diff --git a/.github/workflows/test-rabbitmq-alphas.yml b/.github/workflows/test-rabbitmq-alphas.yml
index 3f4b26b13a..eca3f8e212 100644
--- a/.github/workflows/test-rabbitmq-alphas.yml
+++ b/.github/workflows/test-rabbitmq-alphas.yml
@@ -43,19 +43,19 @@ jobs:
         run: make deps
       - name: Test with NIO
         run: |
-          ./mvnw verify -P use-nio -Drabbitmqctl.bin=DOCKER:rabbitmq \
-            -Dtest-broker.A.nodename=rabbit@$(hostname) -Dtest-broker.B.nodename=hare@$(hostname) \
+          ./mvnw verify -P use-nio -Drabbitmqctl.bin=DOCKER:rabbitmq0 \
+            -Dtest-broker.A.nodename=rabbit@node0 -Dtest-broker.B.nodename=rabbit@node1 \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
             -Dmaven.javadoc.skip=true \
-            -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
             --no-transfer-progress
       - name: Test with blocking IO
         run: |
-          ./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq \
-          -Dtest-broker.A.nodename=rabbit@$(hostname) -Dtest-broker.B.nodename=hare@$(hostname) \
-          -Dmaven.javadoc.skip=true \
-          -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
-          --no-transfer-progress
-      - name: Stop broker A
-        run: docker stop rabbitmq && docker rm rabbitmq
-      - name: Stop broker B
-        run: docker stop hare && docker rm hare
+          ./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq0 \
+            -Dtest-broker.A.nodename=rabbit@node0 -Dtest-broker.B.nodename=rabbit@node1 \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
+            -Dmaven.javadoc.skip=true \
+            --no-transfer-progress
+      - name: Stop cluster
+        run: docker compose --file ci/cluster/docker-compose.yml down
diff --git a/.github/workflows/test-supported-java-versions-5.x.yml b/.github/workflows/test-supported-java-versions-5.x.yml
index 8427652743..0c9a36d00f 100644
--- a/.github/workflows/test-supported-java-versions-5.x.yml
+++ b/.github/workflows/test-supported-java-versions-5.x.yml
@@ -45,17 +45,19 @@ jobs:
         run: |
           ./mvnw verify -P use-nio -Drabbitmqctl.bin=DOCKER:rabbitmq \
             -Dtest-broker.A.nodename=rabbit@$(hostname) -Dmaven.javadoc.skip=true \
-            -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
             -Dit.test=ClientTestSuite,FunctionalTestSuite,ServerTestSuite,SslTestSuite \
             --no-transfer-progress \
             -Dnet.bytebuddy.experimental=true
       - name: Test with blocking IO
         run: |
           ./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq \
-          -Dtest-broker.A.nodename=rabbit@$(hostname) -Dmaven.javadoc.skip=true \
-          -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
-          -Dit.test=ClientTestSuite,FunctionalTestSuite,ServerTestSuite,SslTestSuite \
-          --no-transfer-progress \
-          -Dnet.bytebuddy.experimental=true
+            -Dtest-broker.A.nodename=rabbit@$(hostname) -Dmaven.javadoc.skip=true \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
+            -Dit.test=ClientTestSuite,FunctionalTestSuite,ServerTestSuite,SslTestSuite \
+            --no-transfer-progress \
+            -Dnet.bytebuddy.experimental=true
       - name: Stop broker
         run: docker stop rabbitmq && docker rm rabbitmq
diff --git a/.github/workflows/test-supported-java-versions-main.yml b/.github/workflows/test-supported-java-versions-main.yml
index 6bf72c3675..902b70bd0b 100644
--- a/.github/workflows/test-supported-java-versions-main.yml
+++ b/.github/workflows/test-supported-java-versions-main.yml
@@ -43,17 +43,19 @@ jobs:
         run: |
           ./mvnw verify -P use-nio -Drabbitmqctl.bin=DOCKER:rabbitmq \
             -Dtest-broker.A.nodename=rabbit@$(hostname) -Dmaven.javadoc.skip=true \
-            -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
             -Dit.test=ClientTestSuite,FunctionalTestSuite,ServerTestSuite,SslTestSuite \
             --no-transfer-progress \
             -Dnet.bytebuddy.experimental=true
       - name: Test with blocking IO
         run: |
           ./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq \
-          -Dtest-broker.A.nodename=rabbit@$(hostname) -Dmaven.javadoc.skip=true \
-          -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
-          -Dit.test=ClientTestSuite,FunctionalTestSuite,ServerTestSuite,SslTestSuite \
-          --no-transfer-progress \
-          -Dnet.bytebuddy.experimental=true
+            -Dtest-broker.A.nodename=rabbit@$(hostname) -Dmaven.javadoc.skip=true \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
+            -Dit.test=ClientTestSuite,FunctionalTestSuite,ServerTestSuite,SslTestSuite \
+            --no-transfer-progress \
+            -Dnet.bytebuddy.experimental=true
       - name: Stop broker
         run: docker stop rabbitmq && docker rm rabbitmq
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f9513a60b9..126c9ffe5f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -41,22 +41,23 @@ jobs:
         run: make deps
       - name: Test with NIO
         run: |
-          ./mvnw verify -P use-nio -Drabbitmqctl.bin=DOCKER:rabbitmq \
-            -Dtest-broker.A.nodename=rabbit@$(hostname) -Dtest-broker.B.nodename=hare@$(hostname) \
+          ./mvnw verify -P use-nio -Drabbitmqctl.bin=DOCKER:rabbitmq0 \
+            -Dtest-broker.A.nodename=rabbit@node0 -Dtest-broker.B.nodename=rabbit@node1 \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
             -Dmaven.javadoc.skip=true \
-            -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
             --no-transfer-progress
       - name: Test with blocking IO
         run: |
-          ./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq \
-          -Dtest-broker.A.nodename=rabbit@$(hostname) -Dtest-broker.B.nodename=hare@$(hostname) \
-          -Dmaven.javadoc.skip=true \
-          -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
-          --no-transfer-progress
-      - name: Stop broker A
-        run: docker stop rabbitmq && docker rm rabbitmq
-      - name: Stop broker B
-        run: docker stop hare && docker rm hare
+          ./mvnw verify -Drabbitmqctl.bin=DOCKER:rabbitmq0 \
+            -Dtest-broker.A.nodename=rabbit@node0 -Dtest-broker.B.nodename=rabbit@node1 \
+            -Dca.certificate=./tls-gen/basic/result/ca_certificate.pem \
+            -Dclient.certificate=./tls-gen/basic/result/client_$(hostname)_certificate.pem \
+            -Dmaven.javadoc.skip=true \
+            -Dtest-client-cert.password= -Dtest-tls-certs.dir=rabbitmq-configuration/tls \
+            --no-transfer-progress
