diff --git a/src/test/resources/testsuite.properties b/src/test/resources/testsuite.properties
index c7da597..086988d 100644
--- a/src/test/resources/testsuite.properties
+++ b/src/test/resources/testsuite.properties
@@ -39,7 +39,7 @@
         -Djavax.net.ssl.keyStorePassword=changeit \
         -Djavax.net.ssl.trustStore=${keystores.dir}/ssl-truststore \
         -Djavax.net.ssl.trustStorePassword=changeit \
-        -Djava.endorsed.dirs=${s1as.java.endorsed.dirs}${pathsep}${ts.home}/endorsedlib \
+        ${command.testExecute.endorsed.dir} \
         -Dcom.sun.aas.installRoot=${javaee.home} \
         -Dcatalina.base=${openejb.home} \
         -Dlog.file.location=${log.file.location} \
@@ -50,6 +50,7 @@
         -Ddeliverable.class=${deliverable.class} \
         -Dopenejb.validation.output.level=3 \
         -Djava.security.egd=file:/dev/./urandom \
+        -Dbin.dir=%bin_dir% \
         $testExecuteClass \
         $testExecuteArgs
 
@@ -78,7 +79,7 @@
         ${JAVA_HOME}/bin/java \
         -javaagent:${openejb.home}/lib/openejb-javaagent.jar \
         ${command.testExecuteEmbedded.debugopts} \
-        -Djava.endorsed.dirs=${openejb.home}/endorsed \
+        ${command.testExecuteEjbEmbed.endorsed.dir} \
         -DDB1=new://Resource?type=DataSource \
         -DDB1.JdbcDriver=org.apache.derby.jdbc.ClientDriver \
         -DDB1.JdbcUrl=jdbc:derby://localhost:${derby.server.port}/derbydb;create=true \
@@ -199,7 +200,9 @@
 porting.ts.login.class.1=org.apache.openejb.cts.LoginContextImpl
 porting.ts.url.class.1=org.apache.openejb.cts.URLImpl
 
-sigTestClasspath=${s1as.modules}/javax.servlet.jar${pathsep}${s1as.modules}/javax.ejb.jar${pathsep}${endorsed.dirs}/javax.annotation.jar${pathsep}${s1as.modules}/javax.enterprise.deploy.jar${pathsep}${s1as.modules}/javax.mail.jar${pathsep}${s1as.modules}/javax.persistence.jar${pathsep}${s1as.modules}/javax.resource.jar${pathsep}${s1as.modules}/javax.security.auth.message.jar${pathsep}${s1as.modules}/javax.security.jacc.jar${pathsep}${s1as.modules}/javax.servlet.jsp.jar${pathsep}${s1as.modules}/javax.transaction.jar${pathsep}${endorsed.dirs}/jaxb-api-osgi.jar${pathsep}${s1as.modules}/jaxb-osgi.jar${pathsep}${s1as.modules}/jsf-api.jar${pathsep}${s1as.modules}/javax.servlet.jsp.jstl.jar${pathsep}${endorsed.dirs}/webservices-api-osgi.jar${pathsep}${s1as.modules}/jsr311-api.jar${pathsep}${s1as.modules}/javax.jms.jar${pathsep}${s1as.modules}/javax.management.j2ee.jar${pathsep}${s1as.modules}/ejb.security.jar${pathsep}${s1as.modules}/webservices-osgi.jar${pathsep}${FELIX_CLASSES}${pathsep}${JAVA_HOME}/lib/rt.jar${pathsep}${JAVA_HOME}/lib/jce.jar${pathsep}${s1as.modules}/bean-validator.jar
+jimage.dir=${ts.home}/tmp/jdk-bundles
+#sigTestClasspath=${s1as.modules}/javax.servlet.jar${pathsep}${s1as.modules}/javax.ejb.jar${pathsep}${endorsed.dirs}/javax.annotation.jar${pathsep}${s1as.modules}/javax.enterprise.deploy.jar${pathsep}${s1as.modules}/javax.mail.jar${pathsep}${s1as.modules}/javax.persistence.jar${pathsep}${s1as.modules}/javax.resource.jar${pathsep}${s1as.modules}/javax.security.auth.message.jar${pathsep}${s1as.modules}/javax.security.jacc.jar${pathsep}${s1as.modules}/javax.servlet.jsp.jar${pathsep}${s1as.modules}/javax.transaction.jar${pathsep}${endorsed.dirs}/jaxb-api-osgi.jar${pathsep}${s1as.modules}/jaxb-osgi.jar${pathsep}${s1as.modules}/jsf-api.jar${pathsep}${s1as.modules}/javax.servlet.jsp.jstl.jar${pathsep}${endorsed.dirs}/webservices-api-osgi.jar${pathsep}${s1as.modules}/jsr311-api.jar${pathsep}${s1as.modules}/javax.jms.jar${pathsep}${s1as.modules}/javax.management.j2ee.jar${pathsep}${s1as.modules}/ejb.security.jar${pathsep}${s1as.modules}/webservices-osgi.jar${pathsep}${FELIX_CLASSES}${pathsep}${JAVA_HOME}/lib/rt.jar${pathsep}${JAVA_HOME}/lib/jce.jar${pathsep}${s1as.modules}/bean-validator.jar
+sigTestClasspath=%openejb.jee.classes%
 
