anchor.diff:  
   *Impact* +
   If you have a PKCS#11 keystore configured within your `elasticsearch.yml` file, you must remove that
  -configuration and switch to a supported keystore type, or configure your PKCS#11 keystore as the 
  +configuration and switch to a supported keystore type, or configure your PKCS#11 keystore as the
   JRE default store.
   ====
   
  
positive.code: 
  [discrete]
  [[ssl-misc-changes]]
  ===== Other SSL/TLS changes 
  
  .PKCS#11 keystores and trustores cannot be configured in `elasticsearch.yml`
  [%collapsible]
  
negative.code: [%collapsible]
  ====
  *Details* +
  If `xpack.security.fips_mode.enabled` is true (see <<fips-140-compliance>>),
  the value of `xpack.security.authc.password_hashing.algorithm` now defaults to
  `pbkdf2_stretch`.
  
  