+      - name: Stop cluster
+        run: docker compose --file ci/cluster/docker-compose.yml down
       - name: Publish snapshot
         if: ${{ github.event_name != 'pull_request' }}
         run: ./mvnw clean deploy -Psnapshots -DskipITs -DskipTests --no-transfer-progress
diff --git a/ci/_start-cluster.sh b/ci/_start-cluster.sh
new file mode 100755
index 0000000000..6b01992d96
--- /dev/null
+++ b/ci/_start-cluster.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+LOCAL_SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+RABBITMQ_IMAGE=${RABBITMQ_IMAGE:-rabbitmq:4.0}
+
+wait_for_message() {
+  while ! docker logs "$1" | grep -q "$2";
+  do
+      sleep 5
+      echo "Waiting 5 seconds for $1 to start..."
+  done
+}
+
+make -C "${PWD}"/tls-gen/basic
+
+mv tls-gen/basic/result/server_$(hostname -s)_certificate.pem tls-gen/basic/result/server_certificate.pem
+mv tls-gen/basic/result/server_$(hostname -s)_key.pem tls-gen/basic/result/server_key.pem
+mv tls-gen/basic/server_$(hostname -s) tls-gen/basic/server
+mv tls-gen/basic/client_$(hostname -s) tls-gen/basic/client
+
+rm -rf rabbitmq-configuration
+mkdir -p rabbitmq-configuration/tls
+
+cp -R "${PWD}"/tls-gen/basic/* rabbitmq-configuration/tls
+chmod -R o+r rabbitmq-configuration/tls/*
+chmod -R g+r rabbitmq-configuration/tls/*
+./mvnw -q clean resources:testResources -Dtest-tls-certs.dir=/etc/rabbitmq/tls
+cp target/test-classes/rabbit@localhost.config rabbitmq-configuration/rabbit@localhost.config
+cp target/test-classes/hare@localhost.config rabbitmq-configuration/hare@localhost.config
+
+echo "Running RabbitMQ ${RABBITMQ_IMAGE}"
+
+docker rm -f rabbitmq 2>/dev/null || echo "rabbitmq was not running"
+docker run -d --name rabbitmq \
+    --network host \
+    -v "${PWD}"/rabbitmq-configuration:/etc/rabbitmq \
+    --env RABBITMQ_CONFIG_FILE=/etc/rabbitmq/rabbit@localhost.config \
+    --env RABBITMQ_NODENAME=rabbit@$(hostname) \
+    --env RABBITMQ_NODE_PORT=5672 \
+    --env RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="-setcookie do-not-do-this-in-production" \
+    "${RABBITMQ_IMAGE}"
+
+# for CLI commands to share the same cookie
+docker exec rabbitmq bash -c "echo 'do-not-do-this-in-production' > /var/lib/rabbitmq/.erlang.cookie"
+docker exec rabbitmq chmod 0600 /var/lib/rabbitmq/.erlang.cookie
+
+wait_for_message rabbitmq "completed with"
+
+docker run -d --name hare \
+    --network host \
+    -v "${PWD}"/rabbitmq-configuration:/etc/rabbitmq \
+    --env RABBITMQ_CONFIG_FILE=/etc/rabbitmq/hare@localhost.config \
+    --env RABBITMQ_NODENAME=hare@$(hostname) \
+    --env RABBITMQ_NODE_PORT=5673 \
+    --env RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="-setcookie do-not-do-this-in-production" \
+    "${RABBITMQ_IMAGE}"
+
+# for CLI commands to share the same cookie
+docker exec hare bash -c "echo 'do-not-do-this-in-production' > /var/lib/rabbitmq/.erlang.cookie"
+docker exec hare chmod 0600 /var/lib/rabbitmq/.erlang.cookie
+
+wait_for_message hare "completed with"
+
+docker exec hare rabbitmqctl --node hare@$(hostname) status
+
+docker exec rabbitmq rabbitmq-diagnostics --node rabbit@$(hostname) is_running
+docker exec hare rabbitmq-diagnostics --node hare@$(hostname) is_running
+
+docker exec hare rabbitmqctl --node hare@$(hostname) stop_app
+docker exec hare rabbitmqctl --node hare@$(hostname) join_cluster rabbit@$(hostname)
+docker exec hare rabbitmqctl --node hare@$(hostname) start_app
+
+sleep 10
+
+docker exec hare rabbitmqctl --node hare@$(hostname) await_startup
+
+docker exec hare rabbitmqctl --node hare@$(hostname) enable_feature_flag --opt-in khepri_db
+docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) enable_feature_flag --opt-in khepri_db
+
+docker exec rabbitmq rabbitmq-diagnostics --node rabbit@$(hostname) erlang_version
+docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) version
+docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) status
+docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) cluster_status
diff --git a/ci/cluster/configuration/rabbitmq.conf b/ci/cluster/configuration/rabbitmq.conf
new file mode 100644
index 0000000000..652395d768
--- /dev/null
+++ b/ci/cluster/configuration/rabbitmq.conf
@@ -0,0 +1,20 @@
+cluster_formation.peer_discovery_backend  = rabbit_peer_discovery_classic_config
+cluster_formation.classic_config.nodes.1 = rabbit@node0
+cluster_formation.classic_config.nodes.2 = rabbit@node1
+cluster_formation.classic_config.nodes.3 = rabbit@node2
+loopback_users = none
+
+listeners.ssl.default = 5671
+
+ssl_options.cacertfile = /etc/rabbitmq/tls/ca_certificate.pem
+ssl_options.certfile   = /etc/rabbitmq/tls/server_certificate.pem
+ssl_options.keyfile    = /etc/rabbitmq/tls/server_key.pem
+ssl_options.verify     = verify_peer
+ssl_options.fail_if_no_peer_cert = false
+ssl_options.honor_cipher_order   = true
+
+auth_mechanisms.1 = PLAIN
+auth_mechanisms.2 = ANONYMOUS
+auth_mechanisms.3 = AMQPLAIN
+auth_mechanisms.4 = EXTERNAL
+auth_mechanisms.5 = RABBIT-CR-DEMO
diff --git a/ci/cluster/docker-compose.yml b/ci/cluster/docker-compose.yml
new file mode 100644
index 0000000000..2d438519ba
--- /dev/null
+++ b/ci/cluster/docker-compose.yml
@@ -0,0 +1,49 @@
+services:
+  node0:
+    environment:
+      - RABBITMQ_ERLANG_COOKIE='secret_cookie'
+    networks:
+      - rabbitmq-cluster
+    hostname: node0
+    container_name: rabbitmq0
+    image: ${RABBITMQ_IMAGE:-rabbitmq:4.0}
+    pull_policy: always
+    ports:
+      - "5672:5672"
+      - "5671:5671"
+    tty: true
+    volumes:
+      - ./configuration/:/etc/rabbitmq/
+      - ../../rabbitmq-configuration/tls:/etc/rabbitmq/tls/
+  node1:
+    environment:
+      - RABBITMQ_ERLANG_COOKIE='secret_cookie'
+    networks:
+      - rabbitmq-cluster
+    hostname: node1
+    container_name: rabbitmq1
+    image: ${RABBITMQ_IMAGE:-rabbitmq:4.0}
+    pull_policy: always
+    ports:
+      - "5673:5672"
+    tty: true
+    volumes:
+      - ./configuration/:/etc/rabbitmq/
+      - ../../rabbitmq-configuration/tls:/etc/rabbitmq/tls/
+  node2:
+    environment:
+      - RABBITMQ_ERLANG_COOKIE='secret_cookie'
+    networks:
+      - rabbitmq-cluster
+    hostname: node2
+    container_name: rabbitmq2
+    image: ${RABBITMQ_IMAGE:-rabbitmq:4.0}
+    pull_policy: always
+    ports:
+      - "5674:5672"
+    tty: true
+    volumes:
+      - ./configuration/:/etc/rabbitmq/
+      - ../../rabbitmq-configuration/tls:/etc/rabbitmq/tls/
+networks:
+  rabbitmq-cluster:
diff --git a/ci/start-broker.sh b/ci/start-broker.sh
index 89ab76572d..ad13368cfb 100755
--- a/ci/start-broker.sh
+++ b/ci/start-broker.sh
@@ -12,21 +12,33 @@ wait_for_message() {
   done
 }
 
