);
         setCheckSubjectDNCommonName(true);
         setCheckSubjectDN(true);
-        setSubjectAltNameTypes(new HashSet<>(Arrays.asList(X509Support.DNS_ALT_NAME, X509Support.URI_ALT_NAME)));
+        subjectAltNameTypes = CollectionSupport.setOf(X509Support.DNS_ALT_NAME, X509Support.URI_ALT_NAME);
     }
 
     /**
@@ -119,7 +117,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
      * 
      * @return the immutable set of alt name identifiers
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable public Set<Integer> getSubjectAltNameTypes() {
+    @Nonnull @NotLive @Unmodifiable public Set<Integer> getSubjectAltNameTypes() {
         return subjectAltNameTypes;
     }
 
@@ -133,9 +131,9 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
      */
     public void setSubjectAltNameTypes(@Nullable @NonnullElements final Set<Integer> nameTypes) {
         if (nameTypes == null) {
-            subjectAltNameTypes = Collections.emptySet();
+            subjectAltNameTypes = CollectionSupport.emptySet();
         } else {
-            subjectAltNameTypes = Set.copyOf(nameTypes);
+            subjectAltNameTypes = CollectionSupport.copyToSet(nameTypes);
         }
     }
 
@@ -346,6 +344,7 @@ public class BasicX509CredentialNameEvaluator implements X509CredentialNameEvalu
             log.debug("Extracted X500Principal from certificate: {}", x500DNHandler.getName(subjectPrincipal));
         }        
         for (final String trustedName : trustedNames) {
+            assert trustedName != null;
             X500Principal trustedNamePrincipal = null;
             try {
                 trustedNamePrincipal = x500DNHandler.parse(trustedName);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
index ebc5d45ff..146d65609 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluator.java
@@ -50,10 +50,10 @@ import org.opensaml.security.x509.X500DNHandler;
 import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.X509Support;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An implementation of {@link PKIXTrustEvaluator} that is based on the Java CertPath API.
@@ -61,16 +61,16 @@ import net.shibboleth.shared.logic.Constraint;
 public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(CertPathPKIXTrustEvaluator.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(CertPathPKIXTrustEvaluator.class);
     
     /**
      * Responsible for parsing and serializing X.500 names to/from
      * {@link javax.security.auth.x500.X500Principal} instances.
      */
-    private X500DNHandler x500DNHandler;
+    @Nonnull private X500DNHandler x500DNHandler;
     
     /** Options influencing processing behavior. */
-    private PKIXValidationOptions options;
+    @Nonnull private PKIXValidationOptions options;
 
     /** Constructor. */
     public CertPathPKIXTrustEvaluator() {
@@ -290,6 +290,7 @@ public class CertPathPKIXTrustEvaluator implements PKIXTrustEvaluator {
         log.trace("Constructing trust anchors for PKIX validation");
         final Set<TrustAnchor> trustAnchors = new HashSet<>();
         for (final X509Certificate cert : validationCertificates) {
+            assert cert != null;
             trustAnchors.add(buildTrustAnchor(cert));
         }
 
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java
index 610d176ae..a164c96e3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/DummyX509CredentialNameEvaluator.java
@@ -25,7 +25,8 @@ import javax.annotation.Nullable;
 import org.opensaml.security.SecurityException;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * A dummy implementation of {@link X509CredentialNameEvaluator} which always returns true.
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
index 1ff5ca527..811c7fdfe 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/KeyStoreX509CredentialAdapter.java
@@ -28,7 +28,6 @@ import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.List;
 
 import javax.annotation.Nonnull;
@@ -39,26 +38,27 @@ import org.opensaml.security.credential.Credential;
 import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
 
 /** A wrapper that changes a {@link KeyStore} in to a {@link X509Credential}. */
 public class KeyStoreX509CredentialAdapter extends AbstractCredential implements X509Credential {
 
     /** Class logger. */
-    private Logger log = LoggerFactory.getLogger(KeyStoreX509CredentialAdapter.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(KeyStoreX509CredentialAdapter.class);
 
     /** Keystore that contains the credential to be exposed. */
-    private final KeyStore keyStore;
+    @Nonnull private final KeyStore keyStore;
 
     /** Alias to the credential to be exposed. */
-    private final String credentialAlias;
+    @Nonnull private final String credentialAlias;
 
     /** Password for the key to be exposed. */
-    private final char[] keyPassword;
+    @Nullable private final char[] keyPassword;
 
     /**
      * Constructor.
@@ -69,7 +69,7 @@ public class KeyStoreX509CredentialAdapter extends AbstractCredential implements
      */
     public KeyStoreX509CredentialAdapter(@Nonnull @ParameterName(name="store") final KeyStore store,
             @Nonnull @ParameterName(name="alias") final String alias,
-            @Nullable  @ParameterName(name="password") final char[] password) {
+            @Nullable @ParameterName(name="password") final char[] password) {
         keyStore = Constraint.isNotNull(store, "Keystore cannot be null");
         credentialAlias = Constraint.isNotNull(StringSupport.trimOrNull(alias),
                 "Keystore alias cannot be null or empty");
@@ -79,24 +79,28 @@ public class KeyStoreX509CredentialAdapter extends AbstractCredential implements
     /** {@inheritDoc} */
     @Override
     @Nullable public Collection<X509CRL> getCRLs() {
-        return Collections.EMPTY_LIST;
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
     @Override
     @Nonnull public X509Certificate getEntityCertificate() {
         try {
-            return (X509Certificate) keyStore.getCertificate(credentialAlias);
+            final Certificate cert = keyStore.getCertificate(credentialAlias);
+            if (cert instanceof X509Certificate c) {
+                return c;
+            }
+            throw new KeyStoreException("Certificate entry was not an X509Certificate");
         } catch (final KeyStoreException e) {
             log.error("Error accessing {} certificates in keystore", credentialAlias, e);
-            return null;
+            throw new IllegalStateException("Error accessing certificate in keystore");
         }
     }
 
     /** {@inheritDoc} */
     @Override
     @Nonnull public Collection<X509Certificate> getEntityCertificateChain() {
-        List<X509Certificate> certsCollection = Collections.EMPTY_LIST;
+        List<X509Certificate> certsCollection = CollectionSupport.emptyList();
 
         try {
             final Certificate[] certs = keyStore.getCertificateChain(credentialAlias);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
index 55b1a5af8..c7981d162 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngine.java
@@ -29,10 +29,10 @@ import org.opensaml.security.x509.PKIXValidationInformation;
 import org.opensaml.security.x509.PKIXValidationInformationResolver;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -43,16 +43,16 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Credential> {
 
     /** Class logger. */
-    private final Logger log = LoggerFactory.getLogger(PKIXX509CredentialTrustEngine.class);
+    @Nonnull private final Logger log = LoggerFactory.getLogger(PKIXX509CredentialTrustEngine.class);
 
     /** Resolver used for resolving trusted credentials. */
-    private final PKIXValidationInformationResolver pkixResolver;
+    @Nonnull private final PKIXValidationInformationResolver pkixResolver;
 
     /** The external PKIX trust evaluator used to establish trust. */
-    private final PKIXTrustEvaluator pkixTrustEvaluator;
+    @Nonnull private final PKIXTrustEvaluator pkixTrustEvaluator;
     
     /** The external credential name evaluator used to establish trusted name compliance. */
-    private final X509CredentialNameEvaluator credNameEvaluator;
+    @Nullable private final X509CredentialNameEvaluator credNameEvaluator;
 
     /**
      * Constructor.
@@ -136,15 +136,6 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
         
         log.debug("Attempting PKIX validation of untrusted credential");
 
-        // Nulls here technically violate the method constraints anyway
-        if (untrustedCredential == null) {
-            log.error("X.509 credential was null, unable to perform validation");
-            return false;
-        } else if (untrustedCredential.getEntityCertificate() == null) {
-            log.error("Untrusted X.509 credential's entity certificate was null, unable to perform validation");
-            return false;
-        }
-
         Set<String> trustedNames = null;
         if (getPKIXResolver().supportsTrustedNameResolution()) {
             try {
@@ -189,6 +180,7 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
         }
 
         for (final PKIXValidationInformation validationInfo : validationInfoSet) {
+            assert validationInfo != null;
             try {
                 if (getPKIXTrustEvaluator().validate(validationInfo, untrustedX509Credential)) {
                     log.debug("Credential trust established via PKIX validation");
@@ -216,14 +208,15 @@ public class PKIXX509CredentialTrustEngine implements PKIXTrustEngine<X509Creden
     protected boolean checkNames(@Nullable final Set<String> trustedNames,
             @Nonnull final X509Credential untrustedCredential)  throws SecurityException {
         
-        if (getX509CredentialNameEvaluator() == null) {
+        if (credNameEvaluator == null) {
             log.debug("No credential name evaluator was available, skipping trusted name evaluation");
-           return true; 
+           return true;
         } else if (trustedNames == null) {
             log.debug("Trusted names was null, signalling PKIX resolver does not support trusted names resolution, " 
                     + "skipping trusted name evaluation");
-           return true; 
+           return true;
         } else {
+            assert credNameEvaluator != null;
             return credNameEvaluator.evaluate(untrustedCredential, trustedNames);
         }
     }
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
index 17e5e3c07..0431346bf 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolver.java
@@ -18,7 +18,6 @@
 package org.opensaml.security.x509.impl;
 
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -31,9 +30,8 @@ import org.opensaml.security.x509.PKIXValidationInformation;
 import org.opensaml.security.x509.PKIXValidationInformationResolver;
 import org.opensaml.security.x509.TrustedNamesCriterion;
 
-import com.google.common.collect.ImmutableSet;
-
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -44,10 +42,10 @@ import net.shibboleth.shared.resolver.ResolverException;
 public class StaticPKIXValidationInformationResolver implements PKIXValidationInformationResolver {
 
     /** The PKIX validation information to return. */
-    private final List<PKIXValidationInformation> pkixInfo;
+    @Nonnull private final List<PKIXValidationInformation> pkixInfo;
 
     /** The set of trusted names to return. */
-    private final Set<String> trustedNames;
+    @Nonnull private final Set<String> trustedNames;
     
