As Martin Choma mentioned on WFLY-9899, the security providers are being loaded in a different order on JDK 8 vs JDK 9. With JDK 9, the WildFlyElytronProvider is no longer at the beginning of the providers array as it is with JDK 8. With JDK 9, the providers array also contains duplicate providers - they're being added once from the service loader and once from the installed providers.

Update the default provider supplier to be an aggregate of:

WildFlyElytronProvider
The security providers loaded using the service loader mechanism ensuring that any provider that is already an installed provider is skipped
The installed providers
For WildFly 13, we can look at enhancing this by introducing a security provider selector mechanism. This is tracked in ELY-1530.