-make -C "${PWD}"/tls-gen/basic
+rm -rf rabbitmq-configuration
+mkdir -p rabbitmq-configuration/tls
 
-mv tls-gen/basic/result/server_$(hostname -s)_certificate.pem tls-gen/basic/result/server_certificate.pem
-mv tls-gen/basic/result/server_$(hostname -s)_key.pem tls-gen/basic/result/server_key.pem
-mv tls-gen/basic/server_$(hostname -s) tls-gen/basic/server
-mv tls-gen/basic/client_$(hostname -s) tls-gen/basic/client
+make -C "${PWD}"/tls-gen/basic
 
 rm -rf rabbitmq-configuration
 mkdir -p rabbitmq-configuration/tls
-
-cp -R "${PWD}"/tls-gen/basic/* rabbitmq-configuration/tls
-chmod -R o+r rabbitmq-configuration/tls/*
-chmod -R g+r rabbitmq-configuration/tls/*
-./mvnw -q clean resources:testResources -Dtest-tls-certs.dir=/etc/rabbitmq/tls
-cp target/test-classes/rabbit@localhost.config rabbitmq-configuration/rabbitmq.config
+cp -R "${PWD}"/tls-gen/basic/result/* rabbitmq-configuration/tls
+chmod o+r rabbitmq-configuration/tls/*
+chmod g+r rabbitmq-configuration/tls/*
+
+echo "loopback_users = none
+
+listeners.ssl.default = 5671
+
+ssl_options.cacertfile = /etc/rabbitmq/tls/ca_certificate.pem
+ssl_options.certfile   = /etc/rabbitmq/tls/server_$(hostname)_certificate.pem
+ssl_options.keyfile    = /etc/rabbitmq/tls/server_$(hostname)_key.pem
+ssl_options.verify     = verify_peer
+ssl_options.fail_if_no_peer_cert = false
+ssl_options.honor_cipher_order   = true
+
+auth_mechanisms.1 = PLAIN
+auth_mechanisms.2 = ANONYMOUS
+auth_mechanisms.3 = AMQPLAIN
+auth_mechanisms.4 = EXTERNAL
+auth_mechanisms.5 = RABBIT-CR-DEMO" >> rabbitmq-configuration/rabbitmq.conf
 
 echo "Running RabbitMQ ${RABBITMQ_IMAGE}"
 
diff --git a/ci/start-cluster.sh b/ci/start-cluster.sh
index 6b01992d96..85a8ce5c11 100755
--- a/ci/start-cluster.sh
+++ b/ci/start-cluster.sh
@@ -1,84 +1,39 @@
 #!/usr/bin/env bash
 
-LOCAL_SCRIPT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-RABBITMQ_IMAGE=${RABBITMQ_IMAGE:-rabbitmq:4.0}
+export RABBITMQ_IMAGE=${RABBITMQ_IMAGE:-rabbitmq:4.0}
 
 wait_for_message() {
   while ! docker logs "$1" | grep -q "$2";
   do
-      sleep 5
-      echo "Waiting 5 seconds for $1 to start..."
+      sleep 2
+      echo "Waiting 2 seconds for $1 to start..."
   done
 }
 
-make -C "${PWD}"/tls-gen/basic
-
-mv tls-gen/basic/result/server_$(hostname -s)_certificate.pem tls-gen/basic/result/server_certificate.pem
-mv tls-gen/basic/result/server_$(hostname -s)_key.pem tls-gen/basic/result/server_key.pem
-mv tls-gen/basic/server_$(hostname -s) tls-gen/basic/server
-mv tls-gen/basic/client_$(hostname -s) tls-gen/basic/client
-
 rm -rf rabbitmq-configuration
 mkdir -p rabbitmq-configuration/tls
 
-cp -R "${PWD}"/tls-gen/basic/* rabbitmq-configuration/tls
-chmod -R o+r rabbitmq-configuration/tls/*
-chmod -R g+r rabbitmq-configuration/tls/*
-./mvnw -q clean resources:testResources -Dtest-tls-certs.dir=/etc/rabbitmq/tls
-cp target/test-classes/rabbit@localhost.config rabbitmq-configuration/rabbit@localhost.config
-cp target/test-classes/hare@localhost.config rabbitmq-configuration/hare@localhost.config
-
-echo "Running RabbitMQ ${RABBITMQ_IMAGE}"
-
-docker rm -f rabbitmq 2>/dev/null || echo "rabbitmq was not running"
-docker run -d --name rabbitmq \
-    --network host \
-    -v "${PWD}"/rabbitmq-configuration:/etc/rabbitmq \
-    --env RABBITMQ_CONFIG_FILE=/etc/rabbitmq/rabbit@localhost.config \
-    --env RABBITMQ_NODENAME=rabbit@$(hostname) \
-    --env RABBITMQ_NODE_PORT=5672 \
-    --env RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="-setcookie do-not-do-this-in-production" \
-    "${RABBITMQ_IMAGE}"
-
-# for CLI commands to share the same cookie
-docker exec rabbitmq bash -c "echo 'do-not-do-this-in-production' > /var/lib/rabbitmq/.erlang.cookie"
-docker exec rabbitmq chmod 0600 /var/lib/rabbitmq/.erlang.cookie
-
-wait_for_message rabbitmq "completed with"
-
-docker run -d --name hare \
-    --network host \
-    -v "${PWD}"/rabbitmq-configuration:/etc/rabbitmq \
-    --env RABBITMQ_CONFIG_FILE=/etc/rabbitmq/hare@localhost.config \
-    --env RABBITMQ_NODENAME=hare@$(hostname) \
-    --env RABBITMQ_NODE_PORT=5673 \
-    --env RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="-setcookie do-not-do-this-in-production" \
-    "${RABBITMQ_IMAGE}"
-
-# for CLI commands to share the same cookie
-docker exec hare bash -c "echo 'do-not-do-this-in-production' > /var/lib/rabbitmq/.erlang.cookie"
-docker exec hare chmod 0600 /var/lib/rabbitmq/.erlang.cookie
-
-wait_for_message hare "completed with"
+make -C "${PWD}"/tls-gen/basic
 
