diff --git a/contrib/postgres_proxy/filters/network/test/postgres_integration_test.cc b/contrib/postgres_proxy/filters/network/test/postgres_integration_test.cc
index f027cfec10742..fb47ccde35d00 100644
--- a/contrib/postgres_proxy/filters/network/test/postgres_integration_test.cc
+++ b/contrib/postgres_proxy/filters/network/test/postgres_integration_test.cc
@@ -295,8 +295,7 @@ class UpstreamSSLBaseIntegrationTest : public PostgresBaseIntegrationTest {
     // The tls transport socket will be inserted into fake_upstream when
     // Envoy's upstream starttls transport socket is converted to secure mode.
     std::unique_ptr<Ssl::ContextManager> tls_context_manager =
-        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-            server_factory_context_);
+        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
 
     envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext downstream_tls_context;
 
@@ -528,8 +527,7 @@ class UpstreamAndDownstreamSSLIntegrationTest : public UpstreamSSLBaseIntegratio
     // The tls transport socket will be inserted into fake_upstream when
     // Envoy's upstream starttls transport socket is converted to secure mode.
     std::unique_ptr<Ssl::ContextManager> tls_context_manager =
-        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-            server_factory_context_);
+        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
 
     envoy::extensions::transport_sockets::tls::v3::UpstreamTlsContext upstream_tls_context;
 
diff --git a/envoy/server/factory_context.h b/envoy/server/factory_context.h
index f6a34d53cf87d..8a139fbcb0c4b 100644
--- a/envoy/server/factory_context.h
+++ b/envoy/server/factory_context.h
@@ -36,11 +36,6 @@
 #include "source/common/protobuf/protobuf.h"
 
 namespace Envoy {
-
-namespace Regex {
-class Engine;
-}
-
 namespace Server {
 namespace Configuration {
 
@@ -134,11 +129,6 @@ class CommonFactoryContext {
    * @return ServerLifecycleNotifier& the lifecycle notifier for the server.
    */
   virtual ServerLifecycleNotifier& lifecycleNotifier() PURE;
-
-  /**
-   * @return the server regex engine.
-   */
-  virtual Regex::Engine& regexEngine() PURE;
 };
 
 /**
diff --git a/envoy/server/instance.h b/envoy/server/instance.h
index a6fe23cd4c753..683fef31b60df 100644
--- a/envoy/server/instance.h
+++ b/envoy/server/instance.h
@@ -253,11 +253,6 @@ class Instance {
    */
   virtual Configuration::StatsConfig& statsConfig() PURE;
 
-  /**
-   * @return the server regex engine.
-   */
-  virtual Regex::Engine& regexEngine() PURE;
-
   /**
    * @return envoy::config::bootstrap::v3::Bootstrap& the servers bootstrap configuration.
    */
diff --git a/envoy/ssl/context_manager.h b/envoy/ssl/context_manager.h
index 1cd6f40544728..8c7fae3707b28 100644
--- a/envoy/ssl/context_manager.h
+++ b/envoy/ssl/context_manager.h
@@ -10,13 +10,6 @@
 #include "envoy/stats/scope.h"
 
 namespace Envoy {
-
-namespace Server {
-namespace Configuration {
-class CommonFactoryContext;
-} // namespace Configuration
-} // namespace Server
-
 namespace Ssl {
 
 // Opaque type defined and used by the ``ServerContext``.
@@ -80,8 +73,7 @@ using ContextManagerPtr = std::unique_ptr<ContextManager>;
 class ContextManagerFactory : public Config::UntypedFactory {
 public:
   ~ContextManagerFactory() override = default;
-  virtual ContextManagerPtr
-  createContextManager(Server::Configuration::CommonFactoryContext& factory_context) PURE;
+  virtual ContextManagerPtr createContextManager(TimeSource& time_source) PURE;
 
   // There could be only one factory thus the name is static.
   std::string name() const override { return "ssl_context_manager"; }
diff --git a/mobile/library/common/extensions/cert_validator/platform_bridge/config.cc b/mobile/library/common/extensions/cert_validator/platform_bridge/config.cc
index 807ec2dcfef73..223e6ff8e925e 100644
--- a/mobile/library/common/extensions/cert_validator/platform_bridge/config.cc
+++ b/mobile/library/common/extensions/cert_validator/platform_bridge/config.cc
@@ -9,7 +9,7 @@ namespace Tls {
 
 CertValidatorPtr PlatformBridgeCertValidatorFactory::createCertValidator(
     const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-    Server::Configuration::CommonFactoryContext& /*context*/) {
+    TimeSource& /*time_source*/) {
   return std::make_unique<PlatformBridgeCertValidator>(config, stats);
 }
 
diff --git a/mobile/library/common/extensions/cert_validator/platform_bridge/config.h b/mobile/library/common/extensions/cert_validator/platform_bridge/config.h
index d070c3fc99af5..bc884fddc3ac9 100644
--- a/mobile/library/common/extensions/cert_validator/platform_bridge/config.h
+++ b/mobile/library/common/extensions/cert_validator/platform_bridge/config.h
@@ -15,9 +15,8 @@ namespace Tls {
 class PlatformBridgeCertValidatorFactory : public CertValidatorFactory,
                                            public Config::TypedFactory {
 public:
-  CertValidatorPtr
-  createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                      Server::Configuration::CommonFactoryContext& context) override;
+  CertValidatorPtr createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config,
+                                       SslStats& stats, TimeSource& time_source) override;
 
   std::string name() const override {
     return "envoy_mobile.cert_validator.platform_bridge_cert_validator";
diff --git a/mobile/test/common/integration/BUILD b/mobile/test/common/integration/BUILD
index e2fd61c2abda3..a60cc0281793b 100644
--- a/mobile/test/common/integration/BUILD
+++ b/mobile/test/common/integration/BUILD
@@ -184,7 +184,6 @@ envoy_cc_test_library(
         "@envoy//source/exe:process_wide_lib",
         "@envoy//test/integration:autonomous_upstream_lib",
         "@envoy//test/integration:utility_lib",
-        "@envoy//test/mocks/server:server_factory_context_mocks",
         "@envoy//test/mocks/server:transport_socket_factory_context_mocks",
         "@envoy//test/test_common:environment_lib",
         "@envoy_build_config//:extension_registry",
@@ -214,7 +213,6 @@ envoy_cc_test_library(
         "@envoy//source/exe:process_wide_lib",
         "@envoy//test/integration:autonomous_upstream_lib",
         "@envoy//test/integration:utility_lib",
-        "@envoy//test/mocks/server:server_factory_context_mocks",
         "@envoy//test/mocks/server:transport_socket_factory_context_mocks",
         "@envoy//test/test_common:environment_lib",
         "@envoy_api//envoy/extensions/transport_sockets/tls/v3:pkg_cc_proto",
diff --git a/mobile/test/common/integration/test_server.cc b/mobile/test/common/integration/test_server.cc
index 6e840f9c8545b..5c478560fa556 100644
--- a/mobile/test/common/integration/test_server.cc
+++ b/mobile/test/common/integration/test_server.cc
@@ -25,7 +25,7 @@ namespace Envoy {
 Network::DownstreamTransportSocketFactoryPtr TestServer::createQuicUpstreamTlsContext(
     testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext>& factory_context) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context;
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager{time_system_};
   tls_context.mutable_common_tls_context()->add_alpn_protocols("h3");
   envoy::extensions::transport_sockets::tls::v3::TlsCertificate* certs =
       tls_context.mutable_common_tls_context()->add_tls_certificates();
diff --git a/mobile/test/common/integration/test_server.h b/mobile/test/common/integration/test_server.h
index 6c7c0506b6f01..dc3e7786e87e8 100644
--- a/mobile/test/common/integration/test_server.h
+++ b/mobile/test/common/integration/test_server.h
@@ -8,7 +8,6 @@
 
 #include "envoy/extensions/transport_sockets/quic/v3/quic_transport.pb.h"
 #include "test/integration/autonomous_upstream.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/server/transport_socket_factory_context.h"
 #include "test/integration/server.h"
 
@@ -27,7 +26,6 @@ enum class TestServerType {
 class TestServer : public ListenerHooks {
 private:
   testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context_;
-  testing::NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
   Stats::IsolatedStoreImpl stats_store_;
   Event::GlobalTimeSystem time_system_;
   Api::ApiPtr api_;
@@ -37,7 +35,7 @@ class TestServer : public ListenerHooks {
   Thread::SkipAsserts skip_asserts_;
   ProcessWide process_wide;
   Thread::MutexBasicLockable lock;
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{time_system_};
   std::unique_ptr<bazel::tools::cpp::runfiles::Runfiles> runfiles_;
 
