diff --git a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/RegistryResources.java b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/RegistryResources.java
index 3b60fd6dd46..d7b23ba472c 100644
--- a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/RegistryResources.java
+++ b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/RegistryResources.java
@@ -160,6 +160,24 @@ public static final class SecurityManagement {
         public static final String SERVER_INTERNAL_PRIVATE_KEY_PASSWORD = "Security.InternalKeyStore.KeyPassword";
         public static final String SERVER_INTERNAL_KEYSTORE_TYPE = "Security.InternalKeyStore.Type";
 
+        // Custom KeyStore related constants.
+        public static final class CustomKeyStore {
+
+            public static final String CUSTOM_KEYSTORE_PREFIX = "CUSTOM/";
+
+            public static final String ELEM_SECURITY = "Security";
+            public static final String ELEM_CUSTOM_KEYSTORES = "CustomKeyStores";
+
+            public static final String PROP_LOCATION = "Location";
+            public static final String PROP_TYPE = "Type";
+            public static final String PROP_PASSWORD = "Password";
+            public static final String PROP_KEY_ALIAS = "KeyAlias";
+            public static final String PROP_KEY_PASSWORD = "KeyPassword";
+        }
+
+        // carbon.home location placeholder.
+        public static final String CARBON_HOME_PLACEHOLDER = "${carbon.home}";
+
         //generated pub. key - multitenancy scenario
         public static final String TENANT_PUBKEY_RESOURCE = RegistryResources.ROOT +
                                                             "security/pub-key";
diff --git a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreManager.java b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreManager.java
index 2f33229c786..3f87162dfb6 100644
--- a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreManager.java
+++ b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreManager.java
@@ -17,10 +17,13 @@
 */
 package org.wso2.carbon.core.util;
 
+import org.apache.axiom.om.OMElement;
+import org.apache.commons.lang.StringUtils;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.wso2.carbon.CarbonException;
 import org.wso2.carbon.base.api.ServerConfigurationService;
+import org.wso2.carbon.context.PrivilegedCarbonContext;
 import org.wso2.carbon.core.RegistryResources;
 import org.wso2.carbon.core.internal.CarbonCoreDataHolder;
 import org.wso2.carbon.registry.api.Registry;
@@ -31,11 +34,17 @@
 import org.wso2.carbon.utils.CarbonUtils;
 import org.wso2.carbon.utils.multitenancy.MultitenantConstants;
 
-import java.io.*;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
 import java.security.Key;
 import java.security.KeyStore;
 import java.security.PrivateKey;
 import java.security.PublicKey;
+import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.Date;
 import java.util.concurrent.ConcurrentHashMap;
@@ -55,7 +64,8 @@ public class KeyStoreManager {
     private static Log log = LogFactory.getLog(KeyStoreManager.class);
 
     private Registry registry = null;
-    private ConcurrentHashMap<String, KeyStoreBean> loadedKeyStores = null;
+    private ConcurrentHashMap<String, KeyStoreBean> tenantKeyStores = null;
+    private ConcurrentHashMap<String, KeyStore> customKeyStores = null;
     private int tenantId = MultitenantConstants.SUPER_TENANT_ID;
 
     private ServerConfigurationService serverConfigService;
@@ -73,7 +83,8 @@ private KeyStoreManager(int tenantId, ServerConfigurationService serverConfigSer
                             RegistryService registryService) {
         this.serverConfigService = serverConfigService;
         this.registryService = registryService;
-        loadedKeyStores = new ConcurrentHashMap<String, KeyStoreBean>();
+        tenantKeyStores = new ConcurrentHashMap<String, KeyStoreBean>();
+        customKeyStores = new ConcurrentHashMap<String, KeyStore>();
         this.tenantId = tenantId;
         try {
             registry = registryService.getGovernanceSystemRegistry(tenantId);
@@ -101,6 +112,8 @@ public RegistryService getRegistryService() {
      * @return KeyStoreManager instance for that tenant
      */
     public static KeyStoreManager getInstance(int tenantId) {
+
+        log.debug("KeyStoreManager Instace created for teant id: " + tenantId);
         return getInstance(tenantId, CarbonCoreDataHolder.getInstance().
                 getServerConfigurationService(), CryptoUtil.lookupRegistryService());
     }
@@ -118,92 +131,57 @@ public static KeyStoreManager getInstance(int tenantId,
     }
 
     /**
-     * Get the key store object for the given key store name
+     * Get the key store object for the given key store name.
      *
-     * @param keyStoreName key store name
-     * @return KeyStore object
-     * @throws Exception If there is not a key store with the given name
+     * @param keyStoreName  Key store name.
+     * @return KeyStore object.
+     * @throws Exception    If there is an error when retriving the given keystore.
      */
     public KeyStore getKeyStore(String keyStoreName) throws Exception {
 
+        if (StringUtils.isEmpty(keyStoreName)) {
+            throw new SecurityException("Key store name is null or empty.");
+        }
+
         if (KeyStoreUtil.isPrimaryStore(keyStoreName)) {
             return getPrimaryKeyStore();
         }
 
-        if (isCachedKeyStoreValid(keyStoreName)) {
-            return loadedKeyStores.get(keyStoreName).getKeyStore();
+        if (KeyStoreUtil.isCustomKeyStore(keyStoreName)) {
+            return getCustomKeyStore(keyStoreName);
         }
 
-        String path = RegistryResources.SecurityManagement.KEY_STORES + "/" + keyStoreName;
-        if (registry.resourceExists(path)) {
-            org.wso2.carbon.registry.api.Resource resource = registry.get(path);
-            byte[] bytes = (byte[]) resource.getContent();
-            KeyStore keyStore = KeyStore.getInstance(resource
-                    .getProperty(RegistryResources.SecurityManagement.PROP_TYPE));
-            CryptoUtil cryptoUtil = CryptoUtil.getDefaultCryptoUtil();
-            String encryptedPassword = resource
-                    .getProperty(RegistryResources.SecurityManagement.PROP_PASSWORD);
-            String password = new String(cryptoUtil.base64DecodeAndDecrypt(encryptedPassword));
-            ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
-            keyStore.load(stream, password.toCharArray());
-            KeyStoreBean keyStoreBean = new KeyStoreBean(keyStore, resource.getLastModified());
-            resource.discard();
-
-            if (loadedKeyStores.containsKey(keyStoreName)) {
-                loadedKeyStores.replace(keyStoreName, keyStoreBean);
-            } else {
-                loadedKeyStores.put(keyStoreName, keyStoreBean);
-            }
-            return keyStore;
-        } else {
-            throw new SecurityException("Key Store with a name : " + keyStoreName + " does not exist.");
-        }
+        return getTenantKeyStore(keyStoreName);
     }
 
     /**
-     * This method loads the private key of a given key store
+     * This method loads the private key of a given key store.
      *
-     * @param keyStoreName name of the key store
-     * @param alias        alias of the private key
-     * @return private key corresponding to the alias
+     * @param keyStoreName  Name of the key store.
+     * @param alias         Alias of the private key.
+     * @return Private key corresponding to the alias.
+     * @throws Exception    If there is an error when retriving the private key from given keystore.
      */
     public Key getPrivateKey(String keyStoreName, String alias) {
+
+        if (StringUtils.isEmpty(keyStoreName)) {
+            throw new SecurityException("Key store name is null or empty.");
+        }
+
         try {
             if (KeyStoreUtil.isPrimaryStore(keyStoreName)) {
                 return getDefaultPrivateKey();
             }
 
-            String path = RegistryResources.SecurityManagement.KEY_STORES + "/" + keyStoreName;
-            org.wso2.carbon.registry.api.Resource resource;
-            KeyStore keyStore;
-
-            if (registry.resourceExists(path)) {
-                resource = registry.get(path);
-            } else {
-                throw new SecurityException("Given Key store is not available in registry : " + keyStoreName);
+            if (KeyStoreUtil.isCustomKeyStore(keyStoreName)) {
+                return getCustomKeyStorePrivateKey(keyStoreName);
             }
 