-docker exec hare rabbitmqctl --node hare@$(hostname) status
+rm -rf rabbitmq-configuration
+mkdir -p rabbitmq-configuration/tls
+cp -R "${PWD}"/tls-gen/basic/result/* rabbitmq-configuration/tls
+mv rabbitmq-configuration/tls/server_$(hostname)_certificate.pem rabbitmq-configuration/tls/server_certificate.pem
+mv rabbitmq-configuration/tls/server_$(hostname)_key.pem rabbitmq-configuration/tls/server_key.pem
+chmod o+r rabbitmq-configuration/tls/*
+chmod g+r rabbitmq-configuration/tls/*
 
-docker exec rabbitmq rabbitmq-diagnostics --node rabbit@$(hostname) is_running
-docker exec hare rabbitmq-diagnostics --node hare@$(hostname) is_running
+docker compose --file ci/cluster/docker-compose.yml down
+docker compose --file ci/cluster/docker-compose.yml up --detach
 
-docker exec hare rabbitmqctl --node hare@$(hostname) stop_app
-docker exec hare rabbitmqctl --node hare@$(hostname) join_cluster rabbit@$(hostname)
-docker exec hare rabbitmqctl --node hare@$(hostname) start_app
+wait_for_message rabbitmq0 "completed with"
 
-sleep 10
+docker exec rabbitmq0 rabbitmqctl await_online_nodes 3
 
-docker exec hare rabbitmqctl --node hare@$(hostname) await_startup
+docker exec rabbitmq0 rabbitmqctl enable_feature_flag --opt-in khepri_db
+docker exec rabbitmq1 rabbitmqctl enable_feature_flag --opt-in khepri_db
+docker exec rabbitmq2 rabbitmqctl enable_feature_flag --opt-in khepri_db
 
-docker exec hare rabbitmqctl --node hare@$(hostname) enable_feature_flag --opt-in khepri_db
-docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) enable_feature_flag --opt-in khepri_db
+docker exec rabbitmq0 rabbitmqctl cluster_status
 
-docker exec rabbitmq rabbitmq-diagnostics --node rabbit@$(hostname) erlang_version
-docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) version
-docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) status
-docker exec rabbitmq rabbitmqctl --node rabbit@$(hostname) cluster_status
+docker compose --file ci/cluster/docker-compose.yml ps
diff --git a/pom.xml b/pom.xml
index 2b131fcf65..ada6a2309c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,7 +78,6 @@
     <maven.source.plugin.version>3.3.1</maven.source.plugin.version>
     <groovy.maven.plugin.version>2.1.1</groovy.maven.plugin.version>
     <groovy.all.version>2.4.21</groovy.all.version>
-    <keytool.maven.plugin.version>1.7</keytool.maven.plugin.version>
     <build.helper.maven-plugin.version>3.6.0</build.helper.maven-plugin.version>
     <maven.compiler.plugin.version>3.14.0</maven.compiler.plugin.version>
     <maven.surefire.plugin.version>3.5.2</maven.surefire.plugin.version>
@@ -117,16 +116,10 @@
     <rabbitmq.dir>${deps.dir}/rabbit</rabbitmq.dir>
     <rabbitmqctl.bin>${rabbitmq.dir}/scripts/rabbitmqctl</rabbitmqctl.bin>
 
-    <test-keystore.ca>${project.build.directory}/ca.keystore</test-keystore.ca>
-    <test-keystore.empty>${project.build.directory}/empty.keystore</test-keystore.empty>
-    <test-keystore.password>bunnies</test-keystore.password>
-
     <test-broker.A.nodename>rabbit@localhost</test-broker.A.nodename>
     <test-broker.A.node_port>5672</test-broker.A.node_port>
-    <test-broker.A.config_file>${project.build.directory}/test-classes/${test-broker.A.nodename}</test-broker.A.config_file>
-    <test-broker.B.nodename>hare@localhost</test-broker.B.nodename>
+    <test-broker.B.nodename>rabbit@node1</test-broker.B.nodename>
     <test-broker.B.node_port>5673</test-broker.B.node_port>
-    <test-broker.B.config_file>${project.build.directory}/test-classes/${test-broker.B.nodename}</test-broker.B.config_file>
 
     <!-- to sign artifacts when releasing -->
     <gpg.keyname>6026DFCA</gpg.keyname>
@@ -185,35 +178,6 @@
       </properties>
     </profile>
 
-    <profile>
-      <!--
-      If the caller decided to provide an external RabbitMQ
-      broker/cluster, he can specify the path to his test TLS
-      certificates with the ${test-tls-certs.dir} property.
-
-      Thus, if the CA certificate exists, we also enable the generation
-      of the two Java keystores.
-      -->
-      <id>use-provided-test-keystores</id>
-      <activation>
-        <file>
-          <exists>${test-tls-certs.dir}/testca/cacert.pem</exists>
-        </file>
-      </activation>
-      <build>
-        <plugins>
-          <plugin>
-            <groupId>org.codehaus.mojo</groupId>
-            <artifactId>keytool-maven-plugin</artifactId>
-            <version>${keytool.maven.plugin.version}</version>
-            <configuration>
-              <skip>false</skip>
-            </configuration>
-          </plugin>
-        </plugins>
-      </build>
-    </profile>
-
     <profile>
       <!--
       Tests are integration tests, not unit tests, because they depend
@@ -245,18 +209,10 @@
                 <rabbitmq.dir>${rabbitmq.dir}</rabbitmq.dir>
                 <rabbitmqctl.bin>${rabbitmqctl.bin}</rabbitmqctl.bin>
 
-                <test-keystore.ca>${test-keystore.ca}</test-keystore.ca>
-                <test-keystore.empty>${test-keystore.empty}</test-keystore.empty>
-                <test-keystore.password>${test-keystore.password}</test-keystore.password>
-                <test-client-cert.path>${test-tls-certs.dir}/client/keycert.p12</test-client-cert.path>
-                <test-client-cert.password>changeme</test-client-cert.password>
-
                 <test-broker.A.nodename>${test-broker.A.nodename}</test-broker.A.nodename>
                 <test-broker.A.node_port>${test-broker.A.node_port}</test-broker.A.node_port>
-                <test-broker.A.config_file>${test-broker.A.config_file}</test-broker.A.config_file>
                 <test-broker.B.nodename>${test-broker.B.nodename}</test-broker.B.nodename>
                 <test-broker.B.node_port>${test-broker.B.node_port}</test-broker.B.node_port>
-                <test-broker.B.config_file>${test-broker.B.config_file}</test-broker.B.config_file>
               </systemPropertyVariables>
               <environmentVariables>
                 <DEPS_DIR>${deps.dir}</DEPS_DIR>
@@ -773,24 +729,6 @@
               </source>
             </configuration>
           </execution>
-
-          <!--
-          We always remove the generated Java keystores because
-          keytool(1) complains if the destination file already exists
-          with the content we want to import.
-          -->
-          <execution>
-            <phase>generate-test-resources</phase>
-            <id>remove-old-test-keystores</id>
-            <goals>
-              <goal>execute</goal>
-            </goals>
-            <configuration>
-              <source>
-                ${groovy-scripts.dir}/remove_old_test_keystores.groovy
-              </source>
-            </configuration>
-          </execution>
         </executions>
       </plugin>
 
