docs: private void getKeyTrustManagers(Map<String, Object> connectionInfo, SSLConfig sslConfig, List<KeyManager> kmHolder, List<TrustManager> tmHolder) throws Exception {
          if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
              Tr.entry(tc, "getKeyTrustManagers", new Object[] { connectionInfo, sslConfig });
  
          TrustManagerFactory trustManagerFactory = null;
          KeyManagerFactory keyManagerFactory = null;
          KeyStore keyStore = null;
          KeyStore trustStore = null;
          boolean createKeyMgr = true;
  
          String direction = Constants.DIRECTION_UNKNOWN;
  
          if (connectionInfo != null) {
              direction = (String) connectionInfo.get(Constants.CONNECTION_INFO_DIRECTION);
          }
  
          try {
              // Access a potentially set contextProvider.
              String trustFileName = getSSLContextProperty(Constants.SSLPROP_TRUST_STORE_NAME, sslConfig);
              WSKeyStore wsts = null;
              if (trustFileName != null)
                  wsts = KeyStoreManager.getInstance().getKeyStore(trustFileName);
  
              if (wsts != null) {
                  trustStore = wsts.getKeyStore(false, false);
              }
  
              String keyFileName = getSSLContextProperty(Constants.SSLPROP_KEY_STORE_NAME, sslConfig);
              WSKeyStore wsks = null;
              if (keyFileName != null)
                  wsks = KeyStoreManager.getInstance().getKeyStore(keyFileName);
  
              if (wsks != null) {
                  keyStore = wsks.getKeyStore(false, false);
              }
  
              boolean usingHwCryptoTrustStore = false;
              boolean usingHwCryptoKeyStore = false;
              String ctxtProvider = getSSLContextProperty(Constants.SSLPROP_CONTEXT_PROVIDER, sslConfig);
              String keyMgr = getSSLContextProperty(Constants.SSLPROP_KEY_MANAGER, sslConfig);
              String trustMgr = getSSLContextProperty(Constants.SSLPROP_TRUST_MANAGER, sslConfig);
              String clientAuthentication = getSSLContextProperty(Constants.SSLPROP_CLIENT_AUTHENTICATION, sslConfig);
              String clientAliasName = getSSLContextProperty(Constants.SSLPROP_KEY_STORE_CLIENT_ALIAS, sslConfig);
              String serverAliasName = getSSLContextProperty(Constants.SSLPROP_KEY_STORE_SERVER_ALIAS, sslConfig);
              String tokenLibraryFile = getSSLContextProperty(Constants.SSLPROP_TOKEN_LIBRARY, sslConfig);
              String tokenPassword = getSSLContextProperty(Constants.SSLPROP_TOKEN_PASSWORD, sslConfig);
              String tokenType = getSSLContextProperty(Constants.SSLPROP_TOKEN_TYPE, sslConfig);
              String tokenSlot = getSSLContextProperty(Constants.SSLPROP_TOKEN_SLOT, sslConfig);
              char[] passPhrase = null;
  
              // ---------------------
              // Handle Trust Store
              // ---------------------
              if (trustStore != null) {
                  // Trust store specified.
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                      Tr.debug(tc, "Using trust store: " + wsts.getLocation());
                  }
              } else {
                  // No trust store specified. Check if hw crypto is involved.
                  if (tokenLibraryFile != null) {
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "No trust store specified, but found hardware crypto");
                      }
  
                      WSPKCSInKeyStore pKS = pkcsStoreList.insert(tokenType, tokenLibraryFile, tokenPassword, false, ctxtProvider);
  
                      if (pKS != null) {
                          trustStore = pKS.getTS();
                          trustManagerFactory = pKS.getTMF();
                          usingHwCryptoTrustStore = true;
                      }
                  } else {
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "No trust store specified and no hardware crypto defined");
                      }
                      // No hw crypto.
                      if (direction.equals(Constants.DIRECTION_INBOUND) && (clientAuthentication.equals(Constants.FALSE))) {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                              Tr.debug(tc, "trust store permitted to be null since this is inbound and client auth is false");
                          }
                      } else {
                          throw new IllegalArgumentException("Invalid trust file name of null");
                      }
                  }
              }
  
              if (!usingHwCryptoTrustStore) {
                  // Get instance of trust manager factory. Use contextProvider if
                  // available.
                  // Already got trustManagerFactory for crypto
                  trustManagerFactory = getTrustManagerFactoryInstance(trustMgr, ctxtProvider);
                  String ldapCertstoreHost = System.getProperty(Constants.SSLPROP_LDAP_CERT_STORE_HOST);
                  String ldapCertstorePortS = System.getProperty(Constants.SSLPROP_LDAP_CERT_STORE_PORT);
                  int ldapCertstorePort = ldapCertstorePortS == null ? 389 : Integer.parseInt(ldapCertstorePortS);
  