-            CryptoUtil cryptoUtil = CryptoUtil.getDefaultCryptoUtil();
-            String encryptedPassword = resource
-                    .getProperty(RegistryResources.SecurityManagement.PROP_PRIVATE_KEY_PASS);
-            String privateKeyPasswd = new String(cryptoUtil.base64DecodeAndDecrypt(encryptedPassword));
-
-            if (isCachedKeyStoreValid(keyStoreName)) {
-                keyStore = loadedKeyStores.get(keyStoreName).getKeyStore();
-                return keyStore.getKey(alias, privateKeyPasswd.toCharArray());
-            } else {
-                byte[] bytes = (byte[]) resource.getContent();
-                String keyStorePassword = new String(cryptoUtil.base64DecodeAndDecrypt(resource.getProperty(
-                        RegistryResources.SecurityManagement.PROP_PASSWORD)));
-                keyStore = KeyStore.getInstance(resource
-                        .getProperty(RegistryResources.SecurityManagement.PROP_TYPE));
-                ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
-                keyStore.load(stream, keyStorePassword.toCharArray());
-
-                KeyStoreBean keyStoreBean = new KeyStoreBean(keyStore, resource.getLastModified());
-                updateKeyStoreCache(keyStoreName, keyStoreBean);
-                return keyStore.getKey(alias, privateKeyPasswd.toCharArray());
+            // Primary key store or custom key stores does not expect the key alias.
+            if (StringUtils.isEmpty(alias)) {
+                throw new SecurityException("Private key alias is null or empty.");
             }
+            return getTenantPrivateKey(keyStoreName, alias);
         } catch (Exception e) {
             log.error("Error loading the private key from the key store : " + keyStoreName);
             throw new SecurityException("Error loading the private key from the key store : " +
@@ -211,6 +189,35 @@ public Key getPrivateKey(String keyStoreName, String alias) {
         }
     }
 
+    /**
+     * This method loads the public certificate of a given key store.
+     *
+     * @param keyStoreName  Name of the key store.
+     * @param alias         Alias of the certificate.
+     * @return Public Certificate corresponding to the alias.
+     * @throws Exception    If there is an error when retriving the public certificate from given keystore.
+     */
+    public Certificate getCertificate(String keyStoreName, String alias) throws Exception {
+
+        if (StringUtils.isEmpty(keyStoreName)) {
+            throw new SecurityException("Key store name is null or empty.");
+        }
+
+        if (KeyStoreUtil.isPrimaryStore(keyStoreName)) {
+            return getDefaultPrimaryCertificate();
+        }
+
+        if (KeyStoreUtil.isCustomKeyStore(keyStoreName)) {
+            return getCustomKeyStoreCertificate(keyStoreName);
+        }
+
+        // Primary or custom key store methods does not expect alias.
+        if (StringUtils.isEmpty(alias)) {
+            throw new SecurityException("Certificate alias is null or empty.");
+        }
+        return getTenantCertificate(keyStoreName, alias);
+    }
+
     /**
      * Get the key store password of the given key store resource
      *
@@ -226,7 +233,6 @@ public String getPassword(Resource resource) throws Exception {
 
     }
 
-
     /**
      * Get the key store password for the given key store name.
      * Note:  Caching has been not implemented for this method
@@ -299,7 +305,7 @@ public void updateKeyStore(String name, KeyStore keyStore) throws Exception {
 
         registry.put(path, resource);
         resource.discard();
-        updateKeyStoreCache(name, new KeyStoreBean(keyStore, new Date()));
+        updateTenantKeyStoreCache(name, new KeyStoreBean(keyStore, new Date()));
     }
 
     /**
@@ -310,6 +316,10 @@ public void updateKeyStore(String name, KeyStore keyStore) throws Exception {
      *                   than tenant 0
      */
     public KeyStore getPrimaryKeyStore() throws Exception {
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading primary key store.");
+        }
         if (tenantId == MultitenantConstants.SUPER_TENANT_ID) {
             if (primaryKeyStore == null) {
 
@@ -341,6 +351,48 @@ public KeyStore getPrimaryKeyStore() throws Exception {
         }
     }
 
+    /**
+     * Load the requested tenant keystore from registry.
+     *
+     * @param keyStoreName  Name of the Tenant KeyStore.
+     * @return Key store object.
+     * @throws Exception    Exception if failed to retrive the given keystore from registry.
+     */
+    private KeyStore getTenantKeyStore(String keyStoreName) throws Exception {
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading tenant key store : " + keyStoreName);
+        }
+        if (isCachedTenantKeyStoreValid(keyStoreName)) {
+            return tenantKeyStores.get(keyStoreName).getKeyStore();
+        }
+
+        String path = RegistryResources.SecurityManagement.KEY_STORES + "/" + keyStoreName;
+        if (registry.resourceExists(path)) {
+            org.wso2.carbon.registry.api.Resource resource = registry.get(path);
+            byte[] bytes = (byte[]) resource.getContent();
+            KeyStore keyStore = KeyStore.getInstance(resource
+                    .getProperty(RegistryResources.SecurityManagement.PROP_TYPE));
+            CryptoUtil cryptoUtil = CryptoUtil.getDefaultCryptoUtil();
+            String encryptedPassword = resource
+                    .getProperty(RegistryResources.SecurityManagement.PROP_PASSWORD);
+            String password = new String(cryptoUtil.base64DecodeAndDecrypt(encryptedPassword));
+            ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
+            keyStore.load(stream, password.toCharArray());
+            KeyStoreBean keyStoreBean = new KeyStoreBean(keyStore, resource.getLastModified());
+            resource.discard();
+
+            if (tenantKeyStores.containsKey(keyStoreName)) {
+                tenantKeyStores.replace(keyStoreName, keyStoreBean);
+            } else {
+                tenantKeyStores.put(keyStoreName, keyStoreBean);
+            }
+            return keyStore;
+        } else {
+            throw new SecurityException("Key Store with a name : " + keyStoreName + " does not exist.");
+        }
+    }
+
     /**
      * Load the internal key store, this is allowed only for the super tenant
      *
@@ -418,6 +470,38 @@ public KeyStore getRegistryKeyStore() throws Exception {
         }
     }
 
+    /**
+     * Load custom key stores configured in Carbon.xml file.
+     * Custom key store files should reside in <IS-HOME>/repository/resources/security/
+     *
+     * @param keyStoreName  Name of the custom key store. Must start with the custom key store prefix.
+     * @return Key store object
+     * @throws Exception    Exception if failed to retrive the given key store.
+     */
+    private KeyStore getCustomKeyStore(String keyStoreName) throws Exception {
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading custom key store : " + keyStoreName);
+        }
+        if (customKeyStores.containsKey(keyStoreName)) {
+            return customKeyStores.get(keyStoreName);
+        }
+
+        OMElement config = KeyStoreUtil.getCustomKeyStoreConfigElement(keyStoreName, this.getServerConfigService());
+
+        String location = KeyStoreUtil.getCustomKeyStoreConfig(
+                config, RegistryResources.SecurityManagement.CustomKeyStore.PROP_LOCATION);
+        String type = KeyStoreUtil.getCustomKeyStoreConfig(
+                config, RegistryResources.SecurityManagement.CustomKeyStore.PROP_TYPE);
+        String password = KeyStoreUtil.getCustomKeyStoreConfig(
+                config, RegistryResources.SecurityManagement.CustomKeyStore.PROP_PASSWORD);
+
+        KeyStore keyStore = loadKeyStoreFromFileSystem(location, password, type);
+        customKeyStores.put(keyStoreName, keyStore);
+
+        return keyStore;
+    }
+
     /**
      * Get the default private key, only allowed for tenant 0
      *
@@ -425,6 +509,10 @@ public KeyStore getRegistryKeyStore() throws Exception {
      * @throws Exception Carbon Exception for tenants other than tenant 0
      */
     public PrivateKey getDefaultPrivateKey() throws Exception {
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading primary key store private key.");
+        }
         if (tenantId == MultitenantConstants.SUPER_TENANT_ID) {
             ServerConfigurationService config = this.getServerConfigService();
             String password = config
@@ -437,6 +525,73 @@ public PrivateKey getDefaultPrivateKey() throws Exception {
                 "available only for the super tenant.");
     }
 