   // Either test_server_ will be set for test_server_type is a proxy, otherwise upstream_ will be
diff --git a/mobile/test/common/integration/xds_test_server.h b/mobile/test/common/integration/xds_test_server.h
index f00bc8cb4030a..de2fa12527212 100644
--- a/mobile/test/common/integration/xds_test_server.h
+++ b/mobile/test/common/integration/xds_test_server.h
@@ -7,7 +7,6 @@
 
 #include "test/integration/fake_upstream.h"
 #include "test/integration/server.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/server/transport_socket_factory_context.h"
 #include "test/test_common/test_time.h"
 
@@ -37,7 +36,6 @@ class XdsTestServer {
 
 private:
   testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context_;
-  testing::NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
   Stats::IsolatedStoreImpl stats_store_;
   Event::GlobalTimeSystem time_system_;
   Api::ApiPtr api_;
@@ -46,7 +44,7 @@ class XdsTestServer {
   Event::DispatcherPtr dispatcher_;
   FakeUpstreamConfig upstream_config_;
   Thread::MutexBasicLockable lock_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{time_system_};
   std::unique_ptr<bazel::tools::cpp::runfiles::Runfiles> runfiles_;
   std::unique_ptr<FakeUpstream> xds_upstream_;
   FakeHttpConnectionPtr xds_connection_;
diff --git a/mobile/test/common/integration/xds_test_server_interface.cc b/mobile/test/common/integration/xds_test_server_interface.cc
index d4476e7683274..12152d5d90711 100644
--- a/mobile/test/common/integration/xds_test_server_interface.cc
+++ b/mobile/test/common/integration/xds_test_server_interface.cc
@@ -12,10 +12,6 @@ static std::weak_ptr<Envoy::XdsTestServer> weak_test_server_;
 static std::shared_ptr<Envoy::XdsTestServer> testServer() { return weak_test_server_.lock(); }
 
 void initXdsServer() {
-  // This is called via JNI from kotlin tests, and Envoy doesn't consider it a test thread
-  // which triggers some failures of `ASSERT_IS_MAIN_OR_TEST_THREAD()`.
-  Envoy::Thread::SkipAsserts skip;
-
   Envoy::ExtensionRegistry::registerFactories();
   strong_test_server_ = std::make_shared<Envoy::XdsTestServer>();
   weak_test_server_ = strong_test_server_;
diff --git a/source/common/common/matchers.cc b/source/common/common/matchers.cc
index 4dded56b26f04..d69fe3c728226 100644
--- a/source/common/common/matchers.cc
+++ b/source/common/common/matchers.cc
@@ -201,10 +201,9 @@ bool PathMatcher::match(const absl::string_view path) const {
   return matcher_.match(Http::PathUtil::removeQueryAndFragment(path));
 }
 
-StringMatcherPtr getExtensionStringMatcher(const ::xds::core::v3::TypedExtensionConfig& config,
-                                           ThreadLocal::SlotAllocator& tls, Api::Api& api) {
+StringMatcherPtr getExtensionStringMatcher(const ::xds::core::v3::TypedExtensionConfig& config) {
   auto factory = Config::Utility::getAndCheckFactory<StringMatcherExtensionFactory>(config, false);
-  return factory->createStringMatcher(config.typed_config(), tls, api);
+  return factory->createStringMatcher(config.typed_config());
 }
 
 } // namespace Matchers
diff --git a/source/common/common/matchers.h b/source/common/common/matchers.h
index 49b68c705a42a..ae66633b6660f 100644
--- a/source/common/common/matchers.h
+++ b/source/common/common/matchers.h
@@ -86,36 +86,24 @@ class UniversalStringMatcher : public StringMatcher {
   bool match(absl::string_view) const override { return true; }
 };
 
-StringMatcherPtr getExtensionStringMatcher(const ::xds::core::v3::TypedExtensionConfig& config,
-                                           ThreadLocal::SlotAllocator& tls, Api::Api& api);
+StringMatcherPtr getExtensionStringMatcher(const ::xds::core::v3::TypedExtensionConfig& config);
 
 template <class StringMatcherType = envoy::type::matcher::v3::StringMatcher>
-class PrivateStringMatcherImpl : public ValueMatcher, public StringMatcher {
+class StringMatcherImpl : public ValueMatcher, public StringMatcher {
 public:
-  // TODO(ggreenway): convert all but the first parameter into
-  // `Server::Configuration::CommonFactoryContext`.
-  explicit PrivateStringMatcherImpl(const StringMatcherType& matcher, Regex::Engine* regex_engine,
-                                    ThreadLocal::SlotAllocator* tls, Api::Api* api)
-      : matcher_(matcher) {
+  explicit StringMatcherImpl(const StringMatcherType& matcher) : matcher_(matcher) {
     if (matcher.match_pattern_case() == StringMatcherType::MatchPatternCase::kSafeRegex) {
       if (matcher.ignore_case()) {
         ExceptionUtil::throwEnvoyException("ignore_case has no effect for safe_regex.");
       }
-      if (regex_engine != nullptr) {
-        regex_ = Regex::Utility::parseRegex(matcher_.safe_regex(), *regex_engine);
-      } else {
-        // TODO(ggreenway): remove this branch when we always have an engine. This is only
-        // needed to make tests not complain about dereferencing a null pointer, even though
-        // the reference isn't actually used.
-        regex_ = Regex::Utility::parseRegex(matcher_.safe_regex());
-      }
+      regex_ = Regex::Utility::parseRegex(matcher_.safe_regex());
     } else if (matcher.match_pattern_case() == StringMatcherType::MatchPatternCase::kContains) {
       if (matcher_.ignore_case()) {
         // Cache the lowercase conversion of the Contains matcher for future use
         lowercase_contains_match_ = absl::AsciiStrToLower(matcher_.contains());
       }
     } else {
-      initialize(matcher, tls, api);
+      initialize(matcher);
     }
   }
 
@@ -155,13 +143,11 @@ class PrivateStringMatcherImpl : public ValueMatcher, public StringMatcher {
   // overloading to only handle that case for type `envoy::type::matcher::v3::StringMatcher` to
   // prevent compilation errors on use of `kCustom`.
 
-  void initialize(const xds::type::matcher::v3::StringMatcher&, ThreadLocal::SlotAllocator*,
-                  Api::Api*) {}
+  void initialize(const xds::type::matcher::v3::StringMatcher&) {}
 
-  void initialize(const envoy::type::matcher::v3::StringMatcher& matcher,
-                  ThreadLocal::SlotAllocator* tls, Api::Api* api) {
+  void initialize(const envoy::type::matcher::v3::StringMatcher& matcher) {
     if (matcher.has_custom()) {
-      custom_ = getExtensionStringMatcher(matcher.custom(), *tls, *api);
+      custom_ = getExtensionStringMatcher(matcher.custom());
     }
   }
 
@@ -207,34 +193,9 @@ class PrivateStringMatcherImpl : public ValueMatcher, public StringMatcher {
   StringMatcherPtr custom_;
 };
 
-// Temporarily create two separate types with different constructors, inheriting from the same
-// implementation, to make it easier to find and replace all usage of the old one.
-// TODO(ggreenway): delete these two extra classes, make `PrivateStringMatcherImpl` back into
-// `StringMatcherImpl`.
-template <class StringMatcherType = envoy::type::matcher::v3::StringMatcher>
-class StringMatcherImplWithContext : public PrivateStringMatcherImpl<StringMatcherType> {
-public:
-  explicit StringMatcherImplWithContext(const StringMatcherType& matcher,
-                                        Server::Configuration::CommonFactoryContext& context)
-      : PrivateStringMatcherImpl<StringMatcherType>(matcher, &context.regexEngine(),
-                                                    &context.threadLocal(), &context.api()) {}
-};
-
-template <class StringMatcherType = envoy::type::matcher::v3::StringMatcher>
-class StringMatcherImpl : public PrivateStringMatcherImpl<StringMatcherType> {
-public:
-  explicit StringMatcherImpl(const StringMatcherType& matcher)
-      : PrivateStringMatcherImpl<StringMatcherType>(
-            matcher, Regex::EngineSingleton::getExisting(),
-            InjectableSingleton<ThreadLocal::SlotAllocator>::getExisting(),
-            InjectableSingleton<Api::Api>::getExisting()) {}
-};
-
 class StringMatcherExtensionFactory : public Config::TypedFactory {
 public:
-  // TODO(ggreenway): Convert all but first parameter to `CommonFactoryContext`.
-  virtual StringMatcherPtr createStringMatcher(const ProtobufWkt::Any& config,
-                                               ThreadLocal::SlotAllocator& tls, Api::Api& api) PURE;
+  virtual StringMatcherPtr createStringMatcher(const ProtobufWkt::Any& config) PURE;
 