     /** Flag indicating whether dynamic trusted names should be extracted from criteria set. */
     private boolean supportDynamicTrustedNames;
@@ -81,13 +79,13 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
         if (info != null) {
             pkixInfo = new ArrayList<>(info);
         } else {
-            pkixInfo = Collections.emptyList();
+            pkixInfo = CollectionSupport.emptyList();
         }
 
         if (names != null) {
             trustedNames = new HashSet<>(names);
         } else {
-            trustedNames = Collections.emptySet();
+            trustedNames = CollectionSupport.emptySet();
         }
         
         supportDynamicTrustedNames = supportDynamicNames;
@@ -97,7 +95,7 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
     @Override
     @Nonnull public Set<String> resolveTrustedNames(@Nullable final CriteriaSet criteriaSet) throws ResolverException {
         if (criteriaSet == null) {
-            return ImmutableSet.copyOf(trustedNames);
+            return CollectionSupport.copyToSet(trustedNames);
         }
         
         final HashSet<String> temp = new HashSet<>(trustedNames);
@@ -113,7 +111,7 @@ public class StaticPKIXValidationInformationResolver implements PKIXValidationIn
             }
         }
         
-        return ImmutableSet.copyOf(temp);
+        return CollectionSupport.copyToSet(temp);
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java
index 4e7d801f5..f007ae516 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/impl/X509KeyManagerX509CredentialAdapter.java
@@ -23,7 +23,6 @@ import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Collection;
-import java.util.Collections;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
@@ -35,6 +34,7 @@ import org.opensaml.security.credential.UsageType;
 import org.opensaml.security.x509.X509Credential;
 
 import net.shibboleth.shared.annotation.ParameterName;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
@@ -42,10 +42,10 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class X509KeyManagerX509CredentialAdapter extends AbstractCredential implements X509Credential {
 
     /** Alias used to reference the credential in the key manager. */
-    private final String credentialAlias;
+    @Nonnull private final String credentialAlias;
 
     /** Wrapped key manager. */
-    private final X509KeyManager keyManager;
+    @Nonnull private final X509KeyManager keyManager;
 
     /**
      * Constructor.
@@ -62,7 +62,7 @@ public class X509KeyManagerX509CredentialAdapter extends AbstractCredential impl
     /** {@inheritDoc} */
     @Override
     @Nullable public Collection<X509CRL> getCRLs() {
-        return Collections.EMPTY_LIST;
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
@@ -73,7 +73,7 @@ public class X509KeyManagerX509CredentialAdapter extends AbstractCredential impl
             return certs[0];
         }
 
-        return null;
+        throw new IllegalStateException("Error accessing certificate in key manager");
     }
 
     /** {@inheritDoc} */
@@ -84,7 +84,7 @@ public class X509KeyManagerX509CredentialAdapter extends AbstractCredential impl
             return Arrays.asList(certs);
         }
 
-        return null;
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
index 0912d5bd4..16d3f2594 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfiguration.java
@@ -36,7 +36,6 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
     @Nullable private CertificateNameOptions certificateNameOptions;
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public TrustEngine<? super X509Credential> getX509TrustEngine() {
         return x509TrustEngine;
     }
@@ -51,7 +50,6 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
     }
 
     /** {@inheritDoc} */
-    @Override
     @Nullable public CertificateNameOptions getCertificateNameOptions() {
         return certificateNameOptions;
     }
@@ -65,4 +63,4 @@ public class BasicClientTLSValidationConfiguration implements ClientTLSValidatio
         certificateNameOptions = options;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
index cfa5792df..9709ec8d3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolver.java
@@ -17,12 +17,10 @@
 
 package org.opensaml.security.x509.tls.impl;
 
-import java.util.Collections;
-
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
@@ -48,26 +46,25 @@ import org.opensaml.security.x509.tls.ClientTLSValidationParametersResolver;
 public class BasicClientTLSValidationParametersResolver implements ClientTLSValidationParametersResolver {
 
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements public Iterable<ClientTLSValidationParameters> resolve(final CriteriaSet criteria) 
+    @Nonnull public Iterable<ClientTLSValidationParameters> resolve(@Nullable final CriteriaSet criteria) 
             throws ResolverException {
         final ClientTLSValidationParameters params = resolveSingle(criteria);
         if (params != null) {
-            return Collections.singletonList(params);
+            return CollectionSupport.singletonList(params);
         }
-        return Collections.emptyList();
+        return CollectionSupport.emptyList();
     }
 
     /** {@inheritDoc} */
-    @Nonnull public ClientTLSValidationParameters resolveSingle(final CriteriaSet criteria) throws ResolverException {
-        Constraint.isNotNull(criteria, "CriteriaSet was null");
-        Constraint.isNotNull(criteria.get(ClientTLSValidationConfigurationCriterion.class), 
-                "Resolver requires an instance of ClientTLSValidationConfigurationCriterion");
+    @Nullable public ClientTLSValidationParameters resolveSingle(@Nullable final CriteriaSet criteria)
+            throws ResolverException {
+        final CriteriaSet localCriteria = Constraint.isNotNull(criteria, "CriteriaSet was null");
         
         final ClientTLSValidationParameters params = new ClientTLSValidationParameters();
         
-        params.setX509TrustEngine(resolveTrustEngine(criteria));
+        params.setX509TrustEngine(resolveTrustEngine(localCriteria));
         
-        params.setCertificateNameOptions(resolveNameOptions(criteria));
+        params.setCertificateNameOptions(resolveNameOptions(localCriteria));
         
         return params;
     }
@@ -82,8 +79,10 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
      */
     @Nullable protected TrustEngine<? super X509Credential> resolveTrustEngine(@Nonnull final CriteriaSet criteria) {
         
-        for (final ClientTLSValidationConfiguration config : 
-            criteria.get(ClientTLSValidationConfigurationCriterion.class).getConfigurations()) {
+        final var tlsCriterion = Constraint.isNotNull(criteria.get(ClientTLSValidationConfigurationCriterion.class), 
+                "Resolver requires an instance of ClientTLSValidationConfigurationCriterion");
+        
+        for (final ClientTLSValidationConfiguration config : tlsCriterion.getConfigurations()) {
             if (config.getX509TrustEngine() != null) {
                 return config.getX509TrustEngine();
             }
@@ -99,9 +98,11 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
      * @return the effective name options, or null
      */
     @Nullable protected CertificateNameOptions resolveNameOptions(@Nonnull final CriteriaSet criteria) {
-        
-        for (final ClientTLSValidationConfiguration config : 
-            criteria.get(ClientTLSValidationConfigurationCriterion.class).getConfigurations()) {
+
+        final var tlsCriterion = Constraint.isNotNull(criteria.get(ClientTLSValidationConfigurationCriterion.class), 
+                "Resolver requires an instance of ClientTLSValidationConfigurationCriterion");
+
+        for (final ClientTLSValidationConfiguration config : tlsCriterion.getConfigurations()) {
             if (config.getCertificateNameOptions() != null) {
                 return config.getCertificateNameOptions();
             }
@@ -109,4 +110,4 @@ public class BasicClientTLSValidationParametersResolver implements ClientTLSVali
         return null;
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java
index 1ae0665eb..aa12b2e43 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/StaticX509CredentialKeyManager.java
@@ -23,13 +23,14 @@ import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
 
+import javax.annotation.Nonnull;
 import javax.net.ssl.X509KeyManager;
 
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An implementation of {@link X509KeyManager} based on a single statically configured
@@ -39,16 +40,16 @@ import net.shibboleth.shared.logic.Constraint;
 public class StaticX509CredentialKeyManager implements X509KeyManager {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(StaticX509CredentialKeyManager.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(StaticX509CredentialKeyManager.class);
     
     /** The private key instance. */
-    private PrivateKey privateKey;
+    @Nonnull private PrivateKey privateKey;
     
     /** The certificate chain instance. */
-    private java.security.cert.X509Certificate[] certificateChain;
+    @Nonnull private java.security.cert.X509Certificate[] certificateChain;
     
     /** The alias representing the supplied static credential. */
-    private String internalAlias = "internalAlias-" + this.toString();
+    @Nonnull private String internalAlias = "internalAlias-" + this.toString();
 
     /**
      * Constructor.
@@ -56,13 +57,10 @@ public class StaticX509CredentialKeyManager implements X509KeyManager {
      * @param credential the static credential managed by this key manager
      */
     public StaticX509CredentialKeyManager(final X509Credential credential) {
-        super();
         Constraint.isNotNull(credential, "Credential may not be null");
-        privateKey = Constraint.isNotNull(credential.getPrivateKey(), 
-                "Credential PrivateKey may not be null");
+        privateKey = Constraint.isNotNull(credential.getPrivateKey(), "Credential PrivateKey may not be null");
         certificateChain = Constraint.isNotNull(credential.getEntityCertificateChain(), 
-                "Credential certificate chain may not be null")
-                .toArray(new X509Certificate[0]);
+                "Credential certificate chain may not be null").toArray(new X509Certificate[0]);
         log.trace("Generated static internal alias was: {}", internalAlias);
     }
 
@@ -73,7 +71,6 @@ public class StaticX509CredentialKeyManager implements X509KeyManager {
      * @param chain the certificate chain managed by this key manager
      */
     public StaticX509CredentialKeyManager(final PrivateKey key, final Collection<X509Certificate> chain) {
-        super();
         privateKey = Constraint.isNotNull(key, "PrivateKey may not be null");
         certificateChain = Constraint.isNotNull(chain, 
                 "Certificate chain may not be null").toArray(new X509Certificate[0]);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java
index db32bb769..c8d606a48 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509CredentialKeyManager.java
@@ -22,10 +22,13 @@ import java.security.Principal;
 import java.security.PrivateKey;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
 import javax.net.ssl.X509KeyManager;
 
+import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An implementation of {@link X509KeyManager} which returns data based on the thread-local credential 
@@ -34,10 +37,10 @@ import org.slf4j.LoggerFactory;
 public class ThreadLocalX509CredentialKeyManager implements X509KeyManager {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(ThreadLocalX509CredentialKeyManager.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(ThreadLocalX509CredentialKeyManager.class);
     
     /** The alias representing the supplied static credential. */
-    private String internalAlias = "internalAlias-ThreadLocal";
+    @Nonnull private String internalAlias = "internalAlias-ThreadLocal";
 
     /** {@inheritDoc} */
     public String chooseClientAlias(final String[] arg0, final Principal[] arg1, final Socket arg2) {
@@ -54,16 +57,20 @@ public class ThreadLocalX509CredentialKeyManager implements X509KeyManager {
     /** {@inheritDoc} */
     public X509Certificate[] getCertificateChain(final String arg0) {
         log.trace("In getCertificateChain");
-        return internalAlias.equals(arg0) && ThreadLocalX509CredentialContext.haveCurrent() 
-                ? ThreadLocalX509CredentialContext.getCredential().getEntityCertificateChain()
-                        .toArray(new X509Certificate[0]) : null;
+        
+        final X509Credential cred = ThreadLocalX509CredentialContext.getCredential();
+        
+        return internalAlias.equals(arg0) &&
+                cred != null ? cred.getEntityCertificateChain().toArray(new X509Certificate[0]) : null;
     }
 
