         let listenerAuth = ListenerCertificateAuthenticator.init(rootCerts: [rootCert])
         let listener = try listen(tls: true, auth: listenerAuth)
         
+        // Replicator:
+        let auth = ClientCertificateAuthenticator.init(identity: try tlsIdentity(false)!)
+        let serverCert = listener.tlsIdentity!.certs[0]
+        
+        self.ignoreException {
+            self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false,
+                     auth: auth, serverCert: serverCert, expectedError: CBLErrorTLSClientCertRejected)
+        }
+        
         // Cleanup:
-        try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
-        
-        // Create client identity:
-        let clientCertData = try dataFromResource(name: "identity/client", ofType: "p12")
-        let identity = try TLSIdentity.importIdentity(withData: clientCertData, password: "123", label: clientCertLabel)
-        
-        // Replicator:
-        let auth = ClientCertificateAuthenticator.init(identity: identity)
-        let serverCert = listener.tlsIdentity!.certs[0]
-        
-        self.ignoreException {
-            self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth, serverCert: serverCert)
-        }
-        
-        // Cleanup:
-        try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
-        try stopListen()
-    }
-    
-    func testClientCertAuthWithRootCertsError() throws {
-        if !self.keyChainAccessAllowed { return }
-        
-        // Root Cert:
-        let rootCertData = try dataFromResource(name: "identity/client-ca", ofType: "der")
-        let rootCert = SecCertificateCreateWithData(kCFAllocatorDefault, rootCertData as CFData)!
-        
-        // Listener:
-        let listenerAuth = ListenerCertificateAuthenticator.init(rootCerts: [rootCert])
-        let listener = try listen(tls: true, auth: listenerAuth)
-        
-        // Cleanup:
-        try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
-        
-        // Create client identity:
-        let attrs = [certAttrCommonName: "daniel"]
-        let identity = try TLSIdentity.createIdentity(forServer: false, attributes: attrs, expiration: nil, label: clientCertLabel)
-        
-        // Replicator:
-        let auth = ClientCertificateAuthenticator.init(identity: identity)
-        let serverCert = listener.tlsIdentity!.certs[0]
-        
-        self.ignoreException {
-            self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth, serverCert: serverCert, expectedError: CBLErrorTLSClientCertRejected)
-        }
-        
-        // Cleanup:
-        try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
+        try cleanupTLSIdentity(false)
         try stopListen()
     }
     

        XCTAssertNotNil(listener.tlsIdentity)
        XCTAssertEqual(listener.tlsIdentity!.certs.count, 1)
        
        // Cleanup:
        try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
        
        // Create client identity:
        let attrs = [certAttrCommonName: "daniel"]
        let identity = try TLSIdentity.createIdentity(forServer: false, attributes: attrs, expiration: nil, label: clientCertLabel)
        
        // Replicator:
        let auth = ClientCertificateAuthenticator.init(identity: identity)
        let serverCert = listener.tlsIdentity!.certs[0]
        self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth, serverCert: serverCert, expectedError: CBLErrorTLSClientCertRejected)
        
        // Cleanup:
        try TLSIdentity.deleteIdentity(withLabel: clientCertLabel)
        try stopListen()
    }
    
    func testClientCertAuthWithRootCerts() throws {
        if !self.keyChainAccessAllowed { return }
        
        // Root Cert:

        XCTAssert(identity === listener.tlsIdentity!)
        try stopListener(listener: listener)
        XCTAssertNil(listener.tlsIdentity)
        try cleanupTLSIdentity(true) // cleanup the server tlsIdentity
    }
    
    func testNonTLSNullListenerAuthenticator() throws {
        let listener = try listen(tls: false)
        
        // Replicator - No Authenticator:
        self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false)
        
        // Replicator - Basic Authenticator:
        let auth = BasicAuthenticator.init(username: "daniel", password: "123")
        self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: auth)
        
        // Replicator - Client Cert Authenticator
        let certAuth = ClientCertificateAuthenticator(identity: try tlsIdentity(false)!)
        self.run(target: listener.localURLEndpoint, type: .pushAndPull, continuous: false, auth: certAuth)
        try cleanupTLSIdentity(false) // cleanup client cert auth identity
        
        // Cleanup:
        try stopListen()
    }
       
    func testNonTLSPasswordListenerAuthenticator() throws {
        // Listener:
        let listenerAuth = ListenerPasswordAuthenticator.init {
            (username, password) -> Bool in