+    /**
+     * This method loads the private key of a given tenant key store.
+     *
+     * @param keyStoreName  Name of the tenant key store.
+     * @param alias         Alias of the private key.
+     * @return Private key corresponding to the alias.
+     */
+    private PrivateKey getTenantPrivateKey(String keyStoreName, String alias) throws Exception {
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading private key from tenant key store : " + keyStoreName + " alias: " + alias);
+        }
+        String path = RegistryResources.SecurityManagement.KEY_STORES + "/" + keyStoreName;
+        org.wso2.carbon.registry.api.Resource resource;
+        KeyStore keyStore;
+
+        if (registry.resourceExists(path)) {
+            resource = registry.get(path);
+        } else {
+            throw new SecurityException("Given Key store is not available in registry : " + keyStoreName);
+        }
+
+        CryptoUtil cryptoUtil = CryptoUtil.getDefaultCryptoUtil();
+        String encryptedPassword = resource
+                .getProperty(RegistryResources.SecurityManagement.PROP_PRIVATE_KEY_PASS);
+        String privateKeyPasswd = new String(cryptoUtil.base64DecodeAndDecrypt(encryptedPassword));
+
+        if (isCachedTenantKeyStoreValid(keyStoreName)) {
+            keyStore = tenantKeyStores.get(keyStoreName).getKeyStore();
+        } else {
+            byte[] bytes = (byte[]) resource.getContent();
+            String keyStorePassword = new String(cryptoUtil.base64DecodeAndDecrypt(resource.getProperty(
+                    RegistryResources.SecurityManagement.PROP_PASSWORD)));
+            keyStore = KeyStore.getInstance(resource
+                    .getProperty(RegistryResources.SecurityManagement.PROP_TYPE));
+            ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
+            keyStore.load(stream, keyStorePassword.toCharArray());
+
+            KeyStoreBean keyStoreBean = new KeyStoreBean(keyStore, resource.getLastModified());
+            updateTenantKeyStoreCache(keyStoreName, keyStoreBean);
+        }
+
+        return (PrivateKey) keyStore.getKey(alias, privateKeyPasswd.toCharArray());
+    }
+
+    /**
+     * Get the private key of a given custom keystore.
+     *
+     * @param keyStoreName  Name of the custom key store. Must include the prefix "CustomKeyStore/".
+     * @return Private key from custom keystore corresponding to the alias.
+     * @throws Exception    If failed to retrive the requested private key.
+     */
+    private PrivateKey getCustomKeyStorePrivateKey(String keyStoreName) throws Exception {
+
+        OMElement config = KeyStoreUtil.getCustomKeyStoreConfigElement(keyStoreName, this.getServerConfigService());
+
+        String password = KeyStoreUtil.getCustomKeyStoreConfig(
+                config, RegistryResources.SecurityManagement.CustomKeyStore.PROP_PASSWORD);
+        String alias = KeyStoreUtil.getCustomKeyStoreConfig(
+                config, RegistryResources.SecurityManagement.CustomKeyStore.PROP_KEY_ALIAS);
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading private key from custom key store : " + keyStoreName + " alias: " + alias);
+        }
+        return (PrivateKey) getCustomKeyStore(keyStoreName).getKey(alias, password.toCharArray());
+    }
+
     /**
      * Get default pub. key
      *
@@ -477,6 +632,10 @@ public String getPrimaryPrivateKeyPasssword() throws CarbonException {
      * @throws Exception Permission denied for accessing primary key store
      */
     public X509Certificate getDefaultPrimaryCertificate() throws Exception {
+
+        if (log.isDebugEnabled()) {
+            log.debug("Loading primary key store public certificate.");
+        }
         if (tenantId == MultitenantConstants.SUPER_TENANT_ID) {
             ServerConfigurationService config = this.getServerConfigService();
             String alias = config
@@ -487,13 +646,43 @@ public X509Certificate getDefaultPrimaryCertificate() throws Exception {
                 "available only for the super tenant.");
     }
 
-    private boolean isCachedKeyStoreValid(String keyStoreName) {
+    /**
+     * This method is used to get public certificates of tenant keystores.
+     *
+     * @param keyStoreName      Name of the tenant key store.
+     * @param alias             Public certificate alias.
+     * @return Public certificate of a given tenant keystore.
+     * @throws Exception        If failed to retrive the requested public certificate from the tenant key store.
+     */
+    private Certificate getTenantCertificate(String keyStoreName, String alias) throws Exception {
+
+        return getTenantKeyStore(keyStoreName).getCertificate(alias);
+    }
+
+    /**
+     * This method is used to get public certificates of custom keystores.
+     *
+     * @param keyStoreName      Custom key store name.
+     * @return Public certificate of a given custom keystore
+     * @throws Exception        If failed to retrive the requested public certificate from the custom key store.
+     */
+    private Certificate getCustomKeyStoreCertificate(String keyStoreName) throws Exception {
+
+        OMElement config = KeyStoreUtil.getCustomKeyStoreConfigElement(keyStoreName, this.getServerConfigService());
+        String alias = KeyStoreUtil.getCustomKeyStoreConfig(
+                config, RegistryResources.SecurityManagement.CustomKeyStore.PROP_KEY_ALIAS);
+
+        return getCustomKeyStore(keyStoreName).getCertificate(alias);
+    }
+
+    private boolean isCachedTenantKeyStoreValid(String keyStoreName) {
+
         String path = RegistryResources.SecurityManagement.KEY_STORES + "/" + keyStoreName;
         boolean cachedKeyStoreValid = false;
         try {
-            if (loadedKeyStores.containsKey(keyStoreName)) {
+            if (tenantKeyStores.containsKey(keyStoreName)) {
                 org.wso2.carbon.registry.api.Resource metaDataResource = registry.get(path);
-                KeyStoreBean keyStoreBean = loadedKeyStores.get(keyStoreName);
+                KeyStoreBean keyStoreBean = tenantKeyStores.get(keyStoreName);
                 if (keyStoreBean.getLastModifiedDate().equals(metaDataResource.getLastModified())) {
                     cachedKeyStoreValid = true;
                 }
@@ -512,15 +701,17 @@ private boolean isCachedKeyStoreValid(String keyStoreName) {
         return cachedKeyStoreValid;
     }
 
-    private void updateKeyStoreCache(String keyStoreName, KeyStoreBean keyStoreBean) {
-        if (loadedKeyStores.containsKey(keyStoreName)) {
-            loadedKeyStores.replace(keyStoreName, keyStoreBean);
+    private void updateTenantKeyStoreCache(String keyStoreName, KeyStoreBean keyStoreBean) {
+
+        if (tenantKeyStores.containsKey(keyStoreName)) {
+            tenantKeyStores.replace(keyStoreName, keyStoreBean);
         } else {
-            loadedKeyStores.put(keyStoreName, keyStoreBean);
+            tenantKeyStores.put(keyStoreName, keyStoreBean);
         }
     }
 
     public KeyStore loadKeyStoreFromFileSystem(String keyStorePath, String password, String type) {
+
         CarbonUtils.checkSecurity();
         String absolutePath = new File(keyStorePath).getAbsolutePath();
         FileInputStream inputStream = null;
diff --git a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreUtil.java b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreUtil.java
index a594bfd04f4..70d9ee52038 100644
--- a/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreUtil.java
+++ b/core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/util/KeyStoreUtil.java
@@ -17,15 +17,22 @@
 */
 package org.wso2.carbon.core.util;
 
