anchor.diff:    ...
     <http>
       ...
  -    <http-authentication-factory name="client-cert-digest" http-server-mechanism-factory="global" security-domain="client-cert-domain">
  +    <http-authentication-factory name="client-cert-digest" http-server-mechanism-factory="global" security-domain="ManagementDomain">
         <mechanism-configuration>
  -        <mechanism mechanism-name="CLIENT_CERT" pre-realm-principal-transformer="x500-decoder" realm-mapper="key-store-realm"/>
  +        <mechanism mechanism-name="CLIENT_CERT" pre-realm-principal-transformer="x500-decoder"/>
           <mechanism mechanism-name="DIGEST">
             <mechanism-realm realm-name="ManagementRealm"/>
           </mechanism>
         </mechanism-configuration>
       </http-authentication-factory>
       ...
  +    <configurable-http-server-mechanism-factory name="configured-cert" http-server-mechanism-factory="global">
  +        <properties>
  +            <property name="org.wildfly.security.http.skip-certificate-verification" value="true"/>
  +        </properties>
  +    </configurable-http-server-mechanism-factory>
  +    ...
     </http>
     ...
   </subsystem>
   ----
   
  -Where DIGEST authentication is used we rely on the default configuration within the security domain to select the 'test-users' realm, however where CLIENT_CERT authentication is in use an alternative realm-mapper is referenced to ensure the 'key-store-realm' is used.
  -
  -Additionally for CLIENT_CERT authentication a principal-transformer is referenced to extract the CN attribute from the distinguished name of the client certificate and use this when accessing the identity from the security realm.
  -
   == SASL Authentication Factory
   
   The architecture of the two authentication factories if very similar so a SASL authentication factory can be defined in the same way as the HTTP equivalent.
  +However, as EXTERNAL SASL mechanism does not do any certificate verification, there is no need for configuring SASL server factory.
   
   ----
   ./subsystem=elytron/sasl-authentication-factory=client-cert-digest:add(sasl-server-factory=elytron, \
  -  security-domain=client-cert-domain, \
  +  security-domain=ManagementDomain, \
     mechanism-configurations=[{mechanism-name=EXTERNAL, \
  -  realm-mapper=key-store-realm, \
     pre-realm-principal-transformer=x500-decoder}, \
     {mechanism-name=DIGEST-MD5, mechanism-realm-configurations=[{realm-name=ManagementRealm}]}])
   ----
  
positive.code: <management>
    ...
    <management-interfaces>
      <http-interface http-authentication-factory="client-cert-digest" ssl-context="localhost">
        <http-upgrade enabled="true" sasl-authentication-factory="client-cert-digest"/>
        <socket-binding http="management-http" https="management-https"/>
      </http-interface>
  
negative.code:   ...
    <sasl>
      ...
      <sasl-authentication-factory name="client-cert-digest" sasl-server-factory="elytron" security-domain="ManagementDomain">
        <mechanism-configuration>
          <mechanism mechanism-name="EXTERNAL" pre-realm-principal-transformer="x500-decoder"/>
          <mechanism mechanism-name="DIGEST-MD5">
            <mechanism-realm realm-name="ManagementRealm"/>
          </mechanism>
  