     /** {@inheritDoc} */
     public PrivateKey getPrivateKey(final String arg0) {
         log.trace("In getPrivateKey");
-        return internalAlias.equals(arg0) && ThreadLocalX509CredentialContext.haveCurrent() 
-                ? ThreadLocalX509CredentialContext.getCredential().getPrivateKey() : null;
+        
+        final X509Credential cred = ThreadLocalX509CredentialContext.getCredential();
+        
+        return internalAlias.equals(arg0) && cred != null ? cred.getPrivateKey() : null;
     }
 
     /** {@inheritDoc} */
@@ -78,4 +85,4 @@ public class ThreadLocalX509CredentialKeyManager implements X509KeyManager {
         return new String[] {internalAlias};
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java
index 708dd9c01..501cac9b3 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineContext.java
@@ -38,16 +38,16 @@ public final class ThreadLocalX509TrustEngineContext {
     private static final class Data {
         
         /** Trust engine. */
-        private TrustEngine<? super X509Credential> trustEngine;
+        @Nonnull private TrustEngine<? super X509Credential> trustEngine;
         
         /** Criteria. */
-        private CriteriaSet criteriaSet;
+        @Nonnull private CriteriaSet criteriaSet;
         
         /** Whether evaluation target was trusted. */
-        private Boolean trusted;
+        @Nullable private Boolean trusted;
         
         /** Whether trust engine evaluation failure should be treated as fatal. Defaults to true. */
-        private Boolean failureFatal;
+        @Nonnull private Boolean failureFatal;
         
         /**
          * Constructor.
@@ -67,7 +67,7 @@ public final class ThreadLocalX509TrustEngineContext {
     }
 
     /** ThreadLocal storage for trust engine. */
-    private static ThreadLocal<Data> current = new ThreadLocal<>();
+    @Nonnull private static ThreadLocal<Data> current = new ThreadLocal<>();
 
     /** Constructor. */
     private ThreadLocalX509TrustEngineContext() { }
@@ -151,4 +151,4 @@ public final class ThreadLocalX509TrustEngineContext {
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java
index ddc8e3976..4340bc98d 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustEngineSupport.java
@@ -31,9 +31,9 @@ import org.opensaml.security.trust.TrustEngine;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509Credential;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
+import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 /**
@@ -43,7 +43,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 public final class ThreadLocalX509TrustEngineSupport {
     
     /** Logger. */
-    private static final Logger LOG = LoggerFactory.getLogger(ThreadLocalX509TrustEngineSupport.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(ThreadLocalX509TrustEngineSupport.class);
     
     /** Constructor. */
     private ThreadLocalX509TrustEngineSupport() { }
@@ -98,9 +98,13 @@ public final class ThreadLocalX509TrustEngineSupport {
         
         LOG.trace("Evaluating X509Certificate[] chain against ThreadLocalX509TrustEngineContext");
         
-        if (performTrustEval(chain,
-                ThreadLocalX509TrustEngineContext.getTrustEngine(),
-                ThreadLocalX509TrustEngineContext.getCriteria())) {
+        final var trustEngine = ThreadLocalX509TrustEngineContext.getTrustEngine();
+        final var criteria = ThreadLocalX509TrustEngineContext.getCriteria();
+        // Due to haveCurrent() above, these should be non-null.
+        assert trustEngine != null;
+        assert criteria != null;
+        
+        if (performTrustEval(chain, trustEngine, criteria)) {
             ThreadLocalX509TrustEngineContext.setTrusted(true);
         } else {
             ThreadLocalX509TrustEngineContext.setTrusted(false);
diff --git a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java
index 130a39dd8..1ea380f83 100644
--- a/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java
+++ b/opensaml-security-impl/src/main/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManager.java
@@ -20,10 +20,12 @@ package org.opensaml.security.x509.tls.impl;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
 import javax.net.ssl.X509TrustManager;
 
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+
+import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
  * An implementation of {@link X509TrustManager} which performs its evaluation using trust engine and criteria
@@ -32,7 +34,7 @@ import org.slf4j.LoggerFactory;
 public class ThreadLocalX509TrustManager implements X509TrustManager {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(ThreadLocalX509TrustManager.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(ThreadLocalX509TrustManager.class);
 
     /** {@inheritDoc} */
     public X509Certificate[] getAcceptedIssuers() {
@@ -72,4 +74,4 @@ public class ThreadLocalX509TrustManager implements X509TrustManager {
         ThreadLocalX509TrustEngineSupport.evaluate(chain);
     }
 
-}
+}
\ No newline at end of file
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java
index 3910d7970..6cabba75f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/config/impl/ClientTLSValidationConfigurationInitializerTest.java
@@ -24,6 +24,7 @@ import org.opensaml.security.x509.tls.ClientTLSValidationConfiguration;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
+ at SuppressWarnings("javadoc")
 public class ClientTLSValidationConfigurationInitializerTest extends InitializerBaseTestCase {
     
     @Test
@@ -35,7 +36,7 @@ public class ClientTLSValidationConfigurationInitializerTest extends Initializer
         initializer.init();
         
         config = ConfigurationService.get(ClientTLSValidationConfiguration.class);
-        Assert.assertNotNull(config, "Config was null");
+        assert config != null;
         
         Assert.assertNotNull(config.getCertificateNameOptions());
         
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java
index 79e29d9eb..c71ade89b 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableEntityIDCredentialCriterionTest.java
@@ -24,9 +24,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableEntityIDCredentialCriterionTest {
     
     private BasicCredential credential;
@@ -47,28 +45,28 @@ public class EvaluableEntityIDCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
+        final EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria = new EntityIdCriterion("OTHER");
-        EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
+        final EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testCanNotEvaluate() {
         credential.setEntityId(null);
-        EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
+        final EvaluableEntityIDCredentialCriterion evalCrit = new EvaluableEntityIDCredentialCriterion(criteria);
         Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java
index 55b23c5c4..675899006 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyAlgorithmCredentialCriterionTest.java
@@ -21,15 +21,11 @@ import org.testng.annotations.Test;
 import org.testng.annotations.BeforeMethod;
 import org.testng.Assert;
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableKeyAlgorithmCredentialCriterion;
 import org.opensaml.security.criteria.KeyAlgorithmCriterion;
 import org.opensaml.security.crypto.KeySupport;
 
-/**
- *
- */
+
+ at SuppressWarnings("javadoc")
 public class EvaluableKeyAlgorithmCredentialCriterionTest {
     
     private BasicCredential credential;
@@ -48,21 +44,21 @@ public class EvaluableKeyAlgorithmCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
+        final EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setKeyAlgorithm("SomeOtherKeyAlgo");
-        EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
+        final EvaluableKeyAlgorithmCredentialCriterion evalCrit = new EvaluableKeyAlgorithmCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java
index dc7794cff..bfbe6cd6a 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyLengthCredentialCriterionTest.java
@@ -21,15 +21,10 @@ import org.testng.annotations.Test;
 import org.testng.annotations.BeforeMethod;
 import org.testng.Assert;
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableKeyLengthCredentialCriterion;
 import org.opensaml.security.criteria.KeyLengthCriterion;
 import org.opensaml.security.crypto.KeySupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableKeyLengthCredentialCriterionTest {
     
     private BasicCredential credential;
@@ -50,21 +45,21 @@ public class EvaluableKeyLengthCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
+        final EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setKeyLength(keyLength * 2);
-        EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
+        final EvaluableKeyLengthCredentialCriterion evalCrit = new EvaluableKeyLengthCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java
index 13d90f8d0..e1f7daff7 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableKeyNameCredentialCriterionTest.java
@@ -21,15 +21,10 @@ import org.testng.annotations.Test;
 import org.testng.annotations.BeforeMethod;
 import org.testng.Assert;
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableKeyNameCredentialCriterion;
 import org.opensaml.security.criteria.KeyNameCriterion;
 import org.opensaml.security.crypto.KeySupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableKeyNameCredentialCriterionTest {
     
     private BasicCredential credential;
@@ -52,28 +47,28 @@ public class EvaluableKeyNameCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
+        final EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setKeyName(keyName + "OTHER");
-        EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
+        final EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testCanNotEvaluate() {
         credential.getKeyNames().clear();
-        EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
+        final EvaluableKeyNameCredentialCriterion evalCrit = new EvaluableKeyNameCredentialCriterion(criteria);
         Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java
index 1a76324f4..3cd895a14 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluablePublicKeyCredentialCriterionTest.java
@@ -25,15 +25,10 @@ import java.security.NoSuchProviderException;
 import java.security.PublicKey;
 
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluablePublicKeyCredentialCriterion;
 import org.opensaml.security.criteria.PublicKeyCriterion;
 import org.opensaml.security.crypto.KeySupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluablePublicKeyCredentialCriterionTest {
     
     private BasicCredential credential;
@@ -55,28 +50,28 @@ public class EvaluablePublicKeyCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
+        final EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfyDifferentKey() throws NoSuchAlgorithmException, NoSuchProviderException {
         criteria.setPublicKey(KeySupport.generateKeyPair(keyAlgo, 1024, null).getPublic());
-        EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
+        final EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testCanNotEvaluate() {
         //Only unevaluable case is null credential
-        EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
+        final EvaluablePublicKeyCredentialCriterion evalCrit = new EvaluablePublicKeyCredentialCriterion(criteria);
         Assert.assertEquals(evalCrit.test(null), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java
index 072c1cc79..9738819ab 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableUsageCredentialCriterionTest.java
@@ -22,15 +22,10 @@ import org.testng.annotations.BeforeMethod;
 import org.testng.Assert;
 import org.opensaml.security.credential.BasicCredential;
 import org.opensaml.security.credential.UsageType;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableUsageCredentialCriterion;
 import org.opensaml.security.criteria.UsageCriterion;
 import org.opensaml.security.crypto.KeySupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableUsageCredentialCriterionTest {
     
     private BasicCredential credential;
@@ -51,35 +46,35 @@ public class EvaluableUsageCredentialCriterionTest {
     
     @Test
     public void testSatisfyExactMatch() {
-        EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+        final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
     
     @Test
     public void testSatisfyWithUnspecifiedCriteria() {
         criteria.setUsage(UsageType.UNSPECIFIED);
-        EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+        final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
     