+import org.apache.axiom.om.OMElement;
 import org.apache.axis2.AxisFault;
+import org.apache.axis2.util.XMLUtils;
+import org.wso2.carbon.CarbonException;
 import org.wso2.carbon.base.api.ServerConfigurationService;
 import org.wso2.carbon.core.RegistryResources;
 import org.wso2.carbon.core.internal.CarbonCoreDataHolder;
+import org.wso2.carbon.utils.ServerConstants;
 
 import java.io.File;
 import java.security.KeyStore;
 import java.security.cert.Certificate;
+import java.util.Arrays;
 import java.util.Enumeration;
+import java.util.Iterator;
+import javax.xml.namespace.QName;
 
 public class KeyStoreUtil {
 
@@ -111,4 +118,121 @@ public static Certificate getCertificate(String alias, KeyStore store) throws Ax
         }
     }
 
+    /**
+     * This method checks if the given key store name is for a custom key store by checking the prefix.
+     *
+     * @param keyStoreName      Custom key store name.
+     * @return Boolean value indicating if the given name is for a custom key store.
+     */
+    public static boolean isCustomKeyStore(String keyStoreName) {
+
+        return keyStoreName.startsWith(RegistryResources.SecurityManagement.CustomKeyStore.CUSTOM_KEYSTORE_PREFIX);
+    }
+
+    /**
+     * This method builds the QName object for a configuration within the carbon.xml namespace.
+     *
+     * @param localPart     Local part of the configuration.
+     * @return QName object.
+     */
+    public static QName getQNameWithCarbonNS(String localPart) {
+
+        return new QName(ServerConstants.CARBON_SERVER_XML_NAMESPACE, localPart);
+    }
+
+    /**
+     * This method returns the OMElement object corresponding to the custom key store configuration in Carbon.xml file.
+     *
+     * @param keyStoreName          Name of the custom key store.
+     * @param serverConfiguration   ServerConfigurationService instance.
+     * @return OMElement object for the requested configuration.
+     * @throws CarbonException      If failed to retrieve the requested configuration.
+     */
+    public static OMElement getCustomKeyStoreConfigElement(
+            String keyStoreName, ServerConfigurationService serverConfiguration) throws CarbonException {
+
+        // Remove prefix if exists.
+        if (KeyStoreUtil.isCustomKeyStore(keyStoreName)) {
+            keyStoreName = keyStoreName.substring(
+                    RegistryResources.SecurityManagement.CustomKeyStore.CUSTOM_KEYSTORE_PREFIX.length());
+        }
+
+        OMElement config = null;
+        try {
+            OMElement customKeyStoresConfigElem = XMLUtils.toOM(serverConfiguration.getDocumentElement())
+                    .getFirstChildWithName(KeyStoreUtil.getQNameWithCarbonNS(
+                            RegistryResources.SecurityManagement.CustomKeyStore.ELEM_SECURITY))
+                    .getFirstChildWithName(KeyStoreUtil.getQNameWithCarbonNS(
+                            RegistryResources.SecurityManagement.CustomKeyStore.ELEM_CUSTOM_KEYSTORES));
+
+            Iterator<OMElement> iterator = customKeyStoresConfigElem.getChildElements();
+            while (iterator.hasNext()) {
+                OMElement customKeyStoreConfig = iterator.next();
+                String location = customKeyStoreConfig.getFirstChildWithName(KeyStoreUtil.getQNameWithCarbonNS(
+                        RegistryResources.SecurityManagement.CustomKeyStore.PROP_LOCATION)).getText();
+
+                if (location.endsWith(keyStoreName)) {
+                    config = customKeyStoreConfig;
+                    break;
+                }
+            }
+        } catch (Exception e) {
+            throw new CarbonException("Error occurred while reading custom keystore configuration.", e);
+        }
+
+        if (config == null) {
+            throw new CarbonException("No configuration found for custom key store : " + keyStoreName);
+        }
+
+        return config;
+    }
+
+    /**
+     * This method returns the requested key store property value from the configuration.
+     *
+     * @param config                OMElement object of configuration.
+     * @param propertyName                  Property name.
+     * @return Configuration value as String.
+     * @throws CarbonException      If failed to retrieve the requested configuration.
+     */
+    public static String getCustomKeyStoreConfig(OMElement config, String propertyName) throws CarbonException {
+
+        validateKeyStoreConfigName(propertyName);
+
+        String configValue = config.getFirstChildWithName(getQNameWithCarbonNS(propertyName)).getText();
+
+        if (RegistryResources.SecurityManagement.CustomKeyStore.PROP_LOCATION.equals(propertyName)) {
+            // Replace "{$carbon.home}" placeholder with proper location path
+            if (configValue.startsWith(RegistryResources.SecurityManagement.CARBON_HOME_PLACEHOLDER)) {
+                configValue = configValue.replace(RegistryResources.SecurityManagement.CARBON_HOME_PLACEHOLDER, "");
+                configValue = new File(".").getAbsolutePath() + configValue;
+            } else {
+                throw new CarbonException("Invalid key store location: " + configValue);
+            }
+        }
+
+        return configValue;
+    }
+
+    /**
+     * This method validates the requested key store configuration name.
+     * Only 'Location', 'Type', 'Password', 'KeyAlias' and 'KeyPassword' are valid key store configuration names.
+     *
+     * @param propertyName          Requested key store configuration name.
+     * @throws CarbonException      If the requested key store configuration is invalid.
+     */
+    public static void validateKeyStoreConfigName(String propertyName) throws CarbonException {
+
+        String[] keyStoreProperties = {
+                RegistryResources.SecurityManagement.CustomKeyStore.PROP_LOCATION,
+                RegistryResources.SecurityManagement.CustomKeyStore.PROP_TYPE,
+                RegistryResources.SecurityManagement.CustomKeyStore.PROP_PASSWORD,
+                RegistryResources.SecurityManagement.CustomKeyStore.PROP_KEY_ALIAS,
+                RegistryResources.SecurityManagement.CustomKeyStore.PROP_KEY_PASSWORD
+        };
+
+        if (!Arrays.asList(keyStoreProperties).contains(propertyName)) {
+            throw new CarbonException("Requested key store configuration is invalid.");
+        }
+    }
 }
diff --git a/core/org.wso2.carbon.core/src/test/java/org/wso2/carbon/core/util/KeyStoreUtilTest.java b/core/org.wso2.carbon.core/src/test/java/org/wso2/carbon/core/util/KeyStoreUtilTest.java
new file mode 100644
index 00000000000..34d131487f4
--- /dev/null
+++ b/core/org.wso2.carbon.core/src/test/java/org/wso2/carbon/core/util/KeyStoreUtilTest.java
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2024, WSO2 LLC. (http://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.wso2.carbon.core.util;
+
+import org.apache.axiom.om.OMElement;
+import org.testng.annotations.DataProvider;
+import org.testng.annotations.Test;
+import org.wso2.carbon.CarbonException;
+import org.wso2.carbon.base.ServerConfiguration;
+import org.wso2.carbon.utils.ServerConstants;
+
+import javax.xml.namespace.QName;
+
+import java.nio.file.Paths;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.fail;
+
+public class KeyStoreUtilTest {
+
+    private static final String basedir = Paths.get("").toAbsolutePath().toString();
+    private static final String testDir = Paths.get(basedir, "src", "test", "resources").toString();
+
+    @DataProvider(name = "KeyStoreNameDataProvider")
+    public Object[][] keyStoreNameDataProvider() {
+
+        return new Object[][] {
+                {"CUSTOM/myKeyStore", true},
+                {"CUSTOM/@#$_keyStore", true},
+                {"abcd", false},
+                {"", false},
+                {" ", false},
+        };
+    }
+
