private EndpointCertificateSecrets readFromSecretStore(EndpointCertificateMetadata endpointCertificateMetadata) {
        try {
            EndpointCertificateSecrets endpointCertificateSecrets = secretStores.stream()
                    .filter(store -> store.supports(endpointCertificateMetadata.issuer()))
                    .collect(CustomCollectors.singleton())
                    .orElseThrow(() -> new RuntimeException("No provider of secrets for issuer " + endpointCertificateMetadata.issuer()))
                    .getSecret(endpointCertificateMetadata);

            if (endpointCertificateSecrets.isMissing())
                return endpointCertificateSecrets;

            verifyKeyMatchesCertificate(endpointCertificateMetadata, endpointCertificateSecrets);
            return endpointCertificateSecrets;
        } catch (RuntimeException e) {
            log.log(Level.WARNING, "Exception thrown during certificate retrieval", e);
            // Assume not ready yet
            return EndpointCertificateSecrets.missing(endpointCertificateMetadata.version());
        }
    }
Used to retrieve actual endpoint certificate/key from secret store.

@author andreer
configserver/src/main/java/com/yahoo/vespa/config/server/tenant/EndpointCertificateRetriever.java