     @Test
     public void testSatisfyWithUnspecifiedCredential() {
         credential.setUsageType(UsageType.UNSPECIFIED);
-        EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+        final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setUsage(UsageType.ENCRYPTION);
-        EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
+        final EvaluableUsageCredentialCriterion evalCrit = new EvaluableUsageCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java
index e5ae3050a..e13879d86 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509CertSelectorCredentialCriterionTest.java
@@ -25,17 +25,15 @@ import java.security.NoSuchProviderException;
 import java.security.cert.X509CertSelector;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
 import javax.security.auth.x500.X500Principal;
 
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509CertSelectorCredentialCriterion;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509Support;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableX509CertSelectorCredentialCriterionTest {
     
     private BasicX509Credential credential;
@@ -44,7 +42,7 @@ public class EvaluableX509CertSelectorCredentialCriterionTest {
     private EvaluableX509CertSelectorCredentialCriterion evalCrit;
     
     private X509Certificate entityCert;
-    private String entityCertBase64 = 
+    @Nonnull private String entityCertBase64 = 
         "MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
         "cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
         "DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -112,7 +110,7 @@ public class EvaluableX509CertSelectorCredentialCriterionTest {
     @Test
     public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
         certSelector.setCertificate(entityCert);
-        BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+        final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
         Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
     }
     
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java
index 561c4454d..d4254d4fe 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509DigestCredentialCriterionTest.java
@@ -28,29 +28,27 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509DigestCriterion;
 import org.opensaml.security.x509.X509Support;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableX509DigestCredentialCriterionTest {
     
     private BasicX509Credential credential;
-    private String digestAlgorithm = "SHA-256";
-    private String entityCertDigestBase64 = "z+OxxIy+EZxLN6PbDEXPmOutQhaYbcJYKDrIyFSuE0I=";
+    @Nonnull private String digestAlgorithm = "SHA-256";
+    @Nonnull private String entityCertDigestBase64 = "z+OxxIy+EZxLN6PbDEXPmOutQhaYbcJYKDrIyFSuE0I=";
     private byte[] entityCertDigest;
     
     private X509DigestCriterion criteria;
     
     
     private X509Certificate entityCert;
-    private String entityCertBase64 = 
+    @Nonnull private String entityCertBase64 = 
         "MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
         "cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
         "DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -90,35 +88,35 @@ public class EvaluableX509DigestCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+        final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setAlgorithm("SHA-1");
-        EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+        final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
-        BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
-        EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+        final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+        final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testCanNotEvaluate() {
         criteria.setAlgorithm("SHA0");
-        EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
+        final EvaluableX509DigestCredentialCriterion evalCrit = new EvaluableX509DigestCredentialCriterion(criteria);
         Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java
index b846fac04..545ef08ff 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509IssuerSerialCredentialCriterionTest.java
@@ -25,20 +25,16 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
 import javax.security.auth.x500.X500Principal;
 
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509IssuerSerialCredentialCriterion;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509IssuerSerialCriterion;
 import org.opensaml.security.x509.X509Support;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableX509IssuerSerialCredentialCriterionTest {
     
     private BasicX509Credential credential;
@@ -47,7 +43,7 @@ public class EvaluableX509IssuerSerialCredentialCriterionTest {
     private X509IssuerSerialCriterion criteria;
     
     private X509Certificate entityCert;
-    private String entityCertBase64 = 
+    @Nonnull private String entityCertBase64 = 
         "MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
         "cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
         "DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -88,28 +84,28 @@ public class EvaluableX509IssuerSerialCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
+        final EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setSerialNumber(new BigInteger("100"));
-        EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
+        final EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
-        BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
-        EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
+        final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+        final EvaluableX509IssuerSerialCredentialCriterion evalCrit = new EvaluableX509IssuerSerialCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java
index cc5ff1d1d..8c60b359d 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectKeyIdentifierCredentialCriterionTest.java
@@ -28,29 +28,26 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
+
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509SubjectKeyIdentifierCredentialCriterion;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509SubjectKeyIdentifierCriterion;
 import org.opensaml.security.x509.X509Support;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableX509SubjectKeyIdentifierCredentialCriterionTest {
     
     private BasicX509Credential credential;
-    private String entityCertSKIBase64 = "OBGBOSNoqgroOhl9RniD0sMlRa4=";
+    @Nonnull private String entityCertSKIBase64 = "OBGBOSNoqgroOhl9RniD0sMlRa4=";
     private byte[] subjectKeyIdentifier;
     
     private X509SubjectKeyIdentifierCriterion criteria;
     
     
     private X509Certificate entityCert;
-    private String entityCertBase64 = 
+    @Nonnull private String entityCertBase64 = 
         "MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
         "cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
         "DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -74,7 +71,7 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterionTest {
         "+hcVyvCXs5XtFTFWDAVYvzQ6";
     
     private X509Certificate entityCertNoSKI;
-    private String entityCertNoSKIBase64 = 
+    @Nonnull private String entityCertNoSKIBase64 = 
         "MIIBwjCCASugAwIBAgIJAMrW6QSeKNBJMA0GCSqGSIb3DQEBBAUAMCMxITAfBgNV" +
         "BAMTGG5vZXh0ZW5zaW9ucy5leGFtcGxlLm9yZzAeFw0wNzA1MTkxNzU2NTVaFw0w" +
         "NzA2MTgxNzU2NTVaMCMxITAfBgNVBAMTGG5vZXh0ZW5zaW9ucy5leGFtcGxlLm9y" +
@@ -105,35 +102,35 @@ public class EvaluableX509SubjectKeyIdentifierCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+        final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setSubjectKeyIdentifier("abcdef123456".getBytes());
-        EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+        final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
-        BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
-        EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+        final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+        final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testCanNotEvaluate() {
         credential.setEntityCertificate(entityCertNoSKI);
-        EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
+        final EvaluableX509SubjectKeyIdentifierCredentialCriterion evalCrit = new EvaluableX509SubjectKeyIdentifierCredentialCriterion(criteria);
         Assert.assertEquals(evalCrit.test(credential), evalCrit.isUnevaluableSatisfies(), "Credential should have been unevaluable against the criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java
index 8946ef704..86e92bdea 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/criteria/impl/EvaluableX509SubjectNameCredentialCriterionTest.java
@@ -25,20 +25,16 @@ import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.cert.X509Certificate;
 
+import javax.annotation.Nonnull;
 import javax.security.auth.x500.X500Principal;
 
 import org.opensaml.security.credential.BasicCredential;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriteriaRegistry;
-import org.opensaml.security.credential.criteria.impl.EvaluableCredentialCriterion;
-import org.opensaml.security.credential.criteria.impl.EvaluableX509SubjectNameCredentialCriterion;
 import org.opensaml.security.crypto.KeySupport;
 import org.opensaml.security.x509.BasicX509Credential;
 import org.opensaml.security.x509.X509SubjectNameCriterion;
 import org.opensaml.security.x509.X509Support;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EvaluableX509SubjectNameCredentialCriterionTest {
     
     private BasicX509Credential credential;
@@ -46,7 +42,7 @@ public class EvaluableX509SubjectNameCredentialCriterionTest {
     private X509SubjectNameCriterion criteria;
     
     private X509Certificate entityCert;
-    private String entityCertBase64 = 
+    @Nonnull private String entityCertBase64 = 
         "MIIDzjCCAragAwIBAgIBMTANBgkqhkiG9w0BAQUFADAtMRIwEAYDVQQKEwlJbnRl" +
         "cm5ldDIxFzAVBgNVBAMTDmNhLmV4YW1wbGUub3JnMB4XDTA3MDUyMTE4MjM0MFoX" +
         "DTE3MDUxODE4MjM0MFowMTESMBAGA1UEChMJSW50ZXJuZXQyMRswGQYDVQQDExJm" +
@@ -86,28 +82,28 @@ public class EvaluableX509SubjectNameCredentialCriterionTest {
     
     @Test
     public void testSatisfy() {
-        EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
+        final EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 
     @Test
     public void testNotSatisfy() {
         criteria.setSubjectName( new X500Principal("cn=SomeOtherName, o=SomeOtherOrg"));
-        EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
+        final EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(credential), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testNotSatisfyWrongCredType() throws NoSuchAlgorithmException, NoSuchProviderException {
-        BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
-        EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
+        final BasicCredential basicCred = new BasicCredential(KeySupport.generateKey("AES", 128, null));
+        final EvaluableX509SubjectNameCredentialCriterion evalCrit = new EvaluableX509SubjectNameCredentialCriterion(criteria);
         Assert.assertFalse(evalCrit.test(basicCred), "Credential should NOT have matched the evaluable criteria");
     }
     
     @Test
     public void testRegistry() throws Exception {
-        EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
-        Assert.assertNotNull(evalCrit, "Evaluable criteria was unavailable from the registry");
+        final EvaluableCredentialCriterion evalCrit = EvaluableCredentialCriteriaRegistry.getEvaluator(criteria);
+        assert evalCrit != null;
         Assert.assertTrue(evalCrit.test(credential), "Credential should have matched the evaluable criteria");
     }
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java
index fa654f78d..8930c5639 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/credential/impl/ChainingCredentialResolverTest.java
@@ -18,8 +18,6 @@
 package org.opensaml.security.credential.impl;
 