@@ -840,47 +778,6 @@
         </configuration>
       </plugin>
 
-      <!-- Generate two Java keystores for the SSLTests testsuite. -->
-      <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>keytool-maven-plugin</artifactId>
-        <version>${keytool.maven.plugin.version}</version>
-        <configuration>
-          <skip>true</skip>
-        </configuration>
-        <executions>
-          <execution>
-            <id>generate-test-ca-keystore</id>
-            <phase>generate-test-resources</phase>
-            <goals>
-              <goal>importCertificate</goal>
-            </goals>
-            <configuration>
-              <file>${test-tls-certs.dir}/testca/cacert.pem</file>
-              <keystore>${test-keystore.ca}</keystore>
-              <storepass>${test-keystore.password}</storepass>
-              <noprompt>true</noprompt>
-              <alias>server1</alias>
-            </configuration>
-          </execution>
-          <execution>
-            <id>generate-test-empty-keystore</id>
-            <phase>generate-test-resources</phase>
-            <goals>
-              <goal>importCertificate</goal>
-              <goal>deleteAlias</goal>
-            </goals>
-            <configuration>
-              <file>${test-tls-certs.dir}/testca/cacert.pem</file>
-              <keystore>${test-keystore.empty}</keystore>
-              <storepass>${test-keystore.password}</storepass>
-              <noprompt>true</noprompt>
-              <alias>server1</alias>
-            </configuration>
-          </execution>
-        </executions>
-      </plugin>
-
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-jar-plugin</artifactId>
diff --git a/src/main/scripts/query_test_tls_certs_dir.groovy b/src/main/scripts/query_test_tls_certs_dir.groovy
deleted file mode 100644
index 2c86bb8c10..0000000000
--- a/src/main/scripts/query_test_tls_certs_dir.groovy
+++ /dev/null
@@ -1,25 +0,0 @@
-String[] command = [
-  properties['make.bin'],
-  '-C', properties['rabbitmq.dir'],
-  '--no-print-directory',
-  'show-test-tls-certs-dir',
-  "DEPS_DIR=${properties['deps.dir']}",
-]
-
-def pb = new ProcessBuilder(command)
-pb.redirectErrorStream(true)
-
-def process = pb.start()
-
-// We are only interested in the last line of output. Previous lines, if
-// any, are related to the generation of the test certificates.
-def whole_output = ""
-process.inputStream.eachLine {
-  whole_output += it
-  project.properties['test-tls-certs.dir'] = it.trim()
-}
-process.waitFor()
-if (process.exitValue() != 0) {
-  println(whole_output.trim())
-  fail("Failed to query test TLS certs directory with command: ${command.join(' ')}")
-}
diff --git a/src/main/scripts/remove_old_test_keystores.groovy b/src/main/scripts/remove_old_test_keystores.groovy
deleted file mode 100644
index e08775e4e0..0000000000
--- a/src/main/scripts/remove_old_test_keystores.groovy
+++ /dev/null
@@ -1,8 +0,0 @@
-def dir = new File(project.build.directory)
-
-// This pattern starts with `.*`. This is normally useless and even
-// inefficient but the matching doesn't work without it...
-def pattern = ~/.*\.keystore$/
-dir.eachFileMatch(pattern) { file ->
-  file.delete()
-}
diff --git a/src/test/java/com/rabbitmq/client/AmqpClientTestExtension.java b/src/test/java/com/rabbitmq/client/AmqpClientTestExtension.java
index 58abd3efeb..dcffa744b2 100644
--- a/src/test/java/com/rabbitmq/client/AmqpClientTestExtension.java
+++ b/src/test/java/com/rabbitmq/client/AmqpClientTestExtension.java
@@ -1,4 +1,5 @@
-// Copyright (c) 2023-2025 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
+// Copyright (c) 2023-2025 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom
+// Inc. and/or its subsidiaries.
 //
 // This software, the RabbitMQ Java client library, is triple-licensed under the
 // Mozilla Public License 2.0 ("MPL"), the GNU General Public License version 2
@@ -24,9 +25,7 @@
 import com.rabbitmq.client.test.server.ServerTestSuite;
 import com.rabbitmq.client.test.ssl.SslTestSuite;
 import com.rabbitmq.tools.Host;
-import java.io.File;
 import java.net.Socket;
-import java.util.Properties;
 import org.junit.jupiter.api.extension.AfterEachCallback;
 import org.junit.jupiter.api.extension.BeforeAllCallback;
 import org.junit.jupiter.api.extension.BeforeEachCallback;
@@ -36,31 +35,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-public class AmqpClientTestExtension implements ExecutionCondition, BeforeAllCallback,
-    BeforeEachCallback,
-    AfterEachCallback {
+public class AmqpClientTestExtension
+    implements ExecutionCondition, BeforeAllCallback, BeforeEachCallback, AfterEachCallback {
 
   private static final Logger LOGGER = LoggerFactory.getLogger(AmqpClientTestExtension.class);
 
-  static {
-    Properties TESTS_PROPS = new Properties(System.getProperties());
-    String make = System.getenv("MAKE");
-    if (make != null) {
-      TESTS_PROPS.setProperty("make.bin", make);
-    }
-    try {
-      TESTS_PROPS.load(Host.class.getClassLoader().getResourceAsStream("config.properties"));
-    } catch (Exception e) {
-      System.out.println(
-          "\"build.properties\" or \"config.properties\" not found" +
-              " in classpath. Please copy \"build.properties\" and" +
-              " \"config.properties\" into src/test/resources. Ignore" +
-              " this message if running with ant.");
-    } finally {
-      System.setProperties(TESTS_PROPS);
-    }
-  }
-
   private static boolean isFunctionalSuite(ExtensionContext context) {
     return isTestSuite(context, FunctionalTestSuite.class);
   }
@@ -86,8 +65,7 @@ public static boolean requiredProperties() {
     String rabbitmqctl = Host.rabbitmqctlCommand();
     if (rabbitmqctl == null) {
       System.err.println(
-          "rabbitmqctl required; please set \"rabbitmqctl.bin\" system" +
-              " property");
+          "rabbitmqctl required; please set \"rabbitmqctl.bin\" system" + " property");
       return false;
     }
 
