if (config.getLdapUrl() != null && config.getLdapUrl().startsWith("ldaps:")) {
     configureSNISocketFactory(connFactory);
     String ldapUrl = config.getLdapUrl();
+    String firstUrl = ldapUrl.split("\\s+")[0];
     try {
-        sniHostname = new URI(ldapUrl).getHost();
+        sniHostname = new URI(firstUrl).getHost();
         if (StringUtils.isBlank(sniHostname)) {
             log.warn("Could not extract hostname from LDAP URL '{}'; proceeding without SNI configuration", ldapUrl);
         }
     } catch (URISyntaxException e) {
         log.warn("Malformed LDAP URL '{}'; proceeding without SNI configuration: {}", ldapUrl, e.getMessage());
     }
 }

 private synchronized boolean ensureInitialized() {
     if (!initialized) {
-        initialized = true;
         try {
             jwtParser = AccessController.doPrivileged(this::buildJwtParser);
             encryptionUtil = EncryptionDecryptionUtil.fromSettings(settings, ENCRYPTION_KEY, configPath);
+            initialized = true;
         } catch (final RuntimeException e) {
             log.error("On-behalf-of authentication is misconfigured; OBO tokens will be rejected: {}", e.toString(), e);
+            // leave initialized=false so a subsequent request can retry after the config is fixed
         }
     }
     return jwtParser != null;
 }

-if (pkcs11Keystore && Security.getProviders("KeyStore.PKCS11") == null) {
-    throw new ParseException("No PKCS#11 provider is registered in the JVM; cannot use -kst PKCS11");
+if (pkcs11Keystore) {
+    Provider[] p = Security.getProviders("KeyStore.PKCS11");
+    if (p == null || p.length == 0) {
+        throw new ParseException("No PKCS#11 provider is registered in the JVM; cannot use -kst PKCS11");
+    }
 }

 public EncryptionDecryptionUtil(final String encodedSecret) {
     this(decodeBase64(encodedSecret));
 }
 
+/**
+ * Note: {@code secretBytes} is zeroed after key derivation; callers must not reuse it.
+ */
 public EncryptionDecryptionUtil(final byte[] secretBytes) {
     this.aesKey = deriveKey(secretBytes);
 }

 static void validateSigningKey(final String signingKey) {
-    if (signingKey == null) {
+    if (signingKey == null || signingKey.isEmpty()) {
         throw new OpenSearchSecurityException("Unable to find on behalf of authenticator signing_key");
     }
     final int signingKeyLengthBits;
     try {
         signingKeyLengthBits = Base64.getDecoder().decode(signingKey).length * Byte.SIZE;
     } catch (final IllegalArgumentException e) {
         throw new OpenSearchSecurityException("Signing key is not a valid Base64-encoded value: " + e.getMessage());
     }
     validateSigningKeyBitLength(signingKeyLengthBits);
 }

+private final String hostname;
+
+public HostnameAwareConnectionFactory(ConnectionConfig config, String ldapUrl) {
+    super(config);
+    this.ldapUrl = ldapUrl;
+    this.hostname = new LdapURL(ldapUrl).getEntry().getHostname();
+}
+
 @Override
 public Connection getConnection() {
-    String hostname = new LdapURL(ldapUrl).getEntry().getHostname();
     return new SniAwareConnection(super.getConnection(), hostname);
 }

 public static KeyStore loadKeyStore(final String storePath, final String keyStorePassword, final String type) throws Exception {
     if (storePath == null && !PKCS11.equalsIgnoreCase(type)) {
         return null;
     }
-    String storeType = extractStoreType(storePath, type);
+    String storeType = PKCS11.equalsIgnoreCase(type) ? PKCS11 : extractStoreType(storePath, type);

 final char[] truststorePassword = Optional.ofNullable(SECURITY_SSL_HTTP_TRUSTSTORE_PASSWORD.getSetting(settings))
     .filter(p -> !p.isEmpty())
     .map(String::toCharArray)
     .orElse(null);
 final KeyStore ts = KeyStore.getInstance(truststoreType);
 if ("PKCS11".equalsIgnoreCase(truststoreType)) {
     ts.load(null, truststorePassword);
 } else {
+    if (truststore == null) {
+        throw new IllegalArgumentException("Truststore path required for type " + truststoreType);
+    }
     try (final var fin = new FileInputStream(env.configDir().resolve(truststore).toAbsolutePath().toString())) {
         ts.load(fin, truststorePassword);
     }
 }