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 import java.util.NoSuchElementException;
@@ -32,6 +30,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
@@ -88,7 +87,7 @@ public class ChainingCredentialResolverTest {
      */
     @Test
     public void testOneEmptyMember() throws ResolverException {
-        chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolverEmpty));
+        chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolverEmpty));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 0);
@@ -101,7 +100,7 @@ public class ChainingCredentialResolverTest {
      */
     @Test
     public void testMultipleEmptyMember() throws ResolverException {
-        chainingResolver = new ChainingCredentialResolver(Arrays.asList(staticResolverEmpty, staticResolverEmpty, staticResolverEmpty));
+        chainingResolver = new ChainingCredentialResolver(CollectionSupport.listOf(staticResolverEmpty, staticResolverEmpty, staticResolverEmpty));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 0);
@@ -114,7 +113,7 @@ public class ChainingCredentialResolverTest {
      */
     @Test
     public void testOneMember() throws ResolverException {
-        chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolver12));
+        chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolver12));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 2, cred1, cred2);
@@ -128,7 +127,7 @@ public class ChainingCredentialResolverTest {
     @Test
     public void testMultipleMembers() throws ResolverException {
         chainingResolver = new ChainingCredentialResolver(
-                Arrays.asList(staticResolver12, staticResolver3, staticResolverEmpty, staticResolver45));
+                CollectionSupport.listOf(staticResolver12, staticResolver3, staticResolverEmpty, staticResolver45));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 5, cred1, cred2, cred3, cred4, cred5);
@@ -143,7 +142,7 @@ public class ChainingCredentialResolverTest {
     @Test
     public void testOrderingMultipleMembers() throws ResolverException {
         chainingResolver = new ChainingCredentialResolver(
-                Arrays.asList(staticResolverEmpty, staticResolver45, staticResolverEmpty, staticResolver3, staticResolver12));
+                CollectionSupport.listOf(staticResolverEmpty, staticResolver45, staticResolverEmpty, staticResolver3, staticResolver12));
         
         final List<Credential> resolved = getResolved(chainingResolver.resolve(criteriaSet));
         checkResolved(resolved, 5, cred1, cred2, cred3, cred4, cred5);
@@ -173,7 +172,7 @@ public class ChainingCredentialResolverTest {
      */
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testRemove() throws ResolverException {
-        chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolver12));
+        chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolver12));
         
         final Iterator<Credential> iter = chainingResolver.resolve(criteriaSet).iterator();
         Assert.assertTrue(iter.hasNext(), "Iterator was empty");
@@ -188,7 +187,7 @@ public class ChainingCredentialResolverTest {
      */
     @Test(expectedExceptions=NoSuchElementException.class)
     public void testNoMoreMembers() throws ResolverException {
-        chainingResolver = new ChainingCredentialResolver(Arrays.asList(staticResolver12, staticResolver3));
+        chainingResolver = new ChainingCredentialResolver(CollectionSupport.listOf(staticResolver12, staticResolver3));
         
         final Iterator<Credential> iter = chainingResolver.resolve(criteriaSet).iterator();
         Assert.assertTrue(iter.hasNext(), "Should have next member");
@@ -204,7 +203,7 @@ public class ChainingCredentialResolverTest {
     
     @Test(expectedExceptions=UnsupportedOperationException.class)
     public void testChainUnmodifiable() {
-        chainingResolver = new ChainingCredentialResolver(Collections.singletonList(staticResolver12));
+        chainingResolver = new ChainingCredentialResolver(CollectionSupport.singletonList(staticResolver12));
         chainingResolver.getResolverChain().add(staticResolver3);
     }
     
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java
index 95ad15747..3a31be735 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/BaseDHTest.java
@@ -25,6 +25,11 @@ import org.testng.annotations.DataProvider;
  */
 public class BaseDHTest extends OpenSAMLInitBaseTestCase {
     
+    /**
+     * Get key sizes.
+     * 
+     * @return key sizes
+     */
     @DataProvider
     public Object[][] dhKeySizes() {
         return new Object[][] {
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java
index 7699d3a7b..101218267 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/dh/tests/DHSupportTest.java
@@ -30,9 +30,7 @@ import org.opensaml.security.crypto.dh.DHSupport;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class DHSupportTest extends BaseDHTest {
     
     @Test(dataProvider="dhKeySizes")
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java
index a6a8fe09d..5844bd317 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/curves/tests/NamedCurvesTest.java
@@ -22,6 +22,8 @@ import java.security.spec.ECGenParameterSpec;
 import java.security.spec.ECParameterSpec;
 import java.util.Set;
 
+import javax.annotation.Nonnull;
+
 import org.bouncycastle.jce.ECNamedCurveTable;
 import org.opensaml.security.crypto.JCAConstants;
 import org.opensaml.security.crypto.KeySupport;
@@ -32,41 +34,42 @@ import org.opensaml.security.crypto.ec.NamedCurveRegistry;
 import org.opensaml.security.crypto.ec.curves.AbstractNamedCurve;
 import org.opensaml.security.crypto.ec.tests.BaseNamedCurveTest;
 import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+import net.shibboleth.shared.primitive.LoggerFactory;
+
+ at SuppressWarnings("javadoc")
 public class NamedCurvesTest extends BaseNamedCurveTest {
     
-    private Logger log = LoggerFactory.getLogger(NamedCurvesTest.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(NamedCurvesTest.class);
     
     @Test(dataProvider = "namedCurves")
     public void globalRegistryCurves(String namedCurve) throws Exception {
-        NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
-        Assert.assertNotNull(registry);
+        final NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
+        assert registry != null;
         
-        ECParameterSpec bcSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
-        Assert.assertNotNull(bcSpec);
+        final ECParameterSpec bcSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
+        assert bcSpec != null;
         
-        Assert.assertNotNull(registry.getByName(namedCurve));
-        Assert.assertEquals(registry.getByName(namedCurve).getName(), namedCurve);
+        NamedCurve curve = registry.getByName(namedCurve);
+        assert curve != null;
+        Assert.assertEquals(curve.getName(), namedCurve);
+        
+        curve = registry.getByParameterSpec(bcSpec);
+        assert curve != null;
         
-        Assert.assertNotNull(registry.getByParameterSpec(bcSpec));
         // Use Enhanced- as a simple way to test equality via #equals(...).
         // Wrap both. It seems TestNG does expected.equals(actual), but that may not always be true.
-        Assert.assertEquals(new EnhancedECParameterSpec(registry.getByParameterSpec(bcSpec).getParameterSpec()),
-                new EnhancedECParameterSpec(bcSpec));
+        Assert.assertEquals(new EnhancedECParameterSpec(curve.getParameterSpec()), new EnhancedECParameterSpec(bcSpec));
         
-        NamedCurve curve = registry.getByName(namedCurve);
+        curve = registry.getByName(namedCurve);
         if (AbstractNamedCurve.class.isInstance(curve)) {
             // Test the equality of the curve's spec #buildParameterSpec() against both BC and brute force from key pair generation
-            ECParameterSpec curveSpec = AbstractNamedCurve.class.cast(curve).buildParameterSpec();
-            Assert.assertNotNull(curveSpec);
+            final ECParameterSpec curveSpec = AbstractNamedCurve.class.cast(curve).buildParameterSpec();
+            assert curveSpec != null;
             
-            ECParameterSpec jcaSpec =  ECPublicKey.class.cast(
+            final ECParameterSpec jcaSpec =  ECPublicKey.class.cast(
                     KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(namedCurve), null)
                     .getPublic()).getParams();
             Assert.assertNotNull(jcaSpec);
@@ -92,18 +95,18 @@ public class NamedCurvesTest extends BaseNamedCurveTest {
      */
     @Test
     public void sanityCheckOIDAndNameAndParams() throws Exception {
-        NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
-        Assert.assertNotNull(registry);
+        final NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
+        assert registry != null;
         
-        Set<NamedCurve> registeredCurves = registry.getRegisteredCurves();
+        final Set<NamedCurve> registeredCurves = registry.getRegisteredCurves();
         
         for (NamedCurve curve : registeredCurves) {
             log.debug("Testing OID and name for curve: impl {}", curve.getClass().getName());
             
-            ECParameterSpec specByOID = ECSupport.convert(ECNamedCurveTable.getParameterSpec(curve.getObjectIdentifier()));
-            Assert.assertNotNull(specByOID);
-            ECParameterSpec specByName = ECSupport.convert(ECNamedCurveTable.getParameterSpec(mapBCCurveName(curve.getName())));
-            Assert.assertNotNull(specByName);
+            final ECParameterSpec specByOID = ECSupport.convert(ECNamedCurveTable.getParameterSpec(curve.getObjectIdentifier()));
+            assert specByOID != null;
+            final ECParameterSpec specByName = ECSupport.convert(ECNamedCurveTable.getParameterSpec(mapBCCurveName(curve.getName())));
+            assert specByName != null;
             
             
             // Params by OID and name match each other.
@@ -122,7 +125,7 @@ public class NamedCurvesTest extends BaseNamedCurveTest {
      * @param standardName
      * @return the corresponding BC curve name
      */
-    private String mapBCCurveName(String standardName) {
+    @Nonnull private String mapBCCurveName(String standardName) {
         if (standardName.startsWith("X9.62 ")) {
             return standardName.substring(6);
         }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java
index 54a3c63b9..0ae98a417 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/BaseNamedCurveTest.java
@@ -25,6 +25,11 @@ import org.testng.annotations.DataProvider;
  */
 public class BaseNamedCurveTest extends OpenSAMLInitBaseTestCase {
     
+    /**
+     * Get curve names.
+     * 
+     * @return curve names
+     */
     @DataProvider
     public Object[][] namedCurves() {
         return new Object[][] {
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java
index 0cd95d8ab..acbc7570b 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/ECSupportTest.java
@@ -35,9 +35,7 @@ import org.opensaml.security.crypto.ec.NamedCurve;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class ECSupportTest extends BaseNamedCurveTest {
     
     @Test(dataProvider="namedCurves")
@@ -47,7 +45,8 @@ public class ECSupportTest extends BaseNamedCurveTest {
         final KeyPair origKeyPair = kpGenerator.generateKeyPair();
         Assert.assertNotNull(origKeyPair);
         Assert.assertTrue(ECPublicKey.class.isInstance(origKeyPair.getPublic()));
-        ECPublicKey origPublicKey = ECPublicKey.class.cast(origKeyPair.getPublic());
+        final ECPublicKey origPublicKey = ECPublicKey.class.cast(origKeyPair.getPublic());
+        assert origPublicKey != null;
         
         final KeyPair generatedKeyPair = ECSupport.generateCompatibleKeyPair(origPublicKey, null);
         
@@ -61,7 +60,7 @@ public class ECSupportTest extends BaseNamedCurveTest {
         final KeyPairGenerator kpGenerator = KeyPairGenerator.getInstance(JCAConstants.KEY_ALGO_EC);
         kpGenerator.initialize(new ECGenParameterSpec(namedCurve));
         final KeyPair publicKeyPair = kpGenerator.generateKeyPair();
-        ECPublicKey publicKey = ECPublicKey.class.cast(publicKeyPair.getPublic());
+        final ECPublicKey publicKey = ECPublicKey.class.cast(publicKeyPair.getPublic());
         
         final KeyPair privateKeyPair = ECSupport.generateCompatibleKeyPair(publicKey, null);
         
@@ -73,11 +72,11 @@ public class ECSupportTest extends BaseNamedCurveTest {
     
     @Test(dataProvider="namedCurves")
     public void convertParameterSpec(String namedCurve) throws Exception {
-        ECParameterSpec control = ECPublicKey.class.cast(
+        final ECParameterSpec control = ECPublicKey.class.cast(
                 KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(namedCurve), null).getPublic()).getParams();
         
-        ECParameterSpec target = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
-        Assert.assertNotNull(target);
+        final ECParameterSpec target = ECSupport.convert(ECNamedCurveTable.getParameterSpec(namedCurve));
+        assert target != null;
         
         Assert.assertNotSame(target, control);
         