+    @Test(dataProvider = "KeyStoreNameDataProvider")
+    public void testIsCustomKeyStore(String keyStoreName, boolean expectedResult) {
+
+        assertEquals(KeyStoreUtil.isCustomKeyStore(keyStoreName), expectedResult);
+    }
+
+    @DataProvider(name = "QNameWithCarbonNSDataProvider")
+    public String[] qNameWithCarbonNSDataProvider() {
+
+        return new String[] {
+                "localPart",
+                "",
+        };
+    }
+
+    @Test(dataProvider = "QNameWithCarbonNSDataProvider")
+    public void testGetQNameWithCarbonNS(String localPart) {
+
+        QName qName = KeyStoreUtil.getQNameWithCarbonNS(localPart);
+        assertEquals(ServerConstants.CARBON_SERVER_XML_NAMESPACE, qName.getNamespaceURI());
+        assertEquals(localPart, qName.getLocalPart());
+    }
+
+    @DataProvider(name = "CustomKeyStoreConfigDataProvider")
+    public String[][] customKeyStoreConfigDataProvider() {
+
+        return new String[][] {
+                {"custom.jks", "Location", basedir + "/./repository/resources/security/custom.jks"},
+                {"custom.jks", "Type", "JKS"},
+                {"custom.jks", "Password", "customPassword"},
+                {"custom.jks", "KeyAlias", "customAlias"},
+                {"custom.jks", "KeyPassword", "customKeyPass"},
+                {"testKey.jks", "Location", basedir + "/./repository/resources/security/testKey.jks"},
+                {"testKey.jks", "Type", "JKS"},
+                {"testKey.jks", "Password", "testPass"},
+                {"testKey.jks", "KeyAlias", "testKey"},
+                {"testKey.jks", "KeyPassword", "testKeyPass"}
+        };
+    }
+
+    // This test covers both getCustomKeyStoreConfigElement and getCustomKeyStoreConfig methods
+    @Test(dataProvider = "CustomKeyStoreConfigDataProvider")
+    public void testReadCustomKeyStoreConfigs(String keyStoreName, String configName, String expectedValue) {
+
+        try {
+            String serverConfigPath = Paths.get(testDir, "carbon.xml").toString();
+            ServerConfiguration serverConfiguration = ServerConfiguration.getInstance();
+            serverConfiguration.forceInit(serverConfigPath);
+            OMElement keyStoreConfigElement = KeyStoreUtil.getCustomKeyStoreConfigElement(keyStoreName, serverConfiguration);
+            assertEquals(KeyStoreUtil.getCustomKeyStoreConfig(keyStoreConfigElement, configName), expectedValue);
+        } catch (Exception e) {
+            fail();
+        }
+    }
+
+    @DataProvider(name = "CorrectKeyStoreConfigDataProvider")
+    public String[] correctKeyStoreConfigDataProvider() {
+
+        return new String[] {
+                "Location",
+                "Type",
+                "Password",
+                "KeyAlias",
+                "KeyPassword"
+        };
+    }
+
+    @Test(dataProvider = "CorrectKeyStoreConfigDataProvider")
+    public void testValidateCorrectKeyStoreConfigNames(String configName) {
+
+        try {
+            KeyStoreUtil.validateKeyStoreConfigName(configName);
+        } catch (CarbonException e) {
+            fail();
+        }
+    }
+
+    @DataProvider(name = "IncorrectKeyStoreConfigDataProvider")
+    public String[] incorrectKeyStoreConfigDataProvider() {
+
+        return new String[] {
+                "ABCD",
+                "",
+                " "
+        };
+    }
+
+    @Test(dataProvider = "IncorrectKeyStoreConfigDataProvider", expectedExceptions = CarbonException.class)
+    public void testValidateIncorrectKeyStoreConfigName(String configName) throws Exception {
+
+        KeyStoreUtil.validateKeyStoreConfigName(configName);
+    }
+}
diff --git a/core/org.wso2.carbon.core/src/test/resources/carbon.xml b/core/org.wso2.carbon.core/src/test/resources/carbon.xml
new file mode 100644
index 00000000000..3a375a3edcc
--- /dev/null
+++ b/core/org.wso2.carbon.core/src/test/resources/carbon.xml
@@ -0,0 +1,657 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!--
+  ~ Copyright (c) 2017, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
+  ~
+  ~ WSO2 Inc. licenses this file to you under the Apache License,
+  ~ Version 2.0 (the "License"); you may not use this file except
+  ~ in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied.  See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+
+<!--
+    This is the main server configuration file
+
+    ${carbon.home} represents the carbon.home system property.
+    Other system properties can be specified in a similar manner.
+-->
+<Server xmlns="http://wso2.org/projects/carbon/carbon.xml">
+
+    <!--
+       Product Name
+    -->
+    <Name>${product.name}</Name>
+
+    <!--
+       machine readable unique key to identify each product
+    -->
+    <ServerKey>${product.key}</ServerKey>
+
+    <!--
+       Product Version
+    -->
+    <Version>${product.version}</Version>
+
+    <!--
+       Host name or IP address of the machine hosting this server
+       e.g. www.wso2.org, 192.168.1.10
+       This is will become part of the End Point Reference of the
+       services deployed on this server instance.
+    -->
+    <!--HostName>www.wso2.org</HostName-->
+
+    <!--
+    Host name to be used for the Carbon management console
+    -->
+    <!--MgtHostName>mgt.wso2.org</MgtHostName-->
+
+    <!--
+        The URL of the back end server. This is where the admin services are hosted and
+        will be used by the clients in the front end server.
+        This is required only for the Front-end server. This is used when seperating BE server from FE server
+       -->
+    <ServerURL>local:/${carbon.context}/services/</ServerURL>
+    <!--
+    <ServerURL>https://${carbon.local.ip}:${carbon.management.port}${carbon.context}/services/</ServerURL>
+    -->
+    <!--
+    The URL of the index page. This is where the user will be redirected after signing in to the
+    carbon server.
+    -->
+    <!-- IndexPageURL>/carbon/admin/index.jsp</IndexPageURL-->
+
+    <!--
+    For cApp deployment, we have to identify the roles that can be acted by the current server.
+    The following property is used for that purpose. Any number of roles can be defined here.
+    Regular expressions can be used in the role.
+    Ex : <Role>.*</Role> means this server can act any role
+    -->
+    <ServerRoles>
+        <Role>${default.server.role}</Role>
+    </ServerRoles>
+
+    <!-- uncommnet this line to subscribe to a bam instance automatically -->
+    <!--<BamServerURL>https://bamhost:bamport/services/</BamServerURL>-->
+
+    <!--
+       The fully qualified name of the server
+    -->
+    <Package>org.wso2.carbon</Package>
+
+    <!--
+       Webapp context root of WSO2 Carbon management console.
+    -->
+    <WebContextRoot>/</WebContextRoot>
+
+    <!--
+    	Proxy context path is a useful parameter to add a proxy path when a Carbon server is fronted by reverse proxy. In addtion
+        to the proxy host and proxy port this parameter allows you add a path component to external URLs. e.g.
+     		URL of the Carbon server -> https://10.100.1.1:9443/carbon
+   		URL of the reverse proxy -> https://prod.abc.com/appserver/carbon
+
+   	appserver - proxy context path. This specially required whenever you are generating URLs to displace in
+   	Carbon UI components.
+    -->
+    <!--
+    	<MgtProxyContextPath></MgtProxyContextPath>
+    	<ProxyContextPath></ProxyContextPath>
+    -->
+
+    <!-- In-order to  get the registry http Port from the back-end when the default http transport is not the same-->
+    <!--RegistryHttpPort>9763</RegistryHttpPort-->
+
+    <!--
+    Number of items to be displayed on a management console page. This is used at the
+    backend server for pagination of various items.
+    -->
+    <ItemsPerPage>15</ItemsPerPage>
+
+    <!-- The endpoint URL of the cloud instance management Web service -->