@@ -95,20 +73,7 @@ public static boolean requiredProperties() {
   }
 
   public static boolean isSSLAvailable() {
-    String sslClientCertsDir = System.getProperty("test-client-cert.path");
-    String hostname = System.getProperty("broker.hostname");
-    String port = System.getProperty("broker.sslport");
-    if (sslClientCertsDir == null || hostname == null || port == null) {
-      return false;
-    }
-
-    // If certificate is present and some server is listening on port 5671
-    if (new File(sslClientCertsDir).exists() &&
-        checkServerListening(hostname, Integer.parseInt(port))) {
-      return true;
-    } else {
-      return false;
-    }
+    return checkServerListening("localhost", 5671);
   }
 
   private static boolean checkServerListening(String host, int port) {
@@ -132,40 +97,42 @@ private static boolean checkServerListening(String host, int port) {
   public ConditionEvaluationResult evaluateExecutionCondition(ExtensionContext context) {
     // HA test suite must be checked first because it contains other test suites
     if (isHaSuite(context)) {
-      return requiredProperties() ? enabled("Required properties available")
+      return requiredProperties()
+          ? enabled("Required properties available")
           : disabled("Required properties not available");
     } else if (isServerSuite(context)) {
-      return requiredProperties() ? enabled("Required properties available")
+      return requiredProperties()
+          ? enabled("Required properties available")
           : disabled("Required properties not available");
     } else if (isFunctionalSuite(context)) {
-      return requiredProperties() ? enabled("Required properties available")
+      return requiredProperties()
+          ? enabled("Required properties available")
           : disabled("Required properties not available");
     } else if (isSslSuite(context)) {
-      return requiredProperties() && isSSLAvailable() ? enabled(
-          "Required properties and TLS available")
+      return requiredProperties() && isSSLAvailable()
+          ? enabled("Required properties and TLS available")
           : disabled("Required properties or TLS not available");
     }
     return enabled("ok");
   }
 
   @Override
-  public void beforeAll(ExtensionContext context) {
-
-  }
+  public void beforeAll(ExtensionContext context) {}
 
   @Override
   public void beforeEach(ExtensionContext context) {
     LOGGER.info(
         "Starting test: {}.{} (nio? {})",
-        context.getTestClass().get().getSimpleName(), context.getTestMethod().get().getName(),
-        TestUtils.USE_NIO
-    );
+        context.getTestClass().get().getSimpleName(),
+        context.getTestMethod().get().getName(),
+        TestUtils.USE_NIO);
   }
 
   @Override
   public void afterEach(ExtensionContext context) {
-    LOGGER.info("Test finished: {}.{}",
-        context.getTestClass().get().getSimpleName(), context.getTestMethod().get().getName());
+    LOGGER.info(
+        "Test finished: {}.{}",
+        context.getTestClass().get().getSimpleName(),
+        context.getTestMethod().get().getName());
   }
-
 }
diff --git a/src/test/java/com/rabbitmq/client/test/functional/ConnectionRecovery.java b/src/test/java/com/rabbitmq/client/test/functional/ConnectionRecovery.java
index b54507d5df..4257c5a7b3 100644
--- a/src/test/java/com/rabbitmq/client/test/functional/ConnectionRecovery.java
+++ b/src/test/java/com/rabbitmq/client/test/functional/ConnectionRecovery.java
@@ -23,7 +23,6 @@
 import com.rabbitmq.client.test.BrokerTestCase;
 import com.rabbitmq.client.test.TestUtils;
 import com.rabbitmq.tools.Host;
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 
 import java.io.IOException;
@@ -368,7 +367,6 @@ private void testClientNamedQueueRecoveryWith(String q, boolean noWait) throws I
     }
 
     // bug 26552
-    @Disabled
     @Test public void clientNamedTransientAutoDeleteQueueAndBindingRecovery() throws IOException, InterruptedException, TimeoutException {
         String q   = UUID.randomUUID().toString();
         String x   = "tmp-fanout";
diff --git a/src/test/java/com/rabbitmq/client/test/functional/DurableOnTransient.java b/src/test/java/com/rabbitmq/client/test/functional/DurableOnTransient.java
index f3dec6d0fe..08508a71f3 100644
--- a/src/test/java/com/rabbitmq/client/test/functional/DurableOnTransient.java
+++ b/src/test/java/com/rabbitmq/client/test/functional/DurableOnTransient.java
@@ -20,7 +20,6 @@
 
 import java.io.IOException;
 
-import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.Test;
 
 import com.rabbitmq.client.GetResponse;
@@ -68,7 +67,6 @@ protected void releaseResources() throws IOException {
         assertNotNull(basicGet());
     }
 
-    @Disabled("Does not apply with Khepri (update datastore while second node is down)")
     @Test public void semiDurableBindingRemoval() throws IOException {
         if (clusteredConnection != null) {
             deleteExchange("x");
@@ -78,18 +76,25 @@ protected void releaseResources() throws IOException {
             channel.queueBind("q", "x", "k");
 
             stopSecondary();
+            boolean restarted = false;
+            try {
+                deleteExchange("x");
 
-            deleteExchange("x");
-
-            startSecondary();
+                startSecondary();
+                restarted = true;
 
-            declareTransientTopicExchange("x");
+                declareTransientTopicExchange("x");
 
-            basicPublishVolatile("x", "k");
-            assertDelivered("q", 0);
+                basicPublishVolatile("x", "k");
+                assertDelivered("q", 0);
 
-            deleteQueue("q");
-            deleteExchange("x");
+                deleteQueue("q");
+                deleteExchange("x");
+            } finally {
+                if (!restarted) {
+                    startSecondary();
+                }
+            }
         }
     }
 }
diff --git a/src/test/java/com/rabbitmq/client/test/server/LoopbackUsers.java b/src/test/java/com/rabbitmq/client/test/server/LoopbackUsers.java
index b97162c4c7..e81de3703e 100644
--- a/src/test/java/com/rabbitmq/client/test/server/LoopbackUsers.java
+++ b/src/test/java/com/rabbitmq/client/test/server/LoopbackUsers.java
@@ -48,14 +48,26 @@ public class LoopbackUsers {
     @Test public void loopback() throws IOException, TimeoutException {
 	      if (!Host.isOnDocker()) {
             String addr = findRealIPAddress().getHostAddress();
-            assertGuestFail(addr);
-            Host.rabbitmqctl("eval 'application:set_env(rabbit, loopback_users, []).'");
-            assertGuestSucceed(addr);
-            Host.rabbitmqctl("eval 'application:set_env(rabbit, loopback_users, [<<\"guest\">>]).'");
-            assertGuestFail(addr);
+            String initialValue = getLoopbackUsers();
+            try {
+                setLoopbackUsers("[]");
+                assertGuestSucceed(addr);
+                setLoopbackUsers("[<<\"guest\">>]");
+                assertGuestFail(addr);
+            } finally {
+                setLoopbackUsers(initialValue);
+            }
         }
     }
 