@@ -90,14 +89,14 @@ public class ECSupportTest extends BaseNamedCurveTest {
 
     @Test(dataProvider="namedCurves")
     public void encodeAndDecodeECPoint(String namedCurve) throws Exception {
-        ECParameterSpec spec = ECPublicKey.class.cast(
+        final ECParameterSpec spec = ECPublicKey.class.cast(
                 KeySupport.generateKeyPair(JCAConstants.KEY_ALGO_EC, new ECGenParameterSpec(namedCurve), null).getPublic()).getParams();
         
         //  Do this differently (and clearer) than in the actual code just so check the latter.
         int fieldSizeBits = spec.getCurve().getField().getFieldSize();
         int fieldSizeBytes = (fieldSizeBits % 8) == 0 ? (fieldSizeBits / 8) : (fieldSizeBits / 8) + 1;
         
-        byte[] encoded = ECSupport.encodeECPointUncompressed(spec.getGenerator(), spec.getCurve());
+        final byte[] encoded = ECSupport.encodeECPointUncompressed(spec.getGenerator(), spec.getCurve());
         Assert.assertNotNull(encoded);
         Assert.assertEquals(encoded.length, (fieldSizeBytes * 2) + 1);
         Assert.assertEquals(encoded[0], 0x04);
@@ -106,14 +105,14 @@ public class ECSupportTest extends BaseNamedCurveTest {
         Assert.assertEquals(new BigInteger(1, encoded, fieldSizeBytes+1, fieldSizeBytes),
                 spec.getGenerator().getAffineY());
         
-        ECPoint decoded = ECSupport.decodeECPoint(encoded, spec.getCurve());
+        final ECPoint decoded = ECSupport.decodeECPoint(encoded, spec.getCurve());
         Assert.assertNotNull(decoded);
         Assert.assertEquals(decoded, spec.getGenerator());
     }
     
     @Test
     public void getCurvesFromBouncyCastle() {
-        Set<NamedCurve> curves = ECSupport.getCurvesFromBouncyCastle();
+        final Set<NamedCurve> curves = ECSupport.getCurvesFromBouncyCastle();
         Assert.assertNotNull(curves);
         Assert.assertFalse(curves.isEmpty());
     }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java
index 70e7abb5f..df065f408 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/EnhancedECParameterSpecTest.java
@@ -29,9 +29,7 @@ import org.opensaml.security.crypto.ec.EnhancedECParameterSpec;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class EnhancedECParameterSpecTest extends BaseNamedCurveTest {
     
     @Test(dataProvider = "namedCurves")
@@ -40,8 +38,8 @@ public class EnhancedECParameterSpecTest extends BaseNamedCurveTest {
         // the same object that whatever provider is in effect produces when generating a KeyPair, etc.
         // SunEC seems to produce the same object instance for all key pairs of a given curve, presumably
         // they have an internal table of name -> ECParameterSpec.
-        ECParameterSpec controlInput = ECSupport.convert(ECNamedCurveTable.getParameterSpec(name));
-        Assert.assertNotNull(controlInput);
+        final ECParameterSpec controlInput = ECSupport.convert(ECNamedCurveTable.getParameterSpec(name));
+        assert controlInput != null;
         
         EnhancedECParameterSpec control = new EnhancedECParameterSpec(controlInput);
         
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java
index b89e959e2..dd71b06ee 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/crypto/ec/tests/NamedCurveRegistryTest.java
@@ -37,9 +37,7 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.collection.CollectionSupport;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class NamedCurveRegistryTest extends BaseNamedCurveTest {
     
     @Test
@@ -52,12 +50,12 @@ public class NamedCurveRegistryTest extends BaseNamedCurveTest {
         secp521r1.initialize();
         
         // To test lookup by a different param spec object instance
-        ECParameterSpec secp256r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp256r1.getObjectIdentifier()));
-        ECParameterSpec secp384r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp384r1.getObjectIdentifier()));
-        ECParameterSpec secp521r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp521r1.getObjectIdentifier()));
-        Assert.assertNotNull(secp256r1ParamSpec);
-        Assert.assertNotNull(secp384r1ParamSpec);
-        Assert.assertNotNull(secp521r1ParamSpec);
+        final ECParameterSpec secp256r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp256r1.getObjectIdentifier()));
+        final ECParameterSpec secp384r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp384r1.getObjectIdentifier()));
+        final ECParameterSpec secp521r1ParamSpec = ECSupport.convert(ECNamedCurveTable.getParameterSpec(secp521r1.getObjectIdentifier()));
+        assert secp256r1ParamSpec != null;
+        assert secp384r1ParamSpec != null;
+        assert secp521r1ParamSpec != null;
         
         
         NamedCurveRegistry registry = new NamedCurveRegistry();
@@ -158,12 +156,12 @@ public class NamedCurveRegistryTest extends BaseNamedCurveTest {
     
     @Test
     public void globalRegistry() {
-        NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
-        Assert.assertNotNull(registry);
+        final NamedCurveRegistry registry = ECSupport.getGlobalNamedCurveRegistry();
+        assert registry != null;
         
         // Test that it has at least the 3 main ones.
         Assert.assertTrue(registry.getRegisteredCurves().size() >= 3);
-        Set<String> curveNames = registry.getRegisteredCurves().stream().map(NamedCurve::getName).collect(Collectors.toSet());
+        final Set<String> curveNames = registry.getRegisteredCurves().stream().map(NamedCurve::getName).collect(Collectors.toSet());
         Assert.assertTrue(curveNames.contains("secp256r1"));
         Assert.assertTrue(curveNames.contains("secp384r1"));
         Assert.assertTrue(curveNames.contains("secp521r1"));
@@ -171,23 +169,25 @@ public class NamedCurveRegistryTest extends BaseNamedCurveTest {
     
     @Test
     public void registerBouncyCastleCurves() throws Exception {
-        String propName = GlobalNamedCurveRegistryInitializer.CONFIG_PROPERTY_REGISTER_BOUNCY_CASTLE_CURVES;
-        NamedCurveRegistry origRegistry = ECSupport.getGlobalNamedCurveRegistry();
+        final String propName = GlobalNamedCurveRegistryInitializer.CONFIG_PROPERTY_REGISTER_BOUNCY_CASTLE_CURVES;
+        final NamedCurveRegistry origRegistry = ECSupport.getGlobalNamedCurveRegistry();
+        assert origRegistry != null;
         try {
-            Properties props = new Properties();
+            final Properties props = new Properties();
             props.setProperty(propName, "true");
             ThreadLocalConfigurationPropertiesHolder.setProperties(props);
             
             new GlobalNamedCurveRegistryInitializer().init();
-            NamedCurveRegistry bcRegistry = ECSupport.getGlobalNamedCurveRegistry();
+            final NamedCurveRegistry bcRegistry = ECSupport.getGlobalNamedCurveRegistry();
+            assert bcRegistry != null;
             Assert.assertNotSame(bcRegistry, origRegistry);
             
-            Set<NamedCurve> origCurves = origRegistry.getRegisteredCurves();
-            Set<NamedCurve> bcCurves = bcRegistry.getRegisteredCurves();
+            final Set<NamedCurve> origCurves = origRegistry.getRegisteredCurves();
+            final Set<NamedCurve> bcCurves = bcRegistry.getRegisteredCurves();
             Assert.assertTrue(bcCurves.size() > origCurves.size());
             
-            Set<String> origOIDs = origCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
-            Set<String> bcOIDs = bcCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
+            final Set<String> origOIDs = origCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
+            final Set<String> bcOIDs = bcCurves.stream().map(NamedCurve::getObjectIdentifier).collect(Collectors.toSet());
             Assert.assertTrue(bcOIDs.containsAll(origOIDs));
         } finally {
             ThreadLocalConfigurationPropertiesHolder.clear();
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
index 5eab2907b..33d656447 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityConfigurationTest.java
@@ -22,6 +22,9 @@ import java.net.URISyntaxException;
 import java.security.cert.CertificateException;
 import java.util.Collections;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.apache.hc.client5.http.auth.UsernamePasswordCredentials;
 import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
 import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
@@ -36,9 +39,7 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.resolver.CriteriaSet;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class BasicHttpClientSecurityConfigurationTest {
     
     private X509Credential x509Credential;
@@ -89,7 +90,8 @@ public class BasicHttpClientSecurityConfigurationTest {
     // Helpers
     
     public static class MockTrustEngine implements TrustEngine<X509Credential>  {
-        public boolean validate(X509Credential token, CriteriaSet trustBasisCriteria) throws SecurityException {
+        public boolean validate(@Nonnull final X509Credential token, @Nullable final CriteriaSet trustBasisCriteria)
+                throws SecurityException {
             return false;
         }
     }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
index 54c77e068..3f5cc8142 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/BasicHttpClientSecurityParametersResolverTest.java
@@ -23,6 +23,9 @@ import java.security.KeyException;
 import java.security.cert.CertificateException;
 import java.util.Collections;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider;
 import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
 import org.opensaml.security.SecurityException;
@@ -41,9 +44,7 @@ import org.testng.annotations.Test;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
-/**
- *
- */
+ at SuppressWarnings("javadoc")
 public class BasicHttpClientSecurityParametersResolverTest {
     
     private BasicHttpClientSecurityParametersResolver resolver;
@@ -74,7 +75,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNull(params.getAuthCache());
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertNotNull(params.getCredentialsProvider());
@@ -93,7 +94,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNull(params.getAuthCache());
         Assert.assertNull(params.getClientTLSCredential());
         Assert.assertNull(params.getCredentialsProvider());
@@ -117,7 +118,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNull(params.getAuthCache());
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertNotNull(params.getCredentialsProvider());
@@ -135,7 +136,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNull(params.getAuthCache());
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertNotNull(params.getCredentialsProvider());
@@ -153,7 +154,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNull(params.getAuthCache());
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertNotNull(params.getCredentialsProvider());
@@ -181,7 +182,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertSame(params.getClientTLSCredential(), config1.getClientTLSCredential());
         
@@ -194,7 +195,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertSame(params.getClientTLSCredential(), config2.getClientTLSCredential());
         
@@ -207,7 +208,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNotNull(params.getClientTLSCredential());
         Assert.assertSame(params.getClientTLSCredential(), config3.getClientTLSCredential());
     }
@@ -220,7 +221,7 @@ public class BasicHttpClientSecurityParametersResolverTest {
         
         HttpClientSecurityParameters params = resolver.resolveSingle(criteria);
         
-        Assert.assertNotNull(params);;
+        assert params != null;
         Assert.assertNotNull(params.getTLSCriteriaSet());
     }
     