+    <!--<InstanceMgtWSEndpoint>https://ec2.amazonaws.com/</InstanceMgtWSEndpoint>-->
+
+    <!--
+       Ports used by this server
+    -->
+    <Ports>
+
+        <!-- Ports offset. This entry will set the value of the ports defined below to
+         the define value + Offset.
+         e.g. Offset=2 and HTTPS port=9443 will set the effective HTTPS port to 9445
+         -->
+        <Offset>0</Offset>
+
+        <!-- The JMX Ports -->
+        <JMX>
+            <!--The port RMI registry is exposed-->
+            <RMIRegistryPort>9999</RMIRegistryPort>
+            <!--The port RMI server should be exposed-->
+            <RMIServerPort>11111</RMIServerPort>
+        </JMX>
+
+        <!-- Embedded LDAP server specific ports -->
+        <EmbeddedLDAP>
+            <!-- Port which embedded LDAP server runs -->
+            <LDAPServerPort>10389</LDAPServerPort>
+            <!-- Port which KDC (Kerberos Key Distribution Center) server runs -->
+            <KDCServerPort>8000</KDCServerPort>
+        </EmbeddedLDAP>
+
+        <!--
+                 Override datasources JNDIproviderPort defined in bps.xml and datasources.properties files
+        -->
+        <!--<JNDIProviderPort>2199</JNDIProviderPort>-->
+        <!--Override receive port of thrift based entitlement service.-->
+        <ThriftEntitlementReceivePort>10500</ThriftEntitlementReceivePort>
+
+        <!--
+         This is the proxy port of the worker cluster. These need to be configured in a scenario where
+         manager node is not exposed through the load balancer through which the workers are exposed
+         therefore doesn't have a proxy port.
+        <WorkerHttpProxyPort>80</WorkerHttpProxyPort>
+        <WorkerHttpsProxyPort>443</WorkerHttpsProxyPort>
+        -->
+
+    </Ports>
+
+    <!--
+        JNDI Configuration
+    -->
+    <JNDI>
+        <!--
+             The fully qualified name of the default initial context factory
+        -->
+        <DefaultInitialContextFactory>org.wso2.carbon.tomcat.jndi.CarbonJavaURLContextFactory</DefaultInitialContextFactory>
+        <!--
+             The restrictions that are done to various JNDI Contexts in a Multi-tenant environment
+        -->
+        <Restrictions>
+            <!--
+                Contexts that will be available only to the super-tenant
+            -->
+            <!-- <SuperTenantOnly>
+                <UrlContexts>
+                    <UrlContext>
+                        <Scheme>foo</Scheme>
+                    </UrlContext>
+                    <UrlContext>
+                        <Scheme>bar</Scheme>
+                    </UrlContext>
+                </UrlContexts>
+            </SuperTenantOnly> -->
+            <!--
+                Contexts that are common to all tenants
+            -->
+            <AllTenants>
+                <UrlContexts>
+                    <UrlContext>
+                        <Scheme>java</Scheme>
+                    </UrlContext>
+                    <!-- <UrlContext>
+                        <Scheme>foo</Scheme>
+                    </UrlContext> -->
+                </UrlContexts>
+            </AllTenants>
+            <!--
+                 All other contexts not mentioned above will be available on a per-tenant basis
+                 (i.e. will not be shared among tenants)
+            -->
+        </Restrictions>
+    </JNDI>
+
+    <!--
+        Property to determine if the server is running an a cloud deployment environment.
+        This property should only be used to determine deployment specific details that are
+        applicable only in a cloud deployment, i.e when the server deployed *-as-a-service.
+    -->
+    <IsCloudDeployment>false</IsCloudDeployment>
+
+    <!--
+	Property to determine whether usage data should be collected for metering purposes
+    -->
+    <EnableMetering>false</EnableMetering>
+
+    <!-- The Max time a thread should take for execution in seconds -->
+    <MaxThreadExecutionTime>600</MaxThreadExecutionTime>
+
+    <!--
+        A flag to enable or disable Ghost Deployer. By default this is set to false. That is
+        because the Ghost Deployer works only with the HTTP/S transports. If you are using
+        other transports, don't enable Ghost Deployer.
+    -->
+    <GhostDeployment>
+        <Enabled>false</Enabled>
+    </GhostDeployment>
+
+
+    <!--
+        Eager loading or lazy loading is a design pattern commonly used in computer programming which
+        will initialize an object upon creation or load on-demand. In carbon, lazy loading is used to
+        load tenant when a request is received only. Similarly Eager loading is used to enable load
+        existing tenants after carbon server starts up. Using this feature, you will be able to include
+        or exclude tenants which are to be loaded when server startup.
+
+        We can enable only one LoadingPolicy at a given time.
+
+        1. Tenant Lazy Loading
+           This is the default behaviour and enabled by default. With this policy, tenants are not loaded at
+           server startup, but loaded based on-demand (i.e when a request is received for a tenant).
+           The default tenant idle time is 30 minutes.
+
+        2. Tenant Eager Loading
+           This is by default not enabled. It can be be enabled by un-commenting the <EagerLoading> section.
+           The eager loading configurations supported are as below. These configurations can be given as the
+           value for <Include> element with eager loading.
+                (i)Load all tenants when server startup             -   *
+                (ii)Load all tenants except foo.com & bar.com       -   *,!foo.com,!bar.com
+                (iii)Load only foo.com &  bar.com to be included    -   foo.com,bar.com
+    -->
+    <Tenant>
+        <LoadingPolicy>
+            <LazyLoading>
+                <IdleTime>30</IdleTime>
+            </LazyLoading>
+            <!-- <EagerLoading>
+                   <Include>*,!foo.com,!bar.com</Include>
+            </EagerLoading>-->
+        </LoadingPolicy>
+    </Tenant>
+
+    <!--
+     Caching related configurations
+    -->
+    <Cache>
+        <!-- Default cache timeout in minutes -->
+        <DefaultCacheTimeout>15</DefaultCacheTimeout>
+    </Cache>
+
+    <!--
+    Axis2 related configurations
+    -->
+    <Axis2Config>
+        <!--
+             Location of the Axis2 Services & Modules repository
+
+             This can be a directory in the local file system, or a URL.
+
+             e.g.
+             1. /home/wso2wsas/repository/ - An absolute path
+             2. repository - In this case, the path is relative to CARBON_HOME
+             3. file:///home/wso2wsas/repository/
+             4. http://wso2wsas/repository/
+        -->
+        <RepositoryLocation>${carbon.home}/repository/deployment/server/</RepositoryLocation>
+
+        <!--
+         Deployment update interval in seconds. This is the interval between repository listener
+         executions.
+        -->
+        <DeploymentUpdateInterval>15</DeploymentUpdateInterval>
+
+        <!--
+            Location of the main Axis2 configuration descriptor file, a.k.a. axis2.xml file
+
+            This can be a file on the local file system, or a URL
+
+            e.g.
+            1. /home/repository/axis2.xml - An absolute path
+            2. conf/axis2.xml - In this case, the path is relative to CARBON_HOME
+            3. file:///home/carbon/repository/axis2.xml
+            4. http://repository/conf/axis2.xml
+        -->
+        <ConfigurationFile>${carbon.home}/repository/conf/axis2/axis2.xml</ConfigurationFile>
+
+        <!--
+          ServiceGroupContextIdleTime, which will be set in ConfigurationContex
+          for multiple clients which are going to access the same ServiceGroupContext
+          Default Value is 30 Sec.
