This fix changes the meaning of the `keyStoreProvider` and `trustStoreProvider` connector/acceptor URL parameters. They no longer define the "type" of store (e.g. JKS, JCEKS, PKCS12, etc.). They now define the actual provider (e.g. SunJCE, SUN, SunJSSE, etc.). The *new* `keyStoreType` and `trustStoreType` parameters define the type of store. This change **will break** any existing client that is setting either `keyStoreProvider` or `trustStoreProvider` upon upgrade. Client URLs should be updated to use `keyStoreType` and `trustStoreType` instead of `keyStoreProvider` or `trustStoreProvider` respectively.

I was able to reproduce this with the embedded (JBoss EAP) broker by following the instructions at https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html/how_to_configure_server_security/securing_the_server_and_its_interfaces#configure_ssl_fips_nss_database to create an nss db to use as a PKCS11 provder (no hard token / reader needed), then configuring my server as shown in the attachments (standalone-full.xml, standalone.conf, java.security, nss_pkcs11_fips.cfg). I did deviate a bit from the instruction as I had certs and ca certs already that I imported into nssdb via pk12util.