@@ -240,7 +241,8 @@ public class BasicHttpClientSecurityParametersResolverTest {
     }
     
     public static class MockTrustEngine implements TrustEngine<X509Credential>  {
-        public boolean validate(X509Credential token, CriteriaSet trustBasisCriteria) throws SecurityException {
+        public boolean validate(@Nonnull final X509Credential token, @Nullable final CriteriaSet trustBasisCriteria)
+                throws SecurityException {
             return false;
         }
     }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java
index 14f5fee7d..cadc7584f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSession.java
@@ -21,6 +21,7 @@ import java.security.Principal;
 import java.security.cert.Certificate;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
 import javax.net.ssl.SSLSessionContext;
@@ -30,10 +31,16 @@ import javax.net.ssl.SSLSessionContext;
  */
 public class MockSSLSession implements SSLSession {
     
-    private List<Certificate> peerCertificates;
-    private String peerHost;
+    @Nonnull private final List<Certificate> peerCertificates;
+    @Nonnull private final String peerHost;
     
-    public MockSSLSession(List<Certificate> certs, String host) {
+    /**
+     * Constructor.
+     *
+     * @param certs certs
+     * @param host peer host
+     */
+    public MockSSLSession(@Nonnull final List<Certificate> certs, @Nonnull final String host) {
         this.peerCertificates = certs;
         this.peerHost = host;
     }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java
index 9e6f2854f..52643ecc8 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockSSLSocket.java
@@ -21,6 +21,7 @@ import java.io.IOException;
 import java.security.cert.Certificate;
 import java.util.List;
 
+import javax.annotation.Nonnull;
 import javax.net.ssl.HandshakeCompletedListener;
 import javax.net.ssl.SSLSession;
 import javax.net.ssl.SSLSocket;
@@ -32,7 +33,13 @@ public class MockSSLSocket extends SSLSocket {
     
     private SSLSession session;
     
-    public MockSSLSocket(List<Certificate> certs, String host) {
+    /**
+     * Constructor.
+     *
+     * @param certs certs
+     * @param host peer host
+     */
+    public MockSSLSocket(@Nonnull final List<Certificate> certs, @Nonnull final String host) {
        session = new MockSSLSession(certs, host);
     }
 
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java
index ea80e9e48..63fe18a3f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/MockTLSSocketFactory.java
@@ -24,6 +24,8 @@ import java.net.UnknownHostException;
 import java.security.cert.Certificate;
 import java.util.List;
 
+import javax.annotation.Nonnull;
+
 import org.apache.hc.client5.http.socket.LayeredConnectionSocketFactory;
 import org.apache.hc.core5.http.HttpHost;
 import org.apache.hc.core5.http.protocol.HttpContext;
@@ -34,31 +36,40 @@ import org.apache.hc.core5.util.TimeValue;
  */
 public class MockTLSSocketFactory implements LayeredConnectionSocketFactory {
     
-    private Socket socket;
+    @Nonnull private final Socket socket;
     
+    /**
+     * Constructor.
+     */
     public MockTLSSocketFactory() {
         socket = new Socket();
     }
     
-    public MockTLSSocketFactory(List<Certificate> certs, String host) {
+    /**
+     * Constructor.
+     *
+     * @param certs certs
+     * @param host peer host
+     */
+    public MockTLSSocketFactory(@Nonnull final List<Certificate> certs, @Nonnull final String host) {
        socket = new MockSSLSocket(certs, host); 
     }
 
     /** {@inheritDoc} */
     public Socket createSocket(HttpContext context) throws IOException {
-        return this.socket;
+        return socket;
     }
 
     /** {@inheritDoc} */
     public Socket connectSocket(TimeValue connectTimeout, Socket sock, HttpHost host, InetSocketAddress remoteAddress,
             InetSocketAddress localAddress, HttpContext context) throws IOException {
-        return this.socket;
+        return socket;
     }
 
     /** {@inheritDoc} */
     public Socket createLayeredSocket(Socket socket, String target, int port, HttpContext context) throws IOException,
             UnknownHostException {
-        return this.socket;
+        return socket;
     }
 
 }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
index 8a0202bc4..f009acc3f 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/httpclient/impl/SecurityEnhancedTLSSocketFactoryTest.java
@@ -22,7 +22,6 @@ import java.io.InputStream;
 import java.net.Socket;
 import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 
@@ -44,9 +43,11 @@ import org.testng.annotations.AfterMethod;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.httpclient.HttpClientSupport;
 import net.shibboleth.shared.resolver.CriteriaSet;
 
+ at SuppressWarnings("javadoc")
 public class SecurityEnhancedTLSSocketFactoryTest {
     
     private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
@@ -89,7 +90,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
         X509Credential cred = getCredential("foo-1A1-good.crt");
 
         securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
-                Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+                CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
         Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
 
         securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
@@ -110,7 +111,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
         httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_TRUST_ENGINE, trustEngine);
 
         securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
-                Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+                CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
         Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
 
         securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
@@ -137,7 +138,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
         httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET, criteria);
 
         securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
-                Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+                CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
         Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
 
         securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
@@ -165,7 +166,7 @@ public class SecurityEnhancedTLSSocketFactoryTest {
         httpContext.setAttribute(HttpClientSecurityConstants.CONTEXT_KEY_CRITERIA_SET, criteria);
 
         securityEnhancedSocketFactory = new SecurityEnhancedTLSSocketFactory(buildInnerSSLFactory(
-                Collections.singletonList((Certificate)cred.getEntityCertificate()), hostname));
+                CollectionSupport.singletonList((Certificate)cred.getEntityCertificate()), hostname));
         Socket socket = securityEnhancedSocketFactory.createSocket(httpContext);
 
         securityEnhancedSocketFactory.connectSocket(TimeValue.ofMilliseconds(0), socket, new HttpHost("https", hostname, 443), null, null, httpContext);
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
index f78b23277..25dcd1c70 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/messaging/impl/PopulateHttpClientSecurityParametersHandlerTest.java
@@ -22,8 +22,9 @@ import java.security.PublicKey;
 import java.security.cert.X509CRL;
 import java.security.cert.X509Certificate;
 import java.util.Collection;
-import java.util.Collections;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
 import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
@@ -43,13 +44,14 @@ import org.testng.annotations.Test;
 
 import com.google.common.base.Predicates;
 
+import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
-import net.shibboleth.shared.logic.ConstraintViolationException;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
 /** Unit test for {@link PopulateHttpClientSecurityParametersHandler}. */
+ at SuppressWarnings("javadoc")
 public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLInitBaseTestCase {
 
     private MessageContext messageContext;
@@ -66,19 +68,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         handler.initialize();
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
-    public void testNoContext() throws Exception {
-        handler.setHttpClientSecurityParametersResolver(new MockResolver(false));
-        handler.initialize();
-        
-        handler.invoke(null);
-    }
-    
     @Test(expectedExceptions=MessageHandlerException.class)
     public void testResolverError() throws Exception {
         handler.setHttpClientSecurityParametersResolver(new MockResolver(true));
         handler.initialize();
         
+        assert messageContext != null;
         handler.invoke(messageContext);
     }    
 
@@ -86,9 +81,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         handler.setHttpClientSecurityParametersResolver(new MockResolver(false));
         handler.initialize();
         
+        assert messageContext != null;
         handler.invoke(messageContext);
-        Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
-        Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+        
+        final HttpClientSecurityParameters params = messageContext.ensureSubcontext(HttpClientSecurityContext.class).getSecurityParameters(); 
+        assert params != null;
+        Assert.assertNotNull(params.getClientTLSCredential());
     }    
     
     @Test public void testSuccessIncludeClientTLS() throws Exception {
@@ -96,9 +94,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         handler.setClientTLSPredicate(Predicates.<MessageContext>alwaysTrue());
         handler.initialize();
         
+        assert messageContext != null;
         handler.invoke(messageContext);
-        Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
-        Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+        
+        final HttpClientSecurityParameters params = messageContext.ensureSubcontext(HttpClientSecurityContext.class).getSecurityParameters(); 
+        assert params != null;
+        Assert.assertNotNull(params.getClientTLSCredential());
     }    
     
     @Test public void testSuccessExcludeClientTLS() throws Exception {
@@ -106,9 +107,12 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         handler.setClientTLSPredicate(Predicates.<MessageContext>alwaysFalse());
         handler.initialize();
         
+        assert messageContext != null;
         handler.invoke(messageContext);
-        Assert.assertNotNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters());
-        Assert.assertNull(messageContext.getSubcontext(HttpClientSecurityContext.class).getSecurityParameters().getClientTLSCredential());
+        
+        final HttpClientSecurityParameters params = messageContext.ensureSubcontext(HttpClientSecurityContext.class).getSecurityParameters(); 
+        assert params != null;
+        Assert.assertNull(params.getClientTLSCredential());
     }    
     
     private class MockResolver implements HttpClientSecurityParametersResolver {
@@ -120,18 +124,19 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         }
         
         /** {@inheritDoc} */
-        @Override
-        public Iterable<HttpClientSecurityParameters> resolve(CriteriaSet criteria) throws ResolverException {
-            return Collections.singletonList(resolveSingle(criteria));
+        @Nonnull public Iterable<HttpClientSecurityParameters> resolve(@Nullable final CriteriaSet criteria) throws ResolverException {
+            final HttpClientSecurityParameters params = resolveSingle(criteria);
+            assert params != null;
+            return CollectionSupport.singletonList(params);
         }
 
         /** {@inheritDoc} */
-        @Override
-        public HttpClientSecurityParameters resolveSingle(CriteriaSet criteria) throws ResolverException {
+        @Nullable public HttpClientSecurityParameters resolveSingle(@Nullable final CriteriaSet criteria) throws ResolverException {
             if (throwException) {
                 throw new ResolverException();
             }
             
+            assert criteria != null;
             Constraint.isNotNull(criteria.get(HttpClientSecurityConfigurationCriterion.class), "Criterion was null");
             HttpClientSecurityParameters params = new HttpClientSecurityParameters();
             params.setClientTLSCredential(new MockX509Credential());
@@ -153,8 +158,8 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         }
 
         /** {@inheritDoc} */
-        public Collection<String> getKeyNames() {
-            return null;
+        @Nonnull public Collection<String> getKeyNames() {
+            return CollectionSupport.emptyList();
         }
 
         /** {@inheritDoc} */
@@ -178,18 +183,18 @@ public class PopulateHttpClientSecurityParametersHandlerTest extends OpenSAMLIni
         }
 
         /** {@inheritDoc} */
-        public Class<? extends Credential> getCredentialType() {
-            return null;
+        @Nonnull public Class<? extends Credential> getCredentialType() {
+            return getClass();
         }
 