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                      Tr.debug(tc, "certStoreHost: " + ldapCertstoreHost);
                      Tr.debug(tc, "certStorePort: " + ldapCertstorePort);
                      Tr.debug(tc, "trustManagerAlgorithm: " + trustManagerFactory.getAlgorithm());
                  }
  
                  if (ldapCertstoreHost != null && trustManagerFactory != null && (trustManagerFactory.getAlgorithm().equals("IbmPKIX"))) {
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "Adding ldap cert store " + ldapCertstoreHost + ":" + ldapCertstorePort + " ");
                      }
  
                      PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustStore, new X509CertSelector());
  
                      // create the ldap parms
                      LDAPCertStoreParameters LDAPParms = new LDAPCertStoreParameters(ldapCertstoreHost, ldapCertstorePort);
                      pkixParams.addCertStore(CertStore.getInstance("LDAP", LDAPParms));
  
                      // enable revocation checking
                      pkixParams.setRevocationEnabled(true);
  
                      // Wrap them as trust manager parameters
                      ManagerFactoryParameters trustParams = new CertPathTrustManagerParameters(pkixParams);
  
                      trustManagerFactory.init(trustParams);
                  } else if (null != trustManagerFactory) {
                      trustManagerFactory.init(trustStore);
                  }
              }
  
              // ---------------------
              // Handle Key Store
              // ---------------------
              if (keyStore != null) {
                  // Key store specified.
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                      Tr.debug(tc, "Using software keystore: " + wsks.getLocation());
                  }
              } else {
                  // No key store specified. Check if hw crypto is involved.
                  if (tokenLibraryFile != null) {
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "No key store specified, but found hardware crypto");
                      }
                      // Hw crypto is involved. Build the trust store in a hw unique way.
                      // First check to see if the same keystore is used by the trust
                      // manager.
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "Reusing key store from Trust Manager");
                      }
  
                      WSPKCSInKeyStore pKS = pkcsStoreList.insert(tokenType, tokenLibraryFile, tokenPassword, true, ctxtProvider);
                      if (pKS != null) {
                          keyStore = pKS.getKS();
                          keyManagerFactory = pKS.getKMF();
                          usingHwCryptoKeyStore = true;
                      }
                  } else {
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "No key store specified and no hardware crypto defined");
                      }
                      throw new IllegalArgumentException("No key store specified and no hardware crypto defined");
                  }
              }
  
              if (!usingHwCryptoKeyStore) {
                  // Get an instance of the key manager factory.
                  keyManagerFactory = getKeyManagerFactoryInstance(keyMgr, ctxtProvider);
                  String kspass = wsks.getPassword();
                  if (!kspass.isEmpty()) {
                      try {
                          SerializableProtectedString keypass = wsks.getKeyPassword();
                          String decodedPass = WSKeyStore.decodePassword(new String(keypass.getChars()));
                          synchronized (_lockObj) {
                              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                                  Tr.debug(tc, "Entering synchronized block around key manager factory init.");
                              }
                              keyManagerFactory.init(keyStore, decodedPass.toCharArray());
                              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                                  Tr.debug(tc, "Exiting synchronized block around key manager factory init.");
                              }
                          }
                      } catch (UnrecoverableKeyException exc) {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                              Tr.debug(tc, "Error initializing key manager, the password can not be used to recover all keys");
                          }
                          Tr.error(tc, "ssl.unrecoverablekey.error.CWPKI0813E", new Object[] { wsks.getLocation(), exc.getMessage() });
                          throw new UnrecoverableKeyException(exc.getMessage() + ": invalid password for key in file '" + wsks.getLocation() + "'");
                      }
                  } else {
                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                          Tr.debug(tc, "No password provide so do not create a keymanager");
                      }
                      createKeyMgr = false;
                  }
              }
  
              if (createKeyMgr) {
                  // Initialize the SSL context with the key and trust manager factories.
                  WSX509KeyManager wsKeyManager = new WSX509KeyManager(keyStore, passPhrase, keyManagerFactory, sslConfig, null);
  
                  if (serverAliasName != null && serverAliasName.length() > 0)
                      wsKeyManager.setServerAlias(serverAliasName);
                  if (clientAliasName != null && clientAliasName.length() > 0)
                      wsKeyManager.setClientAlias(clientAliasName);
  
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                      Tr.debug(tc, "Initializing WSX509KeyManager.", new Object[] { serverAliasName, clientAliasName, tokenSlot });
                  kmHolder.add(wsKeyManager);
              }
  
              // prepare trust manager wrapper.
              TrustManager[] defaultTMArray = trustManagerFactory.getTrustManagers();
              WSX509TrustManager wsTrustManager = new WSX509TrustManager(defaultTMArray, connectionInfo, sslConfig, trustFileName, wsts.getLocation());
              tmHolder.add(wsTrustManager);
  
          } catch (Exception e) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                  Tr.debug(tc, "Exception caught during init, " + e);
              FFDCFilter.processException(e, getClass().getName(), "getKeyTrustManagers", this);
              throw e;
          }
  
          if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
              Tr.exit(tc, "getKeyTrustManagers");
      }