+        -->
+        <ServiceGroupContextIdleTime>30000</ServiceGroupContextIdleTime>
+
+        <!--
+          This repository location is used to crete the client side configuration
+          context used by the server when calling admin services.
+        -->
+        <ClientRepositoryLocation>${carbon.home}/repository/deployment/client/</ClientRepositoryLocation>
+        <!-- This axis2 xml is used in createing the configuration context by the FE server
+         calling to BE server -->
+        <clientAxis2XmlLocation>${carbon.home}/repository/conf/axis2/axis2_client.xml</clientAxis2XmlLocation>
+        <!-- If this parameter is set, the ?wsdl on an admin service will not give the admin service wsdl. -->
+        <HideAdminServiceWSDLs>true</HideAdminServiceWSDLs>
+
+        <!--WARNING-Use With Care! Uncommenting bellow parameter would expose all AdminServices in HTTP transport.
+        With HTTP transport your credentials and data routed in public channels are vulnerable for sniffing attacks.
+        Use bellow parameter ONLY if your communication channels are confirmed to be secured by other means -->
+        <!--HttpAdminServices>*</HttpAdminServices-->
+
+    </Axis2Config>
+
+    <!--
+       The default user roles which will be created when the server
+       is started up for the first time.
+    -->
+    <ServiceUserRoles>
+        <Role>
+            <Name>admin</Name>
+            <Description>Default Administrator Role</Description>
+        </Role>
+        <Role>
+            <Name>user</Name>
+            <Description>Default User Role</Description>
+        </Role>
+    </ServiceUserRoles>
+
+    <!--
+      Enable following config to allow Emails as usernames.
+    -->
+    <!--EnableEmailUserName>true</EnableEmailUserName-->
+
+    <!--
+      Security configurations
+    -->
+    <Security>
+        <!--
+            KeyStore which will be used for encrypting/decrypting passwords
+            and other sensitive information.
+        -->
+        <!-- KeyStore configurations for super tenant.-->
+        <KeyStore>
+            <!-- Keystore file location-->
+            <Location>${carbon.home}/repository/resources/security/wso2carbon.p12</Location>
+            <!-- Keystore type (JKS/PKCS12 etc.)-->
+            <Type>PKCS12</Type>
+            <!-- Keystore password-->
+            <Password>wso2carbon</Password>
+            <!-- Private Key alias-->
+            <KeyAlias>wso2carbon</KeyAlias>
+            <!-- Private Key password-->
+            <KeyPassword>wso2carbon</KeyPassword>
+        </KeyStore>
+        <!-- KeyStore configurations for newly created tenants (not applicable to existing tenants). -->
+        <TenantKeyStore>
+            <!-- Keystore type (JKS/PKCS12 etc.)-->
+            <Type>PKCS12</Type>
+        </TenantKeyStore>
+
+        <!--
+            System wide trust-store which is used to maintain the certificates of all
+            the trusted parties.
+        -->
+        <TrustStore>
+            <!-- trust-store file location -->
+            <Location>${carbon.home}/repository/resources/security/client-truststore.p12</Location>
+            <!-- trust-store type (JKS/PKCS12 etc.) -->
+            <Type>PKCS12</Type>
+            <!-- trust-store password -->
+            <Password>wso2carbon</Password>
+        </TrustStore>
+
+        // Custom KeyStore configurations for KeyStoreUtilTest test cases.
+        <CustomKeyStores>
+            <KeyStore>
+                <!-- Keystore file location-->
+                <Location>${carbon.home}/repository/resources/security/custom.jks</Location>
+                <!-- Keystore type (JKS/PKCS12 etc.)-->
+                <Type>JKS</Type>
+                <!-- Keystore password-->
+                <Password>customPassword</Password>
+                <!-- Private Key alias-->
+                <KeyAlias>customAlias</KeyAlias>
+                <!-- Private Key password-->
+                <KeyPassword>customKeyPass</KeyPassword>
+            </KeyStore>
+            <KeyStore>
+                <!-- Keystore file location-->
+                <Location>${carbon.home}/repository/resources/security/testKey.jks</Location>
+                <!-- Keystore type (JKS/PKCS12 etc.)-->
+                <Type>JKS</Type>
+                <!-- Keystore password-->
+                <Password>testPass</Password>
+                <!-- Private Key alias-->
+                <KeyAlias>testKey</KeyAlias>
+                <!-- Private Key password-->
+                <KeyPassword>testKeyPass</KeyPassword>
+            </KeyStore>
+        </CustomKeyStores>
+
+        <!--
+            The Authenticator configuration to be used at the JVM level. We extend the
+            java.net.Authenticator to make it possible to authenticate to given servers and
+            proxies.
+        -->
+        <NetworkAuthenticatorConfig>
+            <!--
+                Below is a sample configuration for a single authenticator. Please note that
+                all child elements are mandatory. Not having some child elements would lead to
+                exceptions at runtime.
+            -->
+            <!-- <Credential> -->
+            <!--
+                the pattern that would match a subset of URLs for which this authenticator
+                would be used
+            -->
+            <!-- <Pattern>regularExpression</Pattern> -->
+            <!--
+                the type of this authenticator. Allowed values are:
+                1. server
+                2. proxy
+            -->
+            <!-- <Type>proxy</Type> -->
+            <!-- the username used to log in to server/proxy -->
+            <!-- <Username>username</Username> -->
+            <!-- the password used to log in to server/proxy -->
+            <!-- <Password>password</Password> -->
+            <!-- </Credential> -->
+        </NetworkAuthenticatorConfig>
+
+        <!--
+         The Tomcat realm to be used for hosted Web applications. Allowed value is UserManager.
+         If this is set to 'UserManager', the realm will pick users & roles from the system's
+         WSO2 User Manager.
+        -->
+        <TomcatRealm>UserManager</TomcatRealm>
+
+        <!--Option to disable storing of tokens issued by STS-->
+        <DisableTokenStore>false</DisableTokenStore>
+
+        <!--
+         Security token store class name. If this is not set, default class will be
+         org.wso2.carbon.security.util.SecurityTokenStore
+        -->
+        <!--TokenStoreClassName>org.wso2.carbon.identity.sts.store.DBTokenStore</TokenStoreClassName-->
+
+        <XSSPreventionConfig>
+            <Enabled>true</Enabled>
+            <Rule>allow</Rule>
+            <Patterns>
+                <!--Pattern></Pattern-->
+            </Patterns>
+        </XSSPreventionConfig>
+    </Security>
+
+    <!--Hide unnecessary menu Items-->
+    <HideMenuItemIds>
+        <HideMenuItemId>claim_mgt_menu</HideMenuItemId>
+        <HideMenuItemId>identity_mgt_emailtemplate_menu</HideMenuItemId>
+        <HideMenuItemId>identity_security_questions_menu</HideMenuItemId>
+    </HideMenuItemIds>
+
+    <!--
+       The temporary work directory
+    -->
+    <WorkDirectory>${carbon.home}/tmp/work</WorkDirectory>
+
+    <!--
+       House-keeping configuration
+    -->
+    <HouseKeeping>
+
+        <!--
+           true  - Start House-keeping thread on server startup
+           false - Do not start House-keeping thread on server startup.
+                   The user will run it manually as and when he wishes.
+        -->
+        <AutoStart>true</AutoStart>
+
+        <!--
+           The interval in *minutes*, between house-keeping runs
+        -->
+        <Interval>10</Interval>
+
+        <!--
+          The maximum time in *minutes*, temp files are allowed to live