 public static String extractStoreType(String storePath, String storeType) {
     var finalStoreType = Optional.ofNullable(storeType).orElseGet(() -> detectStoreType(storePath));
+    if (finalStoreType == null) {
+        throw new IllegalArgumentException("Unable to determine keystore/truststore type for path: " + storePath);
+    }
     var isFipsSupportedStoreType = Stream.of(PKCS11, BCFKS).anyMatch(it -> it.equalsIgnoreCase(finalStoreType));
 
     if (FipsMode.isEnabled() && !isFipsSupportedStoreType) {
         throw new IllegalArgumentException(
             finalStoreType.toUpperCase(Locale.ROOT) + " keystores / truststores are not supported in FIPS mode - use BCFKS or PKCS#11"
         );
     }
     return finalStoreType;
 }

 CharBuffer passwordBuffer = CharBuffer.wrap(password);
 try {
     return Password.check(passwordBuffer, hash).with(getPBKDF2FunctionFromHash(hash));
-} catch (Throwable e) {
+} catch (Exception e) {
     return false;
 } finally {
     cleanup(passwordBuffer);
 }

-public static java.util.function.Supplier<String> envSupplier = () -> System.getenv("OPENSEARCH_FIPS_MODE");
+static volatile java.util.function.Supplier<String> envSupplier = () -> System.getenv("OPENSEARCH_FIPS_MODE");
 
 public static boolean isEnabled() {
     return "true".equalsIgnoreCase(envSupplier.get());
 }

 byte[] accountBytes = accountName.getBytes(StandardCharsets.UTF_8);
 ByteBuffer passwordByteBuffer = StandardCharsets.UTF_8.encode(CharBuffer.wrap(plainTextPassword));
 byte[] passwordBytes = new byte[passwordByteBuffer.remaining()];
 passwordByteBuffer.get(passwordBytes);
 Arrays.fill(passwordByteBuffer.array(), (byte) 0);
 credentialBytes = new byte[accountBytes.length + 1 + passwordBytes.length];
 System.arraycopy(accountBytes, 0, credentialBytes, 0, accountBytes.length);
 credentialBytes[accountBytes.length] = ':';
 System.arraycopy(passwordBytes, 0, credentialBytes, accountBytes.length + 1, passwordBytes.length);
 Arrays.fill(passwordBytes, (byte) 0);
 
+// NOTE: Base64 encoding materializes plaintext credentials into an immutable String;
+// subsequent wiping of credentialBytes cannot reach that copy.
 authToken = Base64.getUrlEncoder().encodeToString(credentialBytes);

-        byte[] derivedKey = new byte[AES_KEY_LENGTH_BYTES];  // AES-256
-        kdf.generateBytes(derivedKey);
-        return new SecretKeySpec(derivedKey, "AES");
-    } catch (final Exception e) {
-        throw new RuntimeException("Error deriving key from secret", e);
-    } finally {
-        Arrays.fill(secretBytes, (byte) 0);
-    }
+        byte[] ikm = secretBytes.clone();
+        try {
+            FipsKDF.AgreementKDFParameters hkdfParams = FipsKDF.HKDF.withPRF(FipsKDF.AgreementKDFPRF.SHA256_HMAC)
+                .using(ikm)
+                .withIV(HKDF_INFO);
+            KDFCalculator<FipsKDF.AgreementKDFParameters> kdf = new FipsKDF.AgreementOperatorFactory().createKDFCalculator(hkdfParams);
+            byte[] derivedKey = new byte[AES_KEY_LENGTH_BYTES];
+            kdf.generateBytes(derivedKey);
+            return new SecretKeySpec(derivedKey, "AES");
+        } catch (final Exception e) {
+            throw new RuntimeException("Error deriving key from secret", e);
+        } finally {
+            Arrays.fill(ikm, (byte) 0);
+        }

 final String explicitType = environment.settings().get(sslConfigSuffix + KEYSTORE_TYPE);
 final boolean isPkcs11 = PemKeyReader.PKCS11.equalsIgnoreCase(explicitType);
-final Path path = isPkcs11 ? null : resolvePath(environment.settings().get(sslConfigSuffix + KEYSTORE_FILEPATH), environment);
+final String filepath = environment.settings().get(sslConfigSuffix + KEYSTORE_FILEPATH);
+if (!isPkcs11 && filepath == null) {
+    throw new OpenSearchException("Missing keystore filepath setting: " + sslConfigSuffix + KEYSTORE_FILEPATH);
+}
+final Path path = isPkcs11 ? null : resolvePath(filepath, environment);
 final String resolvedType = isPkcs11 ? PemKeyReader.PKCS11 : PemKeyReader.extractStoreType(path.toString(), explicitType);