 ts.run.classpath=%ts.run.classpath%
 openejb.embedded.classpath=%openejb.embedded.classpath%
@@ -226,7 +229,7 @@
 
 harness.log.port=%harness.log.port%
 
-ws_wait=6
+# ws_wait=5
 javatest.timeout.factor=3.0
 
 imap.port = 3143
@@ -239,4 +242,5 @@
 j2eelogin.name=j2ee
 j2eelogin.password=j2ee
 servlet.is.jsr115.compatible=false
-logical.hostname.servlet=Catalina/localhost
\ No newline at end of file
+logical.hostname.servlet=Catalina/localhost
+bin.dir=%bin_dir%
diff --git a/src/test/script/openejb/tck/commands/CommandSupport.groovy b/src/test/script/openejb/tck/commands/CommandSupport.groovy
index 43f4f00..25621da 100644
--- a/src/test/script/openejb/tck/commands/CommandSupport.groovy
+++ b/src/test/script/openejb/tck/commands/CommandSupport.groovy
@@ -199,6 +199,8 @@
         builder.directory = openejbLib
         builder.appendAll("geronimo-*_spec-*.jar")
         builder.append("javaee-api-*.jar")
+        builder.directory = javaHome() +"/lib/"
+        builder.append("rt.jar")
         builder.getPath("openejb.jee.classes")
 
         // ts.run.classpath - used to run the appclient
@@ -291,6 +293,11 @@
         builder.getPath("openejb.embedded.classpath")
     }
 
+    private String javaHome() {
+        def file = new File(System.getProperty("java.home"))
+        return file.getAbsolutePath();
+    }
+
     def selectTests() {
         def builder = new TestListBuilder(this)
         return builder.getTests()
diff --git a/src/test/script/openejb/tck/commands/JavaTestCommand.groovy b/src/test/script/openejb/tck/commands/JavaTestCommand.groovy
index 17e5fff..6d9666c 100644
--- a/src/test/script/openejb/tck/commands/JavaTestCommand.groovy
+++ b/src/test/script/openejb/tck/commands/JavaTestCommand.groovy
@@ -204,6 +204,8 @@
                 if (tckJavaHome != null) {
                     log.info("Using java home (javatest) ${tckJavaHome}")
                     jvmarg(value: "-Dtck.java.home=${tckJavaHome}")
+                } else {
+                    tckJavaHome = javaHome
                 }
 
                 def tckJavaVersion = get('tck.java.version')
@@ -222,6 +224,8 @@
                 if (containerJavaHome != null) {
                     log.info("Using java home (container) ${containerJavaHome}")
                     jvmarg(value: "-Dcontainer.java.home=${containerJavaHome}")
+                } else {
+                    containerJavaHome = javaHome
                 }
 
                 def containerJavaVersion = get('container.java.version')
@@ -231,9 +235,17 @@
 
                 def containerJavaOpts = get('container.java.opts', "")
 