+          in the system. Files/directories which were modified more than
+          "MaxTempFileLifetime" minutes ago will be removed by the
+          house-keeping task
+        -->
+        <MaxTempFileLifetime>30</MaxTempFileLifetime>
+    </HouseKeeping>
+
+    <!--
+       Configuration for handling different types of file upload & other file uploading related
+       config parameters.
+       To map all actions to a particular FileUploadExecutor, use
+       <Action>*</Action>
+    -->
+    <FileUploadConfig>
+        <!--
+           The total file upload size limit in MB
+        -->
+        <TotalFileSizeLimit>100</TotalFileSizeLimit>
+
+        <Mapping>
+            <Actions>
+                <Action>dbs</Action>
+            </Actions>
+            <Class>org.wso2.carbon.ui.transports.fileupload.DBSFileUploadExecutor</Class>
+        </Mapping>
+    </FileUploadConfig>
+
+    <!-- FileNameRegEx is used to validate the file input/upload/write-out names.
+    e.g.
+     <FileNameRegEx>^(?!(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.[^.])?$)[^&lt;&gt:"/\\|?*\x00-\x1F][^&lt;&gt:"/\\|?*\x00-\x1F\ .]$</FileNameRegEx>
+    -->
+    <!--<FileNameRegEx></FileNameRegEx>-->
+
+    <!--
+       Processors which process special HTTP GET requests such as ?wsdl, ?policy etc.
+
+       In order to plug in a processor to handle a special request, simply add an entry to this
+       section.
+
+       The value of the Item element is the first parameter in the query string(e.g. ?wsdl)
+       which needs special processing
+
+       The value of the Class element is a class which implements
+       org.wso2.carbon.transport.HttpGetRequestProcessor
+    -->
+    <HttpGetRequestProcessors>
+        <Processor>
+            <Item>info</Item>
+            <Class>org.wso2.carbon.core.transports.util.InfoProcessor</Class>
+        </Processor>
+        <Processor>
+            <Item>wsdl</Item>
+            <Class>org.wso2.carbon.core.transports.util.Wsdl11Processor</Class>
+        </Processor>
+        <Processor>
+            <Item>wsdl2</Item>
+            <Class>org.wso2.carbon.core.transports.util.Wsdl20Processor</Class>
+        </Processor>
+        <Processor>
+            <Item>xsd</Item>
+            <Class>org.wso2.carbon.core.transports.util.XsdProcessor</Class>
+        </Processor>
+    </HttpGetRequestProcessors>
+
+    <!-- Deployment Synchronizer Configuration. Enable value to true when running with "svn based" dep sync.
+	In master nodes you need to set both AutoCommit and AutoCheckout to true
+	and in  worker nodes set only AutoCheckout to true.
+    -->
+    <DeploymentSynchronizer>
+        <Enabled>false</Enabled>
+        <AutoCommit>false</AutoCommit>
+        <AutoCheckout>true</AutoCheckout>
+        <RepositoryType>svn</RepositoryType>
+        <SvnUrl>http://svnrepo.example.com/repos/</SvnUrl>
+        <SvnUser>username</SvnUser>
+        <SvnPassword>password</SvnPassword>
+        <SvnUrlAppendTenantId>true</SvnUrlAppendTenantId>
+    </DeploymentSynchronizer>
+
+    <!-- Deployment Synchronizer Configuration. Uncomment the following section when running with "registry based" dep sync.
+        In master nodes you need to set both AutoCommit and AutoCheckout to true
+        and in  worker nodes set only AutoCheckout to true.
+    -->
+    <!--<DeploymentSynchronizer>
+        <Enabled>true</Enabled>
+        <AutoCommit>false</AutoCommit>
+        <AutoCheckout>true</AutoCheckout>
+    </DeploymentSynchronizer>-->
+
+    <!-- Mediation persistence configurations. Only valid if mediation features are available i.e. ESB -->
+    <!--<MediationConfig>
+        <LoadFromRegistry>false</LoadFromRegistry>
+        <SaveToFile>false</SaveToFile>
+        <Persistence>enabled</Persistence>
+        <RegistryPersistence>enabled</RegistryPersistence>
+    </MediationConfig>-->
+
+    <!--
+    Server intializing code, specified as implementation classes of org.wso2.carbon.core.ServerInitializer.
+    This code will be run when the Carbon server is initialized
+    -->
+    <ServerInitializers>
+        <!--<Initializer></Initializer>-->
+    </ServerInitializers>
+
+    <!--
+    Indicates whether the Carbon Servlet is required by the system, and whether it should be
+    registered
+    -->
+    <RequireCarbonServlet>${require.carbon.servlet}</RequireCarbonServlet>
+
+    <!--Disabling statistics reporter by default-->
+    <StatisticsReporterDisabled>true</StatisticsReporterDisabled>
+
+    <!-- Enable accessing Admin Console via HTTP -->
+    <!-- EnableHTTPAdminConsole>true</EnableHTTPAdminConsole -->
+
+    <!--
+       Default Feature Repository of WSO2 Carbon.
+    -->
+    <FeatureRepository>
+        <RepositoryName>default repository</RepositoryName>
+        <RepositoryURL>http://product-dist.wso2.com/p2/carbon/releases/wilkes/</RepositoryURL>
+    </FeatureRepository>
+
+    <!--
+	Configure API Management
+   -->
+    <APIManagement>
+
+        <!--Uses the embedded API Manager by default. If you want to use an external
+        API Manager instance to manage APIs, configure below  externalAPIManager-->
+
+        <Enabled>true</Enabled>
+
+        <!--Uncomment and configure API Gateway and
+        Publisher URLs to use external API Manager instance-->
+
+        <!--ExternalAPIManager>
+
+            <APIGatewayURL>http://localhost:8281</APIGatewayURL>
+            <APIPublisherURL>http://localhost:8281/publisher</APIPublisherURL>
+
+        </ExternalAPIManager-->
+
+        <LoadAPIContextsInServerStartup>true</LoadAPIContextsInServerStartup>
+    </APIManagement>
+</Server>
diff --git a/core/org.wso2.carbon.core/src/test/resources/testng.xml b/core/org.wso2.carbon.core/src/test/resources/testng.xml
index 9e60b4c8c4c..212781ea3e5 100644
--- a/core/org.wso2.carbon.core/src/test/resources/testng.xml
+++ b/core/org.wso2.carbon.core/src/test/resources/testng.xml
@@ -24,6 +24,7 @@
         <classes>
             <class name="org.wso2.carbon.core.dependencies.commons.collections.TestInvokerTransformer"/>
             <class name="org.wso2.carbon.core.multitenancy.transports.TenantTransportSender"/>
+            <class name="org.wso2.carbon.core.util.KeyStoreUtilTest"/>
         </classes>
     </test>
 </suite>
\ No newline at end of file
diff --git a/distribution/kernel/carbon-home/repository/resources/conf/templates/repository/conf/carbon.xml.j2 b/distribution/kernel/carbon-home/repository/resources/conf/templates/repository/conf/carbon.xml.j2
index 8c51678080b..974389bd98d 100644
--- a/distribution/kernel/carbon-home/repository/resources/conf/templates/repository/conf/carbon.xml.j2
+++ b/distribution/kernel/carbon-home/repository/resources/conf/templates/repository/conf/carbon.xml.j2
@@ -554,6 +554,25 @@
             <!-- Private Key password-->
             <KeyPassword>{{keystore.saml.key_password}}</KeyPassword>
         </SAMLSignKeyStore>
+        {% if keystore.custom is defined %}
+
+        <CustomKeyStores>
+            {% for keystore in keystore.custom %}
+            <KeyStore>
+                <!-- Keystore file location-->
+                <Location>${carbon.home}/repository/resources/security/{{keystore.file_name}}</Location>
+                <!-- Keystore type (JKS/PKCS12 etc.)-->
+                <Type>{{keystore.type}}</Type>
+                <!-- Keystore password-->
+                <Password>{{keystore.password}}</Password>
+                <!-- Private Key alias-->
+                <KeyAlias>{{keystore.alias}}</KeyAlias>
+                <!-- Private Key password-->
+                <KeyPassword>{{keystore.key_password}}</KeyPassword>
+            </KeyStore>
+            {% endfor %}
+        </CustomKeyStores>
+        {% endif %}
 
         <UserStorePasswordEncryption>{{keystore.userstore_password_encryption}}</UserStorePasswordEncryption>