ECDR-35 removed all the code that leveraged the custom CDR security/ssl-config bundle.  DDF ticket DDF-799 will set the Java system properties with the keystore and truststore details, and HTTPS clients will leverage those.  There is one exception where CXF doesn't honor the keystore details, so if you have a 2-way SSL client, you need to specifically set hte keystore in the TlsClientParameter.  We still do that in the CDR Source.