   std::string category() const override { return "envoy.string_matcher"; }
 };
diff --git a/source/common/common/regex.h b/source/common/common/regex.h
index e64fcf90f2ece..4189df75fc24f 100644
--- a/source/common/common/regex.h
+++ b/source/common/common/regex.h
@@ -79,16 +79,6 @@ class Utility {
 
     return EngineSingleton::get().matcher(matcher.regex());
   }
-
-  template <class RegexMatcherType>
-  static CompiledMatcherPtr parseRegex(const RegexMatcherType& matcher, Engine& engine) {
-    // Fallback deprecated engine type in regex matcher.
-    if (matcher.has_google_re2()) {
-      return std::make_unique<CompiledGoogleReMatcher>(matcher);
-    }
-
-    return engine.matcher(matcher.regex());
-  }
 };
 
 } // namespace Regex
diff --git a/source/common/tls/cert_validator/default_validator.cc b/source/common/tls/cert_validator/default_validator.cc
index 39319a7312b3a..8d049f7ba0c92 100644
--- a/source/common/tls/cert_validator/default_validator.cc
+++ b/source/common/tls/cert_validator/default_validator.cc
@@ -44,8 +44,8 @@ namespace Tls {
 
 DefaultCertValidator::DefaultCertValidator(
     const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-    Server::Configuration::CommonFactoryContext& context)
-    : config_(config), stats_(stats), context_(context) {
+    TimeSource& time_source)
+    : config_(config), stats_(stats), time_source_(time_source) {
   if (config_ != nullptr) {
     allow_untrusted_certificate_ = config_->trustChainVerification() ==
                                    envoy::extensions::transport_sockets::tls::v3::
@@ -155,7 +155,7 @@ int DefaultCertValidator::initializeSslContexts(std::vector<SSL_CTX*> contexts,
     if (!cert_validation_config->subjectAltNameMatchers().empty()) {
       for (const envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher& matcher :
            cert_validation_config->subjectAltNameMatchers()) {
-        auto san_matcher = createStringSanMatcher(matcher, context_);
+        auto san_matcher = createStringSanMatcher(matcher);
         if (san_matcher == nullptr) {
           throwEnvoyExceptionOrPanic(
               absl::StrCat("Failed to create string SAN matcher of type ", matcher.san_type()));
@@ -548,19 +548,18 @@ Envoy::Ssl::CertificateDetailsPtr DefaultCertValidator::getCaCertInformation() c
   if (ca_cert_ == nullptr) {
     return nullptr;
   }
-  return Utility::certificateDetails(ca_cert_.get(), getCaFileName(), context_.timeSource());
+  return Utility::certificateDetails(ca_cert_.get(), getCaFileName(), time_source_);
 }
 
 absl::optional<uint32_t> DefaultCertValidator::daysUntilFirstCertExpires() const {
-  return Utility::getDaysUntilExpiration(ca_cert_.get(), context_.timeSource());
+  return Utility::getDaysUntilExpiration(ca_cert_.get(), time_source_);
 }
 
 class DefaultCertValidatorFactory : public CertValidatorFactory {
 public:
-  CertValidatorPtr
-  createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                      Server::Configuration::CommonFactoryContext& context) override {
-    return std::make_unique<DefaultCertValidator>(config, stats, context);
+  CertValidatorPtr createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config,
+                                       SslStats& stats, TimeSource& time_source) override {
+    return std::make_unique<DefaultCertValidator>(config, stats, time_source);
   }
 
   std::string name() const override { return "envoy.tls.cert_validator.default"; }
diff --git a/source/common/tls/cert_validator/default_validator.h b/source/common/tls/cert_validator/default_validator.h
index f17a01dd3d5d9..c3e88bd09ca19 100644
--- a/source/common/tls/cert_validator/default_validator.h
+++ b/source/common/tls/cert_validator/default_validator.h
@@ -35,7 +35,7 @@ namespace Tls {
 class DefaultCertValidator : public CertValidator, Logger::Loggable<Logger::Id::connection> {
 public:
   DefaultCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config,
-                       SslStats& stats, Server::Configuration::CommonFactoryContext& context);
+                       SslStats& stats, TimeSource& time_source);
 
   ~DefaultCertValidator() override = default;
 
@@ -110,7 +110,7 @@ class DefaultCertValidator : public CertValidator, Logger::Loggable<Logger::Id::
 
   const Envoy::Ssl::CertificateValidationContextConfig* config_;
   SslStats& stats_;
-  Server::Configuration::CommonFactoryContext& context_;
+  TimeSource& time_source_;
 
   bool allow_untrusted_certificate_{false};
   bssl::UniquePtr<X509> ca_cert_;
diff --git a/source/common/tls/cert_validator/factory.h b/source/common/tls/cert_validator/factory.h
index 8f6aebbd6b4c3..40f3fc3de92be 100644
--- a/source/common/tls/cert_validator/factory.h
+++ b/source/common/tls/cert_validator/factory.h
@@ -21,7 +21,7 @@ class CertValidatorFactory : public Config::UntypedFactory {
 public:
   virtual CertValidatorPtr
   createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                      Server::Configuration::CommonFactoryContext& context) PURE;
+                      TimeSource& time_source) PURE;
 
   std::string category() const override { return "envoy.tls.cert_validator"; }
 };
diff --git a/source/common/tls/cert_validator/san_matcher.cc b/source/common/tls/cert_validator/san_matcher.cc
index 0229ca1c12736..13429c3fcdcce 100644
--- a/source/common/tls/cert_validator/san_matcher.cc
+++ b/source/common/tls/cert_validator/san_matcher.cc
@@ -28,8 +28,7 @@ bool StringSanMatcher::match(const GENERAL_NAME* general_name) const {
 }
 
 SanMatcherPtr createStringSanMatcher(
-    envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher const& matcher,
-    Server::Configuration::CommonFactoryContext& context) {
+    envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher const& matcher) {
   // Verify that a new san type has not been added.
   static_assert(envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType_MAX ==
                 4);
@@ -37,13 +36,13 @@ SanMatcherPtr createStringSanMatcher(
   switch (matcher.san_type()) {
     PANIC_ON_PROTO_ENUM_SENTINEL_VALUES;
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::DNS:
-    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher.matcher(), context)};
+    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher.matcher())};
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::EMAIL:
-    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_EMAIL, matcher.matcher(), context)};
+    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_EMAIL, matcher.matcher())};
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::URI:
-    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher.matcher(), context)};
+    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher.matcher())};
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::IP_ADDRESS:
-    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_IPADD, matcher.matcher(), context)};
+    return SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_IPADD, matcher.matcher())};
   case envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SAN_TYPE_UNSPECIFIED:
     PANIC("unhandled value");
   }
diff --git a/source/common/tls/cert_validator/san_matcher.h b/source/common/tls/cert_validator/san_matcher.h
index b9409555209e0..260e9cc3075ef 100644
--- a/source/common/tls/cert_validator/san_matcher.h
+++ b/source/common/tls/cert_validator/san_matcher.h
@@ -34,18 +34,16 @@ class StringSanMatcher : public SanMatcher {
 public:
   bool match(const GENERAL_NAME* general_name) const override;
   ~StringSanMatcher() override = default;
-  StringSanMatcher(int general_name_type, envoy::type::matcher::v3::StringMatcher matcher,
-                   Server::Configuration::CommonFactoryContext& context)
-      : general_name_type_(general_name_type), matcher_(matcher, context) {}
+  StringSanMatcher(int general_name_type, envoy::type::matcher::v3::StringMatcher matcher)
+      : general_name_type_(general_name_type), matcher_(matcher) {}
 
 private:
   const int general_name_type_;
-  const Matchers::StringMatcherImplWithContext<envoy::type::matcher::v3::StringMatcher> matcher_;
+  const Matchers::StringMatcherImpl<envoy::type::matcher::v3::StringMatcher> matcher_;
 };
 
 SanMatcherPtr createStringSanMatcher(
-    const envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher& matcher,
-    Server::Configuration::CommonFactoryContext& context);
+    const envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher& matcher);
 