-                // force memory on tasks because with JDK 8 it's computed with a bit too much
-                containerJavaOpts += " -Xmx512m -Dtest.ejb.stateful.timeout.wait.seconds=60"
+                // not sure about this ....
+                if (tckJavaHome == null || !new File(tckJavaHome, 'jmods').exists()/*j9 doesnt support it*/) {
+                    sysproperty(key: "java.endorsed.dirs", file: "${javaeeRiHome}/lib/endorsed")
+                    sysproperty(key: "command.testExecute.endorsed.dir", value: "-Djava.endorsed.dirs=${javaeeCtsHome}/endorsedlib")
+                    sysproperty(key: "command.testExecuteEjbEmbed.endorsed.dir", value: "-Djava.endorsed.dirs=${openejbHome}/endorsed")
 
+                    containerJavaOpts += " -Djava.locale.providers=COMPAT"
+                }
+
+                // force memory on tasks because with JDK 8 it's computed with a bit too much
+                // containerJavaOpts += " -Xmx512m -Dtest.ejb.stateful.timeout.wait.seconds=60"
 
                 if (options.contains('security')) {
                     log.info("Enabling server security manager")
@@ -289,9 +301,6 @@
                 sysproperty(key: "java.security.policy", file: "${javaeeRiHome}/bin/harness.policy")
                 sysproperty(key: "J2EE_HOME_RI", file: javaeeRiHome)
                 sysproperty(key: "deliverable.class", value: require('deliverable.class'))
-                if (tckJavaHome == null || !new File(tckJavaHome, 'jmods').exists()/*j9 doesnt support it*/) {
-                    sysproperty(key: "java.endorsed.dirs", file: "${javaeeRiHome}/lib/endorsed")
-                }
                 sysproperty(key: "com.sun.enterprise.home", file: javaeeRiHome)
                 sysproperty(key: "com.sun.aas.installRoot", file: javaeeRiHome)
                 sysproperty(key: "DEPLOY_DELAY_IN_MINUTES", value: require('deploy_delay_in_minutes'))
@@ -332,6 +341,8 @@
                     sysproperty(key: "SYSTEMROOT", value: System.getenv('SystemRoot'))
                 }
 
+                sysproperty(key: "bin.dir", value: "${javaeeCtsHome}/bin")
+
                 // Include system properties
                 arg(value: "-EsysProps")
 
diff --git a/src/test/script/openejb/tck/commands/SetupCommand.groovy b/src/test/script/openejb/tck/commands/SetupCommand.groovy
index 87c03b4..6c889b9 100644
--- a/src/test/script/openejb/tck/commands/SetupCommand.groovy
+++ b/src/test/script/openejb/tck/commands/SetupCommand.groovy
@@ -51,6 +51,7 @@
                     'ts.run.classpath',
                     'ts.run.classpath.ri.suffix',
                     'ts.harness.classpath',
+                    'openejb.jee.classes',
                     'openejb.embedded.classpath',
                     'geronimo.specs.classpath',
                     'geronimo.porting.classes'
@@ -79,6 +80,9 @@
                     map['javaee.level'] = 'web'
                 }
 
+                log.info("Setting bin.dir to " + javaeeCtsHome.getAbsolutePath() + "/bin")
+                map['bin_dir'] = javaeeCtsHome.getAbsolutePath() + "/bin"
+
                 // map['servlet_adaptor'] = 'org.apache.cxf.jaxrs.servlet.CXFNonSpringJaxrsServlet'
                 map['servlet_adaptor'] = 'org.apache.openejb.server.rest.OpenEJBRestServlet'
                 map['jaxrs_impl_name'] = 'cxf'
diff --git a/src/test/tomcat/conf/server.xml b/src/test/tomcat/conf/server.xml
index 991f1a4..5cdf835 100644
--- a/src/test/tomcat/conf/server.xml
+++ b/src/test/tomcat/conf/server.xml
@@ -83,13 +83,16 @@
          This connector uses the JSSE configuration, when using APR, the
          connector should be using the OpenSSL style configuration
          described in the APR documentation -->
-    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
-               maxThreads="150" scheme="https" secure="true"
-               clientAuth="false" sslProtocol="TLS"
-               keystoreFile="conf/clientcert.jks"/>
+    <Connector port="%webcontainer.default.ssl.port%" protocol="HTTP/1.1" SSLEnabled="true">
+      <SSLHostConfig truststoreFile="conf/ssl-truststore">
+        <Certificate certificateKeystoreFile="conf/clientcert.jks"
+                     certificateKeystorePassword="changeit"
+                     type="RSA" />
+      </SSLHostConfig>
+    </Connector>
 