             String sniHostname = null;
             if (config.getLdapUrl() != null && config.getLdapUrl().startsWith("ldaps:")) {
                 configureSNISocketFactory(connFactory);
                 String ldapUrl = config.getLdapUrl();
+                String firstUrl = ldapUrl.split("\\s+")[0];
                 try {
-                    sniHostname = new URI(ldapUrl).getHost();
+                    sniHostname = new URI(firstUrl).getHost();

 try {
     return Password.check(passwordBuffer, hash).with(getPBKDF2FunctionFromHash(hash));
-} catch (Throwable e) {
+} catch (Exception e) {
     return false;
 } finally {
     cleanup(passwordBuffer);
 }

 private synchronized boolean ensureInitialized() {
     if (!initialized) {
-        initialized = true;
         try {
             jwtParser = AccessController.doPrivileged(this::buildJwtParser);
             encryptionUtil = EncryptionDecryptionUtil.fromSettings(settings, ENCRYPTION_KEY, configPath);
         } catch (final RuntimeException e) {
             log.error("On-behalf-of authentication is misconfigured; OBO tokens will be rejected: {}", e.toString(), e);
+        } finally {
+            initialized = true;
         }
     }
     return jwtParser != null;
 }

 public static SniContext configure(String hostname) {
+    final String previous = hostnameThreadLocal.get();
     hostnameThreadLocal.set(hostname);
     log.debug("Configured SNI context: hostname={}", hostname);
-    return SNISettingTLSSocketFactory::clearContext;
+    return () -> {
+        if (previous == null) {
+            hostnameThreadLocal.remove();
+        } else {
+            hostnameThreadLocal.set(previous);
+        }
+    };
 }

-if (ThreadLocalTLSSocketFactory.class.getName().equalsIgnoreCase(name)) {
+if (ThreadLocalTLSSocketFactory.class.getName().equals(name)) {
     return ThreadLocalTLSSocketFactory.class;
 }

     private static KeyStore loadStore(String path, String type, char[] password) throws Exception {
-        KeyStore ks = KeyStore.getInstance(type.toUpperCase());
+        KeyStore ks = KeyStore.getInstance(type.toUpperCase(java.util.Locale.ROOT));
 
         if ("PKCS11".equalsIgnoreCase(type)) {
             ks.load(null, password);
         } else {
             try (final var fin = new FileInputStream(Paths.get(path).toFile())) {
                 ks.load(fin, password);
             }
         }
         return ks;
     }

 byte[] accountBytes = accountName.getBytes(StandardCharsets.UTF_8);
 ByteBuffer passwordByteBuffer = StandardCharsets.UTF_8.encode(CharBuffer.wrap(plainTextPassword));
 byte[] passwordBytes = new byte[passwordByteBuffer.remaining()];
 passwordByteBuffer.get(passwordBytes);
-Arrays.fill(passwordByteBuffer.array(), (byte) 0);
+if (passwordByteBuffer.hasArray()) {
+    Arrays.fill(passwordByteBuffer.array(), 0, passwordByteBuffer.array().length, (byte) 0);
+}

-public static java.util.function.Supplier<String> envSupplier = () -> System.getenv("OPENSEARCH_FIPS_MODE");
+static java.util.function.Supplier<String> envSupplier = () -> System.getenv("OPENSEARCH_FIPS_MODE");
 
 public static boolean isEnabled() {
     return "true".equalsIgnoreCase(envSupplier.get());
 }

     public static KeyStore loadKeyStore(final String storePath, final String keyStorePassword, final String type) throws Exception {
         if (storePath == null && !PKCS11.equalsIgnoreCase(type)) {
             return null;
         }
-        String storeType = extractStoreType(storePath, type);
+        String storeType = storePath == null ? PKCS11 : extractStoreType(storePath, type);

-} catch (Exception e) {
-    throw new OpenSearchException("Failed to load keystore from " + (path != null ? path : "PKCS#11 token"), e);
+} else {
+    if (path == null) {
+        throw new OpenSearchException("Keystore path is required for type " + type);
+    }
+    try (final var in = Files.newInputStream(path)) {
+        keyStore.load(in, password);
+    } catch (IOException e) {
+        throw new RuntimeException(e);
+    }
 }

 public EncryptionDecryptionUtil(final byte[] secretBytes) {
-    this.aesKey = deriveKey(secretBytes);
+    this.aesKey = deriveKey(secretBytes.clone());
 }