 } // namespace Tls
 } // namespace TransportSockets
diff --git a/source/common/tls/context_impl.cc b/source/common/tls/context_impl.cc
index 2669fd8559f5d..7d86c94bd5f6f 100644
--- a/source/common/tls/context_impl.cc
+++ b/source/common/tls/context_impl.cc
@@ -80,9 +80,8 @@ int ContextImpl::sslExtendedSocketInfoIndex() {
 }
 
 ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& config,
-                         Server::Configuration::CommonFactoryContext& factory_context,
-                         Ssl::ContextAdditionalInitFunc additional_init)
-    : scope_(scope), stats_(generateSslStats(scope)), factory_context_(factory_context),
+                         TimeSource& time_source, Ssl::ContextAdditionalInitFunc additional_init)
+    : scope_(scope), stats_(generateSslStats(scope)), time_source_(time_source),
       tls_max_version_(config.maxProtocolVersion()),
       stat_name_set_(scope.symbolTable().makeSet("TransportSockets::Tls")),
       unknown_ssl_cipher_(stat_name_set_->add("unknown_ssl_cipher")),
@@ -105,7 +104,7 @@ ContextImpl::ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& c
   }
 
   cert_validator_ = cert_validator_factory->createCertValidator(
-      config.certificateValidationContext(), stats_, factory_context_);
+      config.certificateValidationContext(), stats_, time_source_);
 
   const auto tls_certificates = config.tlsCertificates();
   tls_contexts_.resize(std::max(static_cast<size_t>(1), tls_certificates.size()));
@@ -610,7 +609,7 @@ absl::optional<uint32_t> ContextImpl::daysUntilFirstCertExpires() const {
   }
   for (auto& ctx : tls_contexts_) {
     const absl::optional<uint32_t> tmp =
-        Utility::getDaysUntilExpiration(ctx.cert_chain_.get(), factory_context_.timeSource());
+        Utility::getDaysUntilExpiration(ctx.cert_chain_.get(), time_source_);
     if (!tmp.has_value()) {
       return absl::nullopt;
     }
@@ -644,7 +643,7 @@ std::vector<Envoy::Ssl::CertificateDetailsPtr> ContextImpl::getCertChainInformat
     }
 
     auto detail = Utility::certificateDetails(ctx.cert_chain_.get(), ctx.getCertChainFileName(),
-                                              factory_context_.timeSource());
+                                              time_source_);
     auto ocsp_resp = ctx.ocsp_response_.get();
     if (ocsp_resp) {
       auto* ocsp_details = detail->mutable_ocsp_details();
@@ -660,8 +659,8 @@ std::vector<Envoy::Ssl::CertificateDetailsPtr> ContextImpl::getCertChainInformat
 
 ClientContextImpl::ClientContextImpl(Stats::Scope& scope,
                                      const Envoy::Ssl::ClientContextConfig& config,
-                                     Server::Configuration::CommonFactoryContext& factory_context)
-    : ContextImpl(scope, config, factory_context, nullptr /* additional_init */),
+                                     TimeSource& time_source)
+    : ContextImpl(scope, config, time_source, nullptr /* additional_init */),
       server_name_indication_(config.serverNameIndication()),
       allow_renegotiation_(config.allowRenegotiation()),
       enforce_rsa_key_usage_(config.enforceRsaKeyUsage()),
@@ -790,9 +789,9 @@ int ClientContextImpl::newSessionKey(SSL_SESSION* session) {
 ServerContextImpl::ServerContextImpl(Stats::Scope& scope,
                                      const Envoy::Ssl::ServerContextConfig& config,
                                      const std::vector<std::string>& server_names,
-                                     Server::Configuration::CommonFactoryContext& factory_context,
+                                     TimeSource& time_source,
                                      Ssl::ContextAdditionalInitFunc additional_init)
-    : ContextImpl(scope, config, factory_context, additional_init),
+    : ContextImpl(scope, config, time_source, additional_init),
       session_ticket_keys_(config.sessionTicketKeys()),
       ocsp_staple_policy_(config.ocspStaplePolicy()),
       full_scan_certs_on_sni_mismatch_(config.fullScanCertsOnSNIMismatch()) {
@@ -889,8 +888,7 @@ ServerContextImpl::ServerContextImpl(Stats::Scope& scope,
         throwEnvoyExceptionOrPanic("Required OCSP response is missing from TLS context");
       }
     } else {
-      auto response = std::make_unique<Ocsp::OcspResponseWrapper>(ocsp_resp_bytes,
-                                                                  factory_context_.timeSource());
+      auto response = std::make_unique<Ocsp::OcspResponseWrapper>(ocsp_resp_bytes, time_source_);
       if (!response->matchesCertificate(*ctx.cert_chain_)) {
         throwEnvoyExceptionOrPanic("OCSP response does not match its TLS certificate");
       }
diff --git a/source/common/tls/context_impl.h b/source/common/tls/context_impl.h
index 71f04229af513..9bffa93a74a44 100644
--- a/source/common/tls/context_impl.h
+++ b/source/common/tls/context_impl.h
@@ -115,8 +115,7 @@ class ContextImpl : public virtual Envoy::Ssl::Context,
 protected:
   friend class ContextImplPeer;
 
-  ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& config,
-              Server::Configuration::CommonFactoryContext& factory_context,
+  ContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& config, TimeSource& time_source,
               Ssl::ContextAdditionalInitFunc additional_init);
 
   /**
@@ -152,7 +151,7 @@ class ContextImpl : public virtual Envoy::Ssl::Context,
   std::vector<uint8_t> parsed_alpn_protocols_;
   bssl::UniquePtr<X509> cert_chain_;
   std::string cert_chain_file_path_;
-  Server::Configuration::CommonFactoryContext& factory_context_;
+  TimeSource& time_source_;
   const unsigned tls_max_version_;
   mutable Stats::StatNameSetPtr stat_name_set_;
   const Stats::StatName unknown_ssl_cipher_;
@@ -174,7 +173,7 @@ using ContextImplSharedPtr = std::shared_ptr<ContextImpl>;
 class ClientContextImpl : public ContextImpl, public Envoy::Ssl::ClientContext {
 public:
   ClientContextImpl(Stats::Scope& scope, const Envoy::Ssl::ClientContextConfig& config,
-                    Server::Configuration::CommonFactoryContext& factory_context);
+                    TimeSource& time_source);
 
   bssl::UniquePtr<SSL>
   newSsl(const Network::TransportSocketOptionsConstSharedPtr& options) override;
@@ -196,8 +195,7 @@ enum class OcspStapleAction { Staple, NoStaple, Fail, ClientNotCapable };
 class ServerContextImpl : public ContextImpl, public Envoy::Ssl::ServerContext {
 public:
   ServerContextImpl(Stats::Scope& scope, const Envoy::Ssl::ServerContextConfig& config,
-                    const std::vector<std::string>& server_names,
-                    Server::Configuration::CommonFactoryContext& factory_context,
+                    const std::vector<std::string>& server_names, TimeSource& time_source,
                     Ssl::ContextAdditionalInitFunc additional_init);
 
   // Select the TLS certificate context in SSL_CTX_set_select_certificate_cb() callback with
diff --git a/source/common/tls/context_manager_impl.cc b/source/common/tls/context_manager_impl.cc
index 1c0e8d027aeb7..b76a81264e21b 100644
--- a/source/common/tls/context_manager_impl.cc
+++ b/source/common/tls/context_manager_impl.cc
@@ -15,19 +15,17 @@ namespace Extensions {
 namespace TransportSockets {
 namespace Tls {
 
-ContextManagerImpl::ContextManagerImpl(Server::Configuration::CommonFactoryContext& factory_context)
-    : factory_context_(factory_context) {}
+ContextManagerImpl::ContextManagerImpl(TimeSource& time_source) : time_source_(time_source) {}
 
 Envoy::Ssl::ClientContextSharedPtr
 ContextManagerImpl::createSslClientContext(Stats::Scope& scope,
                                            const Envoy::Ssl::ClientContextConfig& config) {
-  ASSERT_IS_MAIN_OR_TEST_THREAD();
   if (!config.isReady()) {
     return nullptr;
   }
 