         /** {@inheritDoc} */
-        public X509Certificate getEntityCertificate() {
-            return null;
+        @Nonnull public X509Certificate getEntityCertificate() {
+            throw new IllegalStateException();
         }
 
         /** {@inheritDoc} */
-        public Collection<X509Certificate> getEntityCertificateChain() {
-            return null;
+        @Nonnull public Collection<X509Certificate> getEntityCertificateChain() {
+            return CollectionSupport.emptyList();
         }
 
         /** {@inheritDoc} */
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java
index b2682919b..cea1a1e28 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ChainingTrustEngineTest.java
@@ -20,7 +20,9 @@ package org.opensaml.security.trust.impl;
 import java.util.ArrayList;
 import java.util.List;
 
-import net.shibboleth.shared.logic.ConstraintViolationException;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import net.shibboleth.shared.resolver.CriteriaSet;
 
 import org.opensaml.core.criterion.EntityIdCriterion;
@@ -33,6 +35,7 @@ import org.testng.annotations.Test;
 /**
  * Test the chaining trust engine.
  */
+ at SuppressWarnings("javadoc")
 public class ChainingTrustEngineTest {
     
     private CriteriaSet criteriaSet;
@@ -95,11 +98,6 @@ public class ChainingTrustEngineTest {
         engine.validate(token, criteriaSet);
     }
     
-    @Test(expectedExceptions=ConstraintViolationException.class)
-    public void testNullChain() {
-        engine = new ChainingTrustEngine<>(null);
-    }
-    
     /** Mock token types. */
     private class SuperToken {
         
@@ -118,7 +116,8 @@ public class ChainingTrustEngineTest {
         }
 
         /** {@inheritDoc} */
-        public boolean validate(FooToken token1, CriteriaSet trustBasisCriteria) throws SecurityException {
+        public boolean validate(@Nonnull final FooToken token1, @Nullable final CriteriaSet trustBasisCriteria)
+                throws SecurityException {
             if (trusted == null) {
                 throw new SecurityException("This means an error happened");
             }
@@ -137,7 +136,8 @@ public class ChainingTrustEngineTest {
         }
 
         /** {@inheritDoc} */
-        public boolean validate(SuperToken token1, CriteriaSet trustBasisCriteria) throws SecurityException {
+        public boolean validate(@Nonnull final SuperToken token1, @Nullable final CriteriaSet trustBasisCriteria)
+                throws SecurityException {
             if (trusted == null) {
                 throw new SecurityException("This means an error happened");
             }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java
index cf452173d..8a1b73fea 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitKeyTrustEngineTest.java
@@ -41,6 +41,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 /**
  * Test the explicit key trust engine.
  */
+ at SuppressWarnings("javadoc")
 public class ExplicitKeyTrustEngineTest {
     
     private RSAPublicKey entityPubKey;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java
index 7b1598439..ea73d0bb6 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/trust/impl/ExplicitX509CertificateTrustEngineTest.java
@@ -41,6 +41,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 /**
  * Test the explicit key trust engine.
  */
+ at SuppressWarnings("javadoc")
 public class ExplicitX509CertificateTrustEngineTest {
     
     private RSAPublicKey entityPubKey;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
index 1efe65f30..774fc3a65 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/BasicX509CredentialNameEvaluatorTest.java
@@ -35,6 +35,7 @@ import org.testng.annotations.Test;
 /**
  * Tests the {@link CertPathPKIXTrustEvaluator} implementation.
  */
+ at SuppressWarnings("javadoc")
 public class BasicX509CredentialNameEvaluatorTest extends XMLObjectBaseTestCase {
     
     private X509Certificate entityCert3AltNamesDNS_URL_IP;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
index d18fd1e4f..ae1f2a5cd 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/CertPathPKIXTrustEvaluatorTest.java
@@ -41,6 +41,7 @@ import org.opensaml.security.x509.impl.CertPathPKIXTrustEvaluator;
 /**
  * Tests the {@link CertPathPKIXTrustEvaluator} implementation.
  */
+ at SuppressWarnings("javadoc")
 public class CertPathPKIXTrustEvaluatorTest extends XMLObjectBaseTestCase {
     
     private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
index 1e5e4b721..58bac4246 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/PKIXX509CredentialTrustEngineTest.java
@@ -42,6 +42,7 @@ import net.shibboleth.shared.resolver.CriteriaSet;
 /**
  * Tests the {@link PKIXX509CredentialTrustEngine} implementation.
  */
+ at SuppressWarnings("javadoc")
 public class PKIXX509CredentialTrustEngineTest extends XMLObjectBaseTestCase {
     
     private static final String DATA_PATH = "/org/opensaml/security/x509/impl/";
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
index f317c5cf3..c83788990 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/impl/StaticPKIXValidationInformationResolverTest.java
@@ -31,6 +31,7 @@ import org.testng.annotations.Test;
 import net.shibboleth.shared.resolver.CriteriaSet;
 import net.shibboleth.shared.resolver.ResolverException;
 
+ at SuppressWarnings("javadoc")
 public class StaticPKIXValidationInformationResolverTest {
     
     @Test
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java
index 72714f57c..2982dd570 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationConfigurationTest.java
@@ -30,6 +30,7 @@ import org.testng.Assert;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+ at SuppressWarnings("javadoc")
 public class BasicClientTLSValidationConfigurationTest {
     
     private BasicClientTLSValidationConfiguration config;
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java
index 5ec5b2635..0793b2792 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/BasicClientTLSValidationParametersResolverTest.java
@@ -33,13 +33,12 @@ import org.opensaml.security.x509.X509Credential;
 import org.opensaml.security.x509.tls.CertificateNameOptions;
 import org.opensaml.security.x509.tls.ClientTLSValidationConfigurationCriterion;
 import org.opensaml.security.x509.tls.ClientTLSValidationParameters;
-import org.opensaml.security.x509.tls.impl.BasicClientTLSValidationConfiguration;
-import org.opensaml.security.x509.tls.impl.BasicClientTLSValidationParametersResolver;
 import org.testng.Assert;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+ at SuppressWarnings("javadoc")
 public class BasicClientTLSValidationParametersResolverTest {
 
     private BasicClientTLSValidationParametersResolver resolver;
@@ -138,7 +137,7 @@ public class BasicClientTLSValidationParametersResolverTest {
 
         Assert.assertTrue(iterator.hasNext());
 
-        ClientTLSValidationParameters params = iterator.next();
+        final ClientTLSValidationParameters params = iterator.next();
 
         Assert.assertNotNull(params);
         Assert.assertTrue(params.getX509TrustEngine() == controlTrustEngine1);
@@ -151,9 +150,9 @@ public class BasicClientTLSValidationParametersResolverTest {
         config1.setX509TrustEngine(controlTrustEngine1);
         config1.setCertificateNameOptions(controlNameOpts1);
 
-        ClientTLSValidationParameters params = resolver.resolveSingle(criteriaSet);
+        final ClientTLSValidationParameters params = resolver.resolveSingle(criteriaSet);
 
-        Assert.assertNotNull(params);
+        assert params != null;
         Assert.assertTrue(params.getX509TrustEngine() == controlTrustEngine1);
         Assert.assertTrue(params.getCertificateNameOptions() == controlNameOpts1);
     }
diff --git a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java
index a320d1fe6..e646fb9e8 100644
--- a/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java
+++ b/opensaml-security-impl/src/test/java/org/opensaml/security/x509/tls/impl/ThreadLocalX509TrustManagerTest.java
@@ -34,6 +34,7 @@ import org.testng.annotations.Test;
 
 import net.shibboleth.shared.resolver.CriteriaSet;
 
+ at SuppressWarnings("javadoc")
 public class ThreadLocalX509TrustManagerTest {
     
     private ThreadLocalX509TrustManager trustManager = new ThreadLocalX509TrustManager();
@@ -67,7 +68,9 @@ public class ThreadLocalX509TrustManagerTest {
         
         trustManager.checkServerTrusted(chain, "RSA");
         
-        Assert.assertTrue(ThreadLocalX509TrustEngineContext.getTrusted());
+        final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+        assert trusted != null;
+        Assert.assertTrue(trusted);
     }
 
     @Test
@@ -77,8 +80,10 @@ public class ThreadLocalX509TrustManagerTest {
         try {
             trustManager.checkServerTrusted(chain, "RSA");
             Assert.fail("Trust manager should have thrown");
-        } catch (CertificateException e) {
-            Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+        } catch (final CertificateException e) {
+            final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+            assert trusted != null;
+            Assert.assertFalse(trusted);
         }
     }
 
@@ -87,7 +92,9 @@ public class ThreadLocalX509TrustManagerTest {
         ThreadLocalX509TrustEngineContext.loadCurrent(new MockTrustEngine<>(false), criteria, false);
         
         trustManager.checkServerTrusted(chain, "RSA");
-        Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+        final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+        assert trusted != null;
+        Assert.assertFalse(trusted);
     }
 
     @Test
@@ -97,8 +104,10 @@ public class ThreadLocalX509TrustManagerTest {
         try {
             trustManager.checkServerTrusted(chain, "RSA");
             Assert.fail("Trust manager should have thrown");
-        } catch (CertificateException e) {
-            Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+        } catch (final CertificateException e) {
+            final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+            assert trusted != null;
+            Assert.assertFalse(trusted);
         }
     }
 
@@ -107,7 +116,9 @@ public class ThreadLocalX509TrustManagerTest {
         ThreadLocalX509TrustEngineContext.loadCurrent(new MockTrustEngine<>(new SecurityException()), criteria, false);
         
         trustManager.checkServerTrusted(chain, "RSA");
-        Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+        final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+        assert trusted != null;
+        Assert.assertFalse(trusted);
     }
 
     @Test
@@ -117,8 +128,10 @@ public class ThreadLocalX509TrustManagerTest {
         try {
             trustManager.checkServerTrusted(chain, "RSA");
             Assert.fail("Trust manager should have thrown");
-        } catch (CertificateException e) {
-            Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+        } catch (final CertificateException e) {
+            final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+            assert trusted != null;
+            Assert.assertFalse(trusted);
         }
         
     }
@@ -128,7 +141,9 @@ public class ThreadLocalX509TrustManagerTest {
         ThreadLocalX509TrustEngineContext.loadCurrent(new MockTrustEngine<>(new RuntimeException()), criteria, false);
         
         trustManager.checkServerTrusted(chain, "RSA");
-        Assert.assertFalse(ThreadLocalX509TrustEngineContext.getTrusted());
+        final Boolean trusted = ThreadLocalX509TrustEngineContext.getTrusted();
+        assert trusted != null;
+        Assert.assertFalse(trusted);
         
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list