Set security provider before reading any keystore

2 files changed, 4 insertions, 4 deletions

diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/ConfigServerClientsImpl.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/ConfigServerClientsImpl.java
index 951dc5b490b..bd51758793b 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/ConfigServerClientsImpl.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/ConfigServerClientsImpl.java
@@ -6,9 +6,7 @@ import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.NodeReposit
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.NodeRepositoryImpl;
 import com.yahoo.vespa.hosted.node.admin.configserver.orchestrator.Orchestrator;
 import com.yahoo.vespa.hosted.node.admin.configserver.orchestrator.OrchestratorImpl;
-import org.bouncycastle.jce.provider.BouncyCastleProvider;
 
-import java.security.Security;
 import java.util.Optional;
 
 /**
@@ -34,8 +32,6 @@ public class ConfigServerClientsImpl implements ConfigServerClients {
 
     private ConfigServerClientsImpl(NodeRepository nodeRepository, Orchestrator orchestrator,
                                     Optional<ConfigServerApi> configServerApi) {
-        Security.addProvider(new BouncyCastleProvider());
-
         this.nodeRepository = nodeRepository;
         this.orchestrator = orchestrator;
         this.configServerApi = configServerApi;
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/SslConfigServerApiImpl.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/SslConfigServerApiImpl.java
index 1167d662b2f..07103388790 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/SslConfigServerApiImpl.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/configserver/SslConfigServerApiImpl.java
@@ -7,9 +7,11 @@ import com.yahoo.vespa.hosted.node.admin.component.Environment;
 import com.yahoo.vespa.hosted.node.admin.configserver.certificate.ConfigServerKeyStoreRefresher;
 import com.yahoo.vespa.hosted.node.admin.util.KeyStoreOptions;
 import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
+import java.security.Security;
 import java.util.Collections;
 import java.util.Optional;
 
@@ -26,6 +28,8 @@ public class SslConfigServerApiImpl implements ConfigServerApi {
     private final Optional<ConfigServerKeyStoreRefresher> keyStoreRefresher;
 
     public SslConfigServerApiImpl(Environment environment) {
+        Security.addProvider(new BouncyCastleProvider());
+
         this.environment = environment;
 
         // At this point we don't know the state of the keystore, it may not exist at all, or the keystore