   Envoy::Ssl::ClientContextSharedPtr context =
-      std::make_shared<ClientContextImpl>(scope, config, factory_context_);
+      std::make_shared<ClientContextImpl>(scope, config, time_source_);
   contexts_.insert(context);
   return context;
 }
@@ -35,13 +33,12 @@ ContextManagerImpl::createSslClientContext(Stats::Scope& scope,
 Envoy::Ssl::ServerContextSharedPtr ContextManagerImpl::createSslServerContext(
     Stats::Scope& scope, const Envoy::Ssl::ServerContextConfig& config,
     const std::vector<std::string>& server_names, Ssl::ContextAdditionalInitFunc additional_init) {
-  ASSERT_IS_MAIN_OR_TEST_THREAD();
   if (!config.isReady()) {
     return nullptr;
   }
 
   Envoy::Ssl::ServerContextSharedPtr context = std::make_shared<ServerContextImpl>(
-      scope, config, server_names, factory_context_, std::move(additional_init));
+      scope, config, server_names, time_source_, std::move(additional_init));
   contexts_.insert(context);
   return context;
 }
diff --git a/source/common/tls/context_manager_impl.h b/source/common/tls/context_manager_impl.h
index 31df3addd7432..db72e1d308e0e 100644
--- a/source/common/tls/context_manager_impl.h
+++ b/source/common/tls/context_manager_impl.h
@@ -5,7 +5,6 @@
 #include <list>
 
 #include "envoy/common/time.h"
-#include "envoy/server/factory_context.h"
 #include "envoy/ssl/context_manager.h"
 #include "envoy/ssl/private_key/private_key.h"
 #include "envoy/stats/scope.h"
@@ -19,13 +18,14 @@ namespace Tls {
 
 /**
  * The SSL context manager has the following threading model:
- * Contexts can be allocated the main thread. They can be released from any thread (and in practice
- * are since cluster information can be released from any thread). Context allocation/free is a very
- * uncommon thing so we just do a global lock to protect it all.
+ * Contexts can be allocated via any thread (through in practice they are only allocated on the main
+ * thread). They can be released from any thread (and in practice are since cluster information can
+ * be released from any thread). Context allocation/free is a very uncommon thing so we just do a
+ * global lock to protect it all.
  */
 class ContextManagerImpl final : public Envoy::Ssl::ContextManager {
 public:
-  explicit ContextManagerImpl(Server::Configuration::CommonFactoryContext& factory_context);
+  explicit ContextManagerImpl(TimeSource& time_source);
   ~ContextManagerImpl() override = default;
 
   // Ssl::ContextManager
@@ -45,7 +45,7 @@ class ContextManagerImpl final : public Envoy::Ssl::ContextManager {
   void removeContext(const Envoy::Ssl::ContextSharedPtr& old_context) override;
 
 private:
-  Server::Configuration::CommonFactoryContext& factory_context_;
+  TimeSource& time_source_;
   absl::flat_hash_set<Envoy::Ssl::ContextSharedPtr> contexts_;
   PrivateKeyMethodManagerImpl private_key_method_manager_{};
 };
diff --git a/source/extensions/string_matcher/lua/match.cc b/source/extensions/string_matcher/lua/match.cc
index c6ee81e7022c6..fd24f17f81f0a 100644
--- a/source/extensions/string_matcher/lua/match.cc
+++ b/source/extensions/string_matcher/lua/match.cc
@@ -77,11 +77,12 @@ bool LuaStringMatcher::match(const absl::string_view value) const {
 // Lua state is not thread safe, so a state needs to be stored in thread local storage.
 class LuaStringMatcherThreadWrapper : public Matchers::StringMatcher {
 public:
-  LuaStringMatcherThreadWrapper(const std::string& code, ThreadLocal::SlotAllocator& tls) {
+  LuaStringMatcherThreadWrapper(const std::string& code) {
     // Validate that there are no errors while creating on the main thread.
     LuaStringMatcher validator(code);
 
-    tls_slot_ = ThreadLocal::TypedSlot<LuaStringMatcher>::makeUnique(tls);
+    tls_slot_ = ThreadLocal::TypedSlot<LuaStringMatcher>::makeUnique(
+        *InjectableSingleton<ThreadLocal::SlotAllocator>::getExisting());
     tls_slot_->set([code](Event::Dispatcher&) -> std::shared_ptr<LuaStringMatcher> {
       return std::make_shared<LuaStringMatcher>(code);
     });
@@ -94,18 +95,18 @@ class LuaStringMatcherThreadWrapper : public Matchers::StringMatcher {
 };
 
 Matchers::StringMatcherPtr
-LuaStringMatcherFactory::createStringMatcher(const ProtobufWkt::Any& message,
-                                             ThreadLocal::SlotAllocator& tls, Api::Api& api) {
+LuaStringMatcherFactory::createStringMatcher(const ProtobufWkt::Any& message) {
   ::envoy::extensions::string_matcher::lua::v3::Lua config;
   Config::Utility::translateOpaqueConfig(message, ProtobufMessage::getStrictValidationVisitor(),
                                          config);
+  Api::Api* api = InjectableSingleton<Api::Api>::getExisting();
   absl::StatusOr<std::string> result = Config::DataSource::read(
-      config.source_code(), false /* allow_empty */, api, 0 /* max_size */);
+      config.source_code(), false /* allow_empty */, *api, 0 /* max_size */);
   if (!result.ok()) {
     throw EnvoyException(
         fmt::format("Failed to get lua string matcher code from source: {}", result.status()));
   }
-  return std::make_unique<LuaStringMatcherThreadWrapper>(*result, tls);
+  return std::make_unique<LuaStringMatcherThreadWrapper>(*result);
 }
 
 ProtobufTypes::MessagePtr LuaStringMatcherFactory::createEmptyConfigProto() {
diff --git a/source/extensions/string_matcher/lua/match.h b/source/extensions/string_matcher/lua/match.h
index 2777bcf76220e..8452a24b08324 100644
--- a/source/extensions/string_matcher/lua/match.h
+++ b/source/extensions/string_matcher/lua/match.h
@@ -29,9 +29,7 @@ class LuaStringMatcher : public Matchers::StringMatcher, public ThreadLocal::Thr
 
 class LuaStringMatcherFactory : public Matchers::StringMatcherExtensionFactory {
 public:
-  Matchers::StringMatcherPtr createStringMatcher(const ProtobufWkt::Any& message,
-                                                 ThreadLocal::SlotAllocator& tls,
-                                                 Api::Api& api) override;
+  Matchers::StringMatcherPtr createStringMatcher(const ProtobufWkt::Any& message) override;
   std::string name() const override { return "envoy.string_matcher.lua"; }
   ProtobufTypes::MessagePtr createEmptyConfigProto() override;
 };
diff --git a/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc b/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc
index 13f5011c7c01c..4c6f6fb3dc303 100644
--- a/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc
+++ b/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc
@@ -31,9 +31,8 @@ namespace Tls {
 using SPIFFEConfig = envoy::extensions::transport_sockets::tls::v3::SPIFFECertValidatorConfig;
 
 SPIFFEValidator::SPIFFEValidator(const Envoy::Ssl::CertificateValidationContextConfig* config,
-                                 SslStats& stats,
-                                 Server::Configuration::CommonFactoryContext& context)
-    : stats_(stats), time_source_(context.timeSource()) {
+                                 SslStats& stats, TimeSource& time_source)
+    : stats_(stats), time_source_(time_source) {
   ASSERT(config != nullptr);
   allow_expired_certificate_ = config->allowExpiredCertificate();
 
@@ -49,7 +48,7 @@ SPIFFEValidator::SPIFFEValidator(const Envoy::Ssl::CertificateValidationContextC
         // SAN types. See the discussion: https://github.com/envoyproxy/envoy/issues/15392
         // TODO(pradeepcrao): Throw an exception when a non-URI matcher is encountered after the
         // deprecated field match_subject_alt_names is removed
-        subject_alt_name_matchers_.emplace_back(createStringSanMatcher(matcher, context));
+        subject_alt_name_matchers_.emplace_back(createStringSanMatcher(matcher));
       }
     }
   }
@@ -311,10 +310,9 @@ Envoy::Ssl::CertificateDetailsPtr SPIFFEValidator::getCaCertInformation() const
 
 class SPIFFEValidatorFactory : public CertValidatorFactory {
 public:
-  CertValidatorPtr
-  createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                      Server::Configuration::CommonFactoryContext& context) override {
-    return std::make_unique<SPIFFEValidator>(config, stats, context);
+  CertValidatorPtr createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config,
+                                       SslStats& stats, TimeSource& time_source) override {
+    return std::make_unique<SPIFFEValidator>(config, stats, time_source);
   }
 
   std::string name() const override { return "envoy.tls.cert_validator.spiffe"; }
diff --git a/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h b/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h
index 0c8a93a80f16c..4bb140dbe63b1 100644
--- a/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h
+++ b/source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h
@@ -35,7 +35,7 @@ class SPIFFEValidator : public CertValidator {
   SPIFFEValidator(SslStats& stats, TimeSource& time_source)
       : stats_(stats), time_source_(time_source){};
   SPIFFEValidator(const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                  Server::Configuration::CommonFactoryContext& context);
+                  TimeSource& time_source);
   ~SPIFFEValidator() override = default;
 