     <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/>
+    <!-- <Connector port="%tomee.ajp.port%" protocol="AJP/1.3" redirectPort="%tomee.ssl.port%" /> -->
 
 
     <!-- An Engine represents the entry point (within Catalina) that processes
diff --git a/src/test/tomee-plume/conf/catalina.policy b/src/test/tomee-plume/conf/catalina.policy
index 4fb8777..fcc2572 100644
--- a/src/test/tomee-plume/conf/catalina.policy
+++ b/src/test/tomee-plume/conf/catalina.policy
@@ -171,22 +171,25 @@
     permission java.util.PropertyPermission "openejb.*", "read";
     permission java.util.PropertyPermission "user.name", "read";
     permission java.util.PropertyPermission "java.io.tmpdir", "read";
-    permission java.io.FilePermission "${catalina.base}/lib/-", "read"; // java ee api class, slf4j, owb, etc
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.loader"; // tomee
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.core"; // tomee
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.realm"; // tomee
-    permission java.lang.RuntimePermission "setContextClassLoader"; // tomee
+    permission java.io.FilePermission "${catalina.base}/lib/-", "read"; // java ee api class, slf4j, owb, etc
     permission java.lang.RuntimePermission "accessDeclaredMembers"; // owb
     permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; // owb
     permission java.net.SocketPermission "localhost", "connect,resolve"; // jndi
     permission java.net.SocketPermission "127.0.0.1", "connect,resolve"; // jndi
-    permission javax.security.auth.AuthPermission "doAsPrivileged"; // tomee security
     permission javax.security.auth.AuthPermission "modifyPrincipals"; // tomee security
     permission javax.security.auth.AuthPermission "modifyPrivateCredentials"; // tomee security
 
     // TomEE for CTS classes in webapps
     permission java.io.FilePermission "${cts.home}/dist/-", "read";
 
+    // weird on ec2, it does not seem to work well for security api
+    // try a small hard coded version
+    permission java.io.FilePermission "/home/ec2-user/-", "read";
+    permission java.io.FilePermission "/home/ec2-user/jakartaeetck-9.1.0-2021-04-20.1739/dist/com/sun/ts/tests/securityapi/idstore/idstorepermission/securityapi_idstore_idstorepermission/securityapi_idstore_idstorepermission_web/-", "read";
+
     // Required for OpenJMX
     permission java.lang.RuntimePermission "getAttribute";
 
@@ -300,11 +303,18 @@
     permission java.io.FilePermission "${catalina.base}/temp/-", "read,write";
     permission java.io.FilePermission "${catalina.base}/logs/-", "read,write";
     permission java.io.FilePermission "${catalina.base}/work/-", "read,write";
+
+    // weird on ec2, it does not seem to work well for security api
+    // try a small hard coded version
+    permission java.io.FilePermission "/home/ec2-user/-", "read";
+    permission java.io.FilePermission "/home/ec2-user/jakartaeetck-9.1.0-2021-04-20.1739/dist/com/sun/ts/tests/securityapi/idstore/idstorepermission/securityapi_idstore_idstorepermission/securityapi_idstore_idstorepermission_web/-", "read";
+
     permission java.util.PropertyPermission "*", "read,write"; // the log file
     permission java.security.SecurityPermission "getProperty.authconfigprovider.factory";
     permission java.security.SecurityPermission "setProperty.authconfigprovider.factory";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.authenticator.jaspic";
     permission java.util.logging.LoggingPermission "control";
+    permission java.net.SocketPermission "*", "connect,resolve"; // logger
 };
 grant codeBase "file:${cts.home}/dist/com/sun/ts/tests/servlet/ee/spec/security/permissiondd/servlet_ee_spec_security_permissiondd_web/-" {
     permission java.util.PropertyPermission "cts.*", "read";
diff --git a/src/test/tomee-plume/conf/system.properties b/src/test/tomee-plume/conf/system.properties
index fe18b1b..0fff9ca 100644
--- a/src/test/tomee-plume/conf/system.properties
+++ b/src/test/tomee-plume/conf/system.properties
@@ -188,3 +188,5 @@
 #
 #EOF
 #done
+
+jpa_ee_packaging_ejb_standalone_client.jar.moduleId=jpa_ee_packaging_ejb_standalone_ejb_client