+    private static String getLoopbackUsers() throws IOException {
+        return Host.rabbitmqctl("eval '{ok, V} = application:get_env(rabbit, loopback_users), V.'").output();
+    }
+
+    private static void setLoopbackUsers(String value) throws IOException {
+        Host.rabbitmqctl(String.format("eval 'application:set_env(rabbit, loopback_users, %s).'", value));
+    }
+
     private void assertGuestSucceed(String addr) throws IOException, TimeoutException {
         succeedConnect("guest", addr);
         succeedConnect("guest", "localhost");
diff --git a/src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java b/src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java
index 9fe5004107..f85829c119 100644
--- a/src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java
+++ b/src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java
@@ -1,4 +1,5 @@
-// Copyright (c) 2007-2025 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
+// Copyright (c) 2007-2025 Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom
+// Inc. and/or its subsidiaries.
 //
 // This software, the RabbitMQ Java client library, is triple-licensed under the
 // Mozilla Public License 2.0 ("MPL"), the GNU General Public License version 2
@@ -15,82 +16,38 @@
 
 package com.rabbitmq.client.test.ssl;
 
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-
+import com.rabbitmq.tools.Host;
 import java.io.FileInputStream;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
 import java.security.KeyStore;
 import java.security.NoSuchAlgorithmException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.stream.Collectors;
-import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManagerFactory;
 
 class TlsTestUtils {
 
+  static final String[] PROTOCOLS = new String[] {"TLSv1.3", "TLSv1.2"};
+
   private TlsTestUtils() {}
 
   static SSLContext badVerifiedSslContext() throws Exception {
-    return verifiedSslContext(() -> getSSLContext(), emptyKeystoreCa());
+    return sslContext(trustManagerFactory(clientCertificate()));
   }
 
   static SSLContext verifiedSslContext() throws Exception {
-    return verifiedSslContext(() -> getSSLContext(), keystoreCa());
-  }
-
-  static SSLContext verifiedSslContext(CallableSupplier<SSLContext> sslContextSupplier) throws Exception {
-    return verifiedSslContext(sslContextSupplier, keystoreCa());
-  }
-
-  static SSLContext verifiedSslContext(CallableSupplier<SSLContext> sslContextSupplier, String keystorePath) throws Exception {
-    // for local testing, run ./mvnw test-compile -Dtest-tls-certs.dir=/tmp/tls-gen/basic
-    // (generates the Java keystores)
-    assertNotNull(keystorePath);
-    String keystorePasswd = keystorePassword();
-    assertNotNull(keystorePasswd);
-    char [] keystorePassword = keystorePasswd.toCharArray();
-
-    KeyStore tks = KeyStore.getInstance("JKS");
-    tks.load(new FileInputStream(keystorePath), keystorePassword);
-
-    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
-    tmf.init(tks);
-
-    String p12Path = clientCertPath();
-    assertNotNull(p12Path);
-    String p12Passwd = clientCertPassword();
-    assertNotNull(p12Passwd);
-    KeyStore ks = KeyStore.getInstance("PKCS12");
-    char [] p12Password = p12Passwd.toCharArray();
-    ks.load(new FileInputStream(p12Path), p12Password);
-
-    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
-    kmf.init(ks, p12Password);
-
-    SSLContext c = sslContextSupplier.get();
-    c.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
-    return c;
+    return sslContext(trustManagerFactory(caCertificate()));
   }
 
-  static String keystoreCa() {
-    return System.getProperty("test-keystore.ca", "./target/ca.keystore");
-  }
-
-  static String emptyKeystoreCa() {
-    return System.getProperty("test-keystore.empty", "./target/empty.keystore");
-  }
-
-  static String keystorePassword() {
-    return System.getProperty("test-keystore.password", "bunnies");
-  }
-
-  static String clientCertPath() {
-    return System.getProperty("test-client-cert.path", "/tmp/tls-gen/basic/client/keycert.p12");
-  }
-
-  static String clientCertPassword() {
-    return System.getProperty("test-client-cert.password", "");
+  static SSLContext verifiedSslContext(CallableSupplier<SSLContext> sslContextSupplier)
+      throws Exception {
+    return sslContext(sslContextSupplier, trustManagerFactory(caCertificate()));
   }
 
   public static SSLContext getSSLContext() throws NoSuchAlgorithmException {
@@ -112,15 +69,78 @@ public static SSLContext getSSLContext() throws NoSuchAlgorithmException {
   static Collection<String> availableTlsProtocols() {
     try {
       String[] protocols = SSLContext.getDefault().getSupportedSSLParameters().getProtocols();
-      return Arrays.stream(protocols).filter(p -> p.toLowerCase().startsWith("tls")).collect(
-          Collectors.toList());
+      return Arrays.stream(protocols)
+          .filter(p -> p.toLowerCase().startsWith("tls"))
+          .collect(Collectors.toList());
     } catch (NoSuchAlgorithmException e) {
       throw new RuntimeException(e);
     }
   }
 
+  static SSLContext sslContext(TrustManagerFactory trustManagerFactory) throws Exception {
+    return sslContext(() -> SSLContext.getInstance(PROTOCOLS[0]), trustManagerFactory);
+  }
+
+  static SSLContext sslContext(
+      CallableSupplier<SSLContext> sslContextSupplier, TrustManagerFactory trustManagerFactory)
+      throws Exception {
+    SSLContext sslContext = sslContextSupplier.get();
+    sslContext.init(
+        null, trustManagerFactory == null ? null : trustManagerFactory.getTrustManagers(), null);
+    return sslContext;
+  }
+
+  static TrustManagerFactory trustManagerFactory(Certificate certificate) throws Exception {
+    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+    keyStore.load(null, null);
+    keyStore.setCertificateEntry("some-certificate", certificate);
+    TrustManagerFactory trustManagerFactory =
+        TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+    trustManagerFactory.init(keyStore);
+    return trustManagerFactory;
+  }
+
+  static X509Certificate caCertificate() throws Exception {
+    return loadCertificate(caCertificateFile());
+  }
+
+  static String caCertificateFile() {
+    return tlsArtefactPath(
+        System.getProperty("ca.certificate", "./rabbitmq-configuration/tls/ca_certificate.pem"));
+  }
+
+  static X509Certificate clientCertificate() throws Exception {
+    return loadCertificate(clientCertificateFile());
+  }
+
+  static String clientCertificateFile() {
+    return tlsArtefactPath(
+        System.getProperty(
+            "client.certificate",
+            "./rabbitmq-configuration/tls/client_" + hostname() + "_certificate.pem"));
+  }
+
+  static X509Certificate loadCertificate(String file) throws Exception {
+    try (FileInputStream inputStream = new FileInputStream(file)) {
+      CertificateFactory fact = CertificateFactory.getInstance("X.509");
+      return (X509Certificate) fact.generateCertificate(inputStream);
+    }
+  }
+
+  private static String tlsArtefactPath(String in) {
+    return in.replace("$(hostname)", hostname()).replace("$(hostname -s)", hostname());
+  }
+
+  private static String hostname() {
+    try {
+      return InetAddress.getLocalHost().getHostName();
+    } catch (UnknownHostException e) {
+      return Host.hostname();
+    }
+  }
+
   @FunctionalInterface
-  interface CallableSupplier <T> {
+  interface CallableSupplier<T> {
 