   // Tls::CertValidator
diff --git a/source/extensions/transport_sockets/tls/config.cc b/source/extensions/transport_sockets/tls/config.cc
index 1d652c0d15456..ec2f39b60aed1 100644
--- a/source/extensions/transport_sockets/tls/config.cc
+++ b/source/extensions/transport_sockets/tls/config.cc
@@ -51,9 +51,8 @@ ProtobufTypes::MessagePtr DownstreamSslSocketFactory::createEmptyConfigProto() {
 LEGACY_REGISTER_FACTORY(DownstreamSslSocketFactory,
                         Server::Configuration::DownstreamTransportSocketConfigFactory, "tls");
 
-Ssl::ContextManagerPtr SslContextManagerFactory::createContextManager(
-    Server::Configuration::CommonFactoryContext& factory_context) {
-  return std::make_unique<ContextManagerImpl>(factory_context);
+Ssl::ContextManagerPtr SslContextManagerFactory::createContextManager(TimeSource& time_source) {
+  return std::make_unique<ContextManagerImpl>(time_source);
 }
 
 static Envoy::Registry::RegisterInternalFactory<SslContextManagerFactory,
diff --git a/source/extensions/transport_sockets/tls/config.h b/source/extensions/transport_sockets/tls/config.h
index d55bbb67e73bb..b9aa1f86ba9e5 100644
--- a/source/extensions/transport_sockets/tls/config.h
+++ b/source/extensions/transport_sockets/tls/config.h
@@ -44,8 +44,7 @@ DECLARE_FACTORY(DownstreamSslSocketFactory);
 
 class SslContextManagerFactory : public Ssl::ContextManagerFactory {
 public:
-  Ssl::ContextManagerPtr
-  createContextManager(Server::Configuration::CommonFactoryContext& factory_context) override;
+  Ssl::ContextManagerPtr createContextManager(TimeSource& time_source) override;
 };
 
 DECLARE_FACTORY(SslContextManagerFactory);
diff --git a/source/server/config_validation/server.cc b/source/server/config_validation/server.cc
index a2d915b5e66da..054cb3f11b247 100644
--- a/source/server/config_validation/server.cc
+++ b/source/server/config_validation/server.cc
@@ -98,7 +98,7 @@ void ValidationInstance::initialize(const Options& options,
   }
 
   // Inject regex engine to singleton.
-  regex_engine_ = createRegexEngine(
+  Regex::EnginePtr regex_engine = createRegexEngine(
       bootstrap_, messageValidationContext().staticValidationVisitor(), serverFactoryContext());
 
   Config::StatsUtility::createTagProducer(bootstrap_, options_.statsTags());
@@ -132,7 +132,7 @@ void ValidationInstance::initialize(const Options& options,
             "Component factory should not return nullptr from createDrainManager()");
 
   secret_manager_ = std::make_unique<Secret::SecretManagerImpl>(admin()->getConfigTracker());
-  ssl_context_manager_ = createContextManager("ssl_context_manager", server_contexts_);
+  ssl_context_manager_ = createContextManager("ssl_context_manager", api_->timeSource());
   cluster_manager_factory_ = std::make_unique<Upstream::ValidationClusterManagerFactory>(
       server_contexts_, stats(), threadLocal(), http_context_,
       [this]() -> Network::DnsResolverSharedPtr { return this->dnsResolver(); },
diff --git a/source/server/config_validation/server.h b/source/server/config_validation/server.h
index 9f1bb41c031d9..fc301751e57d5 100644
--- a/source/server/config_validation/server.h
+++ b/source/server/config_validation/server.h
@@ -123,7 +123,6 @@ class ValidationInstance final : Logger::Loggable<Logger::Id::main>,
   bool enableReusePortDefault() override { return true; }
 
   Configuration::StatsConfig& statsConfig() override { return config_.statsConfig(); }
-  Regex::Engine& regexEngine() override { return *regex_engine_; }
   envoy::config::bootstrap::v3::Bootstrap& bootstrap() override { return bootstrap_; }
   Configuration::ServerFactoryContext& serverFactoryContext() override { return server_contexts_; }
   Configuration::TransportSocketFactoryContext& transportSocketFactoryContext() override {
@@ -195,7 +194,6 @@ class ValidationInstance final : Logger::Loggable<Logger::Id::main>,
   Filter::TcpListenerFilterConfigProviderManagerImpl tcp_listener_config_provider_manager_;
   Server::DrainManagerPtr drain_manager_;
   HotRestartNopImpl nop_hot_restart_;
-  Regex::EnginePtr regex_engine_;
 };
 
 } // namespace Server
diff --git a/source/server/server.cc b/source/server/server.cc
index a570ccf16cce0..1bd625cd09dcc 100644
--- a/source/server/server.cc
+++ b/source/server/server.cc
@@ -749,7 +749,7 @@ absl::Status InstanceBase::initializeOrThrow(Network::Address::InstanceConstShar
   }
 
   // Once we have runtime we can initialize the SSL context manager.
-  ssl_context_manager_ = createContextManager("ssl_context_manager", server_contexts_);
+  ssl_context_manager_ = createContextManager("ssl_context_manager", time_source_);
 
   cluster_manager_factory_ = std::make_unique<Upstream::ProdClusterManagerFactory>(
       serverFactoryContext(), stats_store_, thread_local_, http_context_,
diff --git a/source/server/server.h b/source/server/server.h
index 0d4d76bc97f1f..3afd1348aaba7 100644
--- a/source/server/server.h
+++ b/source/server/server.h
@@ -197,7 +197,6 @@ class ServerFactoryContextImpl : public Configuration::ServerFactoryContext,
   ProcessContextOptRef processContext() override { return server_.processContext(); }
   Envoy::Server::DrainManager& drainManager() override { return server_.drainManager(); }
   ServerLifecycleNotifier& lifecycleNotifier() override { return server_.lifecycleNotifier(); }
-  Regex::Engine& regexEngine() override { return server_.regexEngine(); }
   Configuration::StatsConfig& statsConfig() override { return server_.statsConfig(); }
   envoy::config::bootstrap::v3::Bootstrap& bootstrap() override { return server_.bootstrap(); }
   OverloadManager& overloadManager() override { return server_.overloadManager(); }
@@ -293,7 +292,6 @@ class InstanceBase : Logger::Loggable<Logger::Id::main>,
   TimeSource& timeSource() override { return time_source_; }
   void flushStats() override;
   Configuration::StatsConfig& statsConfig() override { return config_.statsConfig(); }
-  Regex::Engine& regexEngine() override { return *regex_engine_; }
   envoy::config::bootstrap::v3::Bootstrap& bootstrap() override { return bootstrap_; }
   Configuration::ServerFactoryContext& serverFactoryContext() override { return server_contexts_; }
   Configuration::TransportSocketFactoryContext& transportSocketFactoryContext() override {
diff --git a/source/server/ssl_context_manager.cc b/source/server/ssl_context_manager.cc
index fadc322831638..8a9fec347dee8 100644
--- a/source/server/ssl_context_manager.cc
+++ b/source/server/ssl_context_manager.cc
@@ -49,13 +49,12 @@ class SslContextManagerNoTlsStub final : public Envoy::Ssl::ContextManager {
   }
 };
 
-Ssl::ContextManagerPtr
-createContextManager(const std::string& factory_name,
-                     Server::Configuration::CommonFactoryContext& factory_context) {
+Ssl::ContextManagerPtr createContextManager(const std::string& factory_name,
+                                            TimeSource& time_source) {
   Ssl::ContextManagerFactory* factory =
       Registry::FactoryRegistry<Ssl::ContextManagerFactory>::getFactory(factory_name);
   if (factory != nullptr) {
-    return factory->createContextManager(factory_context);
+    return factory->createContextManager(time_source);
   }
 
   return std::make_unique<SslContextManagerNoTlsStub>();
diff --git a/source/server/ssl_context_manager.h b/source/server/ssl_context_manager.h
index c296955703fe9..4b618e6e64f4e 100644
--- a/source/server/ssl_context_manager.h
+++ b/source/server/ssl_context_manager.h
@@ -6,9 +6,8 @@
 namespace Envoy {
 namespace Server {
 
-Ssl::ContextManagerPtr
-createContextManager(const std::string& factory_name,
-                     Server::Configuration::CommonFactoryContext& factory_context);
+Ssl::ContextManagerPtr createContextManager(const std::string& factory_name,
+                                            TimeSource& time_source);
 
 } // namespace Server
 } // namespace Envoy
diff --git a/test/common/grpc/grpc_client_integration_test_harness.h b/test/common/grpc/grpc_client_integration_test_harness.h
index 0b52d9c55e82b..27baab111f4ff 100644
--- a/test/common/grpc/grpc_client_integration_test_harness.h
+++ b/test/common/grpc/grpc_client_integration_test_harness.h
@@ -510,8 +510,7 @@ class GrpcClientIntegrationTest : public GrpcClientIntegrationParamTest {
   Upstream::MockClusterManager cm_;
   NiceMock<LocalInfo::MockLocalInfo> local_info_;
   Runtime::MockLoader runtime_;
-  testing::NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{test_time_.timeSystem()};
   NiceMock<Random::MockRandomGenerator> random_;
   Http::AsyncClientPtr http_async_client_;
   Http::ConnectionPool::InstancePtr http_conn_pool_;
diff --git a/test/common/quic/BUILD b/test/common/quic/BUILD
index 19437fb2be920..b488b190353dd 100644
--- a/test/common/quic/BUILD
+++ b/test/common/quic/BUILD
@@ -64,7 +64,6 @@ envoy_cc_test(
         "//source/common/quic:envoy_quic_proof_verifier_lib",
         "//source/common/tls:context_config_lib",
         "//test/mocks/network:network_mocks",
-        "//test/mocks/server:server_factory_context_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/test_common:test_runtime_lib",
         "@com_github_google_quiche//:quic_core_versions_lib",
@@ -109,7 +108,6 @@ envoy_cc_test(
         "//test/common/config:dummy_config_proto_cc_proto",
         "//test/common/tls/cert_validator:timed_cert_validator",
         "//test/mocks/event:event_mocks",
-        "//test/mocks/server:server_factory_context_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "@com_github_google_quiche//:quic_test_tools_test_certificates_lib",
     ],
diff --git a/test/common/quic/envoy_quic_proof_source_test.cc b/test/common/quic/envoy_quic_proof_source_test.cc
index afe1e521378e0..a6814a40c52d6 100644
--- a/test/common/quic/envoy_quic_proof_source_test.cc
+++ b/test/common/quic/envoy_quic_proof_source_test.cc
@@ -9,7 +9,6 @@
 
 #include "test/common/quic/test_utils.h"
 #include "test/mocks/network/mocks.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/test_common/test_runtime.h"
 
@@ -72,7 +71,7 @@ class SignatureVerifier {
     const absl::optional<envoy::config::core::v3::TypedExtensionConfig> nullopt = absl::nullopt;
     ON_CALL(cert_validation_ctx_config_, customValidatorConfig()).WillByDefault(ReturnRef(nullopt));
     auto context = std::make_shared<Extensions::TransportSockets::Tls::ClientContextImpl>(
-        *store_.rootScope(), client_context_config_, server_factory_context_);
+        *store_.rootScope(), client_context_config_, time_system_);
     ON_CALL(verify_context_, dispatcher()).WillByDefault(ReturnRef(dispatcher_));
     ON_CALL(verify_context_, transportSocketOptions())
         .WillByDefault(ReturnRef(transport_socket_options_));
@@ -106,7 +105,6 @@ class SignatureVerifier {
   NiceMock<Stats::MockStore> store_;
   Event::GlobalTimeSystem time_system_;
   NiceMock<Ssl::MockClientContextConfig> client_context_config_;
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
   NiceMock<Ssl::MockCertificateValidationContextConfig> cert_validation_ctx_config_;
   std::unique_ptr<EnvoyQuicProofVerifier> verifier_;
   NiceMock<Ssl::MockContextManager> tls_context_manager_;
@@ -226,8 +224,7 @@ class EnvoyQuicProofSourceTest : public ::testing::Test {
   Network::MockFilterChainManager filter_chain_manager_;
   Network::MockListenSocket listen_socket_;
   testing::NiceMock<Network::MockListenerConfig> listener_config_;
-  Server::Configuration::MockServerFactoryContext factory_context_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_{factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_{time_system_};
   Ssl::MockServerContextConfig* mock_context_config_;
   std::function<void()> secret_update_callback_;
   std::unique_ptr<QuicServerTransportSocketFactory> transport_socket_factory_;
@@ -394,9 +391,7 @@ class LegacyEnvoyQuicProofSourceTest : public ::testing::Test {
   Network::MockFilterChainManager filter_chain_manager_;
   Network::MockListenSocket listen_socket_;
   testing::NiceMock<Network::MockListenerConfig> listener_config_;
-  testing::NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_{
-      server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_{time_system_};
   Ssl::MockServerContextConfig* mock_context_config_;
   std::unique_ptr<QuicServerTransportSocketFactory> transport_socket_factory_;
   Ssl::MockTlsCertificateConfig tls_cert_config_;
diff --git a/test/common/quic/envoy_quic_proof_verifier_test.cc b/test/common/quic/envoy_quic_proof_verifier_test.cc
index 97b5bd52724a2..ab12465385ebb 100644
--- a/test/common/quic/envoy_quic_proof_verifier_test.cc
+++ b/test/common/quic/envoy_quic_proof_verifier_test.cc
@@ -9,7 +9,6 @@
 #include "test/common/quic/test_utils.h"
 #include "test/common/tls/cert_validator/timed_cert_validator.h"
 #include "test/mocks/event/mocks.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/mocks/stats/mocks.h"
 #include "test/test_common/test_time.h"
@@ -81,7 +80,7 @@ class EnvoyQuicProofVerifierTest : public testing::Test {
     EXPECT_CALL(cert_validation_ctx_config_, customValidatorConfig())
         .WillRepeatedly(ReturnRef(custom_validator_config_));
     auto context = std::make_shared<Extensions::TransportSockets::Tls::ClientContextImpl>(
-        *store_.rootScope(), client_context_config_, factory_context_);
+        *store_.rootScope(), client_context_config_, time_system_);
     verifier_ = std::make_unique<EnvoyQuicProofVerifier>(std::move(context));
   }
 
@@ -99,7 +98,7 @@ class EnvoyQuicProofVerifierTest : public testing::Test {
   absl::optional<envoy::config::core::v3::TypedExtensionConfig> custom_validator_config_{
       absl::nullopt};
   NiceMock<Stats::MockStore> store_;
-  Server::Configuration::MockServerFactoryContext factory_context_;
+  Event::GlobalTimeSystem time_system_;
   NiceMock<Ssl::MockClientContextConfig> client_context_config_;
   Ssl::MockCertificateValidationContextConfig cert_validation_ctx_config_;
   std::unique_ptr<EnvoyQuicProofVerifier> verifier_;
diff --git a/test/common/tls/cert_validator/BUILD b/test/common/tls/cert_validator/BUILD
index 76c9d63dc831c..f0b243a980d36 100644
--- a/test/common/tls/cert_validator/BUILD
+++ b/test/common/tls/cert_validator/BUILD
@@ -21,7 +21,6 @@ envoy_cc_test(
         "//source/common/tls/cert_validator:cert_validator_lib",
         "//test/common/tls:ssl_test_utils",
         "//test/common/tls/cert_validator:test_common",
-        "//test/mocks/server:server_factory_context_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:test_runtime_lib",
     ],
@@ -57,7 +56,6 @@ envoy_cc_test(
     deps = [
         "//source/common/protobuf:utility_lib",
         "//source/common/tls/cert_validator:cert_validator_lib",
-        "//test/mocks/server:server_factory_context_mocks",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/extensions/transport_sockets/tls/v3:pkg_cc_proto",
     ],
diff --git a/test/common/tls/cert_validator/default_validator_integration_test.cc b/test/common/tls/cert_validator/default_validator_integration_test.cc
index ac5b3232863fc..a76e87ed04fde 100644
--- a/test/common/tls/cert_validator/default_validator_integration_test.cc
+++ b/test/common/tls/cert_validator/default_validator_integration_test.cc
@@ -14,8 +14,8 @@ namespace Ssl {
 
 void SslCertValidatorIntegrationTest::initialize() {
   HttpIntegrationTest::initialize();
-  context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      factory_context_.serverFactoryContext());
+  context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
   registerTestServerPorts({"http"});
 
   test_server_->counter(listenerStatPrefix("ssl.fail_verify_error"))->reset();
diff --git a/test/common/tls/cert_validator/default_validator_test.cc b/test/common/tls/cert_validator/default_validator_test.cc
index aff9ed58697d8..0fa44d2d60530 100644
--- a/test/common/tls/cert_validator/default_validator_test.cc
+++ b/test/common/tls/cert_validator/default_validator_test.cc
@@ -6,7 +6,6 @@
 