     T get() throws Exception;
   }
diff --git a/src/test/java/com/rabbitmq/tools/Host.java b/src/test/java/com/rabbitmq/tools/Host.java
index 11c9f0355a..9adf1fc7fc 100644
--- a/src/test/java/com/rabbitmq/tools/Host.java
+++ b/src/test/java/com/rabbitmq/tools/Host.java
@@ -42,6 +42,14 @@ public class Host {
     private static final String DOCKER_PREFIX = "DOCKER:";
     private static final Pattern CONNECTION_NAME_PATTERN = Pattern.compile("\"connection_name\",\"(?<name>[a-zA-Z0-9\\-]+)?\"");
 
+    public static String hostname() {
+      try {
+        return executeCommand("hostname").output();
+      } catch (IOException e) {
+        throw new RuntimeException(e);
+      }
+    }
+
     public static String capture(InputStream is)
         throws IOException
     {
@@ -72,7 +80,7 @@ public static ProcessState executeCommand(String command) throws IOException
         return new ProcessState(pr, inputState, errorState);
     }
 
-    static class ProcessState {
+    public static class ProcessState {
 
         private final Process process;
         private final InputStreamPumpState inputState;
@@ -85,7 +93,7 @@ static class ProcessState {
             this.errorState = errorState;
         }
 
-        private String output() {
+        public String output() {
             return inputState.buffer.toString();
         }
 
@@ -189,17 +197,6 @@ public static void clearResourceAlarm(String source) throws IOException {
         rabbitmqctl("eval 'rabbit_alarm:clear_alarm({resource_limit, " + source + ", node()}).'");
     }
 
-    public static ProcessState invokeMakeTarget(String command) throws IOException {
-        File rabbitmqctl = new File(rabbitmqctlCommand());
-        return executeCommand(makeCommand() +
-                              " -C \'" + rabbitmqDir() + "\'" +
-                              " RABBITMQCTL=\'" + rabbitmqctl.getAbsolutePath() + "\'" +
-                              " RABBITMQ_NODENAME=\'" + nodenameA() + "\'" +
-                              " RABBITMQ_NODE_PORT=" + node_portA() +
-                              " RABBITMQ_CONFIG_FILE=\'" + config_fileA() + "\'" +
-                              " " + command);
-    }
-
     public static void startRabbitOnNode() throws IOException {
         rabbitmqctl("start_app");
         tryConnectFor(10_000);
@@ -210,7 +207,7 @@ public static void stopRabbitOnNode() throws IOException {
     }
 
     public static void tryConnectFor(int timeoutInMs) throws IOException {
-        tryConnectFor(timeoutInMs, node_portA() == null ? 5672 : Integer.valueOf(node_portA()));
+        tryConnectFor(timeoutInMs, 5672);
     }
 
     public static void tryConnectFor(int timeoutInMs, int port) throws IOException {
@@ -245,15 +242,6 @@ public static String nodenameA()
         return System.getProperty("test-broker.A.nodename");
     }
 
-    public static String node_portA()
-    {
-        return System.getProperty("test-broker.A.node_port");
-    }
-
-    public static String config_fileA()
-    {
-        return System.getProperty("test-broker.A.config_file");
-    }
 
     public static String nodenameB()
     {
@@ -265,11 +253,6 @@ public static String node_portB()
         return System.getProperty("test-broker.B.node_port");
     }
 
-    public static String config_fileB()
-    {
-        return System.getProperty("test-broker.B.config_file");
-    }
-
     public static String rabbitmqctlCommand() {
         String rabbitmqCtl = System.getProperty("rabbitmqctl.bin");
         if (rabbitmqCtl == null) {
@@ -291,11 +274,6 @@ public static boolean isOnDocker() {
         return rabbitmqCtl.startsWith(DOCKER_PREFIX);
     }
 
-    public static String rabbitmqDir()
-    {
-        return System.getProperty("rabbitmq.dir");
-    }
-
     public static void closeConnection(String pid) throws IOException {
         rabbitmqctl("close_connection '" + pid + "' 'Closed via rabbitmqctl'");
     }
diff --git a/src/test/resources/config.properties b/src/test/resources/config.properties
deleted file mode 100644
index 6562e2f80e..0000000000
--- a/src/test/resources/config.properties
+++ /dev/null
@@ -1,3 +0,0 @@
-broker.hostname=localhost
-broker.port=5672
-broker.sslport=5671
diff --git a/src/test/resources/hare@localhost.config b/src/test/resources/hare@localhost.config
deleted file mode 100644
index 41667a9c70..0000000000
--- a/src/test/resources/hare@localhost.config
+++ /dev/null
@@ -1,15 +0,0 @@
-% vim:ft=erlang:
-
-[
-  {rabbit, [
-      {ssl_listeners, [5670]},
-      {ssl_options, [
-          {cacertfile, "${test-tls-certs.dir}/testca/cacert.pem"},
-          {certfile,   "${test-tls-certs.dir}/server/cert.pem"},
-          {keyfile,    "${test-tls-certs.dir}/server/key.pem"},
-          {verify, verify_peer},
-          {fail_if_no_peer_cert, false},
-          {honor_cipher_order, true}]},
-      {auth_mechanisms, ['PLAIN', 'ANONYMOUS', 'AMQPLAIN', 'EXTERNAL', 'RABBIT-CR-DEMO']}
-    ]}
-].
diff --git a/src/test/resources/log4j2-test.properties b/src/test/resources/log4j2-test.properties
deleted file mode 100644
index b7e0a68699..0000000000
--- a/src/test/resources/log4j2-test.properties
+++ /dev/null
@@ -1,12 +0,0 @@
-status = error
-dest = err
-name = PropertiesConfig
-
-appender.console.type = Console
-appender.console.name = STDOUT
-appender.console.layout.type = PatternLayout
-appender.console.layout.pattern = %m%n
-
-logger.com.rabbitmq.level = info
-rootLogger.level = error
-rootLogger.appenderRef.stdout.ref = STDOUT
\ No newline at end of file
diff --git a/src/test/resources/rabbit@localhost.config b/src/test/resources/rabbit@localhost.config
deleted file mode 100644
index 9e3b77c94d..0000000000
--- a/src/test/resources/rabbit@localhost.config
+++ /dev/null
@@ -1,15 +0,0 @@
-% vim:ft=erlang:
-
-[
-  {rabbit, [
-      {ssl_listeners, [5671]},
-      {ssl_options, [
-          {cacertfile, "${test-tls-certs.dir}/testca/cacert.pem"},
-          {certfile,   "${test-tls-certs.dir}/server/cert.pem"},
-          {keyfile,    "${test-tls-certs.dir}/server/key.pem"},
-          {verify, verify_peer},
-          {fail_if_no_peer_cert, false},
-          {honor_cipher_order, true}]},
-      {auth_mechanisms, ['PLAIN', 'ANONYMOUS', 'AMQPLAIN', 'EXTERNAL', 'RABBIT-CR-DEMO']}
-    ]}
-].