 #include "test/common/tls/cert_validator/test_common.h"
 #include "test/common/tls/ssl_test_utility.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/test_common/environment.h"
 #include "test/test_common/test_runtime.h"
 #include "test/test_common/utility.h"
@@ -35,34 +34,28 @@ TEST(DefaultCertValidatorTest, TestVerifySubjectAltNameDNSMatched) {
 }
 
 TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameDNSMatched) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir }}/test/common/tls/test_data/san_dns_cert.pem"));
   envoy::type::matcher::v3::StringMatcher matcher;
   matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.com)raw"));
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
 TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameIncorrectTypeMatched) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir }}/test/common/tls/test_data/san_dns_cert.pem"));
   envoy::type::matcher::v3::StringMatcher matcher;
   matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.com)raw"));
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher)});
   EXPECT_FALSE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
 TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameWildcardDNSMatched) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir "
                                   "}}/test/common/tls/test_data/san_multiple_dns_cert.pem"));
@@ -70,13 +63,11 @@ TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameWildcardDNSMatched) {
   matcher.set_exact("api.example.com");
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
 TEST(DefaultCertValidatorTest, TestMultiLevelMatch) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   // san_multiple_dns_cert matches *.example.com
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir "
@@ -85,7 +76,7 @@ TEST(DefaultCertValidatorTest, TestMultiLevelMatch) {
   matcher.set_exact("foo.api.example.com");
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   EXPECT_FALSE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
@@ -107,15 +98,13 @@ TEST(DefaultCertValidatorTest, TestVerifySubjectAltMultiDomain) {
 }
 
 TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameURIMatched) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir }}/test/common/tls/test_data/san_uri_cert.pem"));
   envoy::type::matcher::v3::StringMatcher matcher;
   matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw(spiffe://lyft.com/[^/]*-team)raw"));
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher)});
   EXPECT_TRUE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
@@ -128,40 +117,37 @@ TEST(DefaultCertValidatorTest, TestVerifySubjectAltNameNotMatched) {
 }
 
 TEST(DefaultCertValidatorTest, TestMatchSubjectAltNameNotMatched) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir }}/test/common/tls/test_data/san_dns_cert.pem"));
   envoy::type::matcher::v3::StringMatcher matcher;
   matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example\.net)raw"));
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_IPADD, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_IPADD, matcher)});
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_URI, matcher)});
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_EMAIL, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_EMAIL, matcher)});
   EXPECT_FALSE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
 TEST(DefaultCertValidatorTest, TestCertificateVerificationWithSANMatcher) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
   Stats::TestUtil::TestStore test_store;
   SslStats stats = generateSslStats(*test_store.rootScope());
   // Create the default validator object.
   auto default_validator =
       std::make_unique<Extensions::TransportSockets::Tls::DefaultCertValidator>(
-          /*CertificateValidationContextConfig=*/nullptr, stats, context);
+          /*CertificateValidationContextConfig=*/nullptr, stats,
+          Event::GlobalTimeSystem().timeSystem());
 
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir }}/test/common/tls/test_data/san_dns_cert.pem"));
   envoy::type::matcher::v3::StringMatcher matcher;
   matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example.com)raw"));
   std::vector<SanMatcherPtr> san_matchers;
-  san_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+  san_matchers.push_back(SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   // Verify the certificate with correct SAN regex matcher.
   EXPECT_EQ(default_validator->verifyCertificate(cert.get(), /*verify_san_list=*/{}, san_matchers,
                                                  nullptr, nullptr),
@@ -171,7 +157,7 @@ TEST(DefaultCertValidatorTest, TestCertificateVerificationWithSANMatcher) {
   matcher.MergeFrom(TestUtility::createExactMatcher("hello.example.com"));
   std::vector<SanMatcherPtr> invalid_san_matchers;
   invalid_san_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   std::string error;
   // Verify the certificate with incorrect SAN exact matcher.
   EXPECT_EQ(default_validator->verifyCertificate(cert.get(), /*verify_san_list=*/{},
@@ -181,13 +167,13 @@ TEST(DefaultCertValidatorTest, TestCertificateVerificationWithSANMatcher) {
 }
 
 TEST(DefaultCertValidatorTest, TestCertificateVerificationWithNoValidationContext) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
   Stats::TestUtil::TestStore test_store;
   SslStats stats = generateSslStats(*test_store.rootScope());
   // Create the default validator object.
   auto default_validator =
       std::make_unique<Extensions::TransportSockets::Tls::DefaultCertValidator>(
-          /*CertificateValidationContextConfig=*/nullptr, stats, context);
+          /*CertificateValidationContextConfig=*/nullptr, stats,
+          Event::GlobalTimeSystem().timeSystem());
 
   EXPECT_EQ(default_validator->verifyCertificate(/*cert=*/nullptr, /*verify_san_list=*/{},
                                                  /*subject_alt_name_matchers=*/{}, nullptr,
@@ -205,13 +191,13 @@ TEST(DefaultCertValidatorTest, TestCertificateVerificationWithNoValidationContex
 }
 
 TEST(DefaultCertValidatorTest, TestCertificateVerificationWithEmptyCertChain) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
   Stats::TestUtil::TestStore test_store;
   SslStats stats = generateSslStats(*test_store.rootScope());
   // Create the default validator object.
   auto default_validator =
       std::make_unique<Extensions::TransportSockets::Tls::DefaultCertValidator>(
-          /*CertificateValidationContextConfig=*/nullptr, stats, context);
+          /*CertificateValidationContextConfig=*/nullptr, stats,
+          Event::GlobalTimeSystem().timeSystem());
 
   SSLContextPtr ssl_ctx = SSL_CTX_new(TLS_method());
   bssl::UniquePtr<STACK_OF(X509)> cert_chain(sk_X509_new_null());
@@ -224,20 +210,18 @@ TEST(DefaultCertValidatorTest, TestCertificateVerificationWithEmptyCertChain) {
 }
 
 TEST(DefaultCertValidatorTest, NoSanInCert) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   bssl::UniquePtr<X509> cert = readCertFromFile(
       TestEnvironment::substitute("{{ test_rundir }}/test/common/tls/test_data/fake_ca_cert.pem"));
   envoy::type::matcher::v3::StringMatcher matcher;
   matcher.MergeFrom(TestUtility::createRegexMatcher(R"raw([^.]*\.example\.net)raw"));
   std::vector<SanMatcherPtr> subject_alt_name_matchers;
   subject_alt_name_matchers.push_back(
-      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher, context)});
+      SanMatcherPtr{std::make_unique<StringSanMatcher>(GEN_DNS, matcher)});
   EXPECT_FALSE(DefaultCertValidator::matchSubjectAltName(cert.get(), subject_alt_name_matchers));
 }
 
 TEST(DefaultCertValidatorTest, WithVerifyDepth) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+
   Stats::TestUtil::TestStore test_store;
   SslStats stats = generateSslStats(*test_store.rootScope());
   envoy::config::core::v3::TypedExtensionConfig typed_conf;
@@ -261,8 +245,8 @@ TEST(DefaultCertValidatorTest, WithVerifyDepth) {
       std::make_unique<TestCertificateValidationContextConfig>(typed_conf, false, san_matchers,
                                                                ca_cert_str, 2);
   auto default_validator =
-      std::make_unique<Extensions::TransportSockets::Tls::DefaultCertValidator>(test_config.get(),
-                                                                                stats, context);
+      std::make_unique<Extensions::TransportSockets::Tls::DefaultCertValidator>(
+          test_config.get(), stats, Event::GlobalTimeSystem().timeSystem());
 
   STACK_OF(X509)* intermediates = cert_chain.get();
   SSLContextPtr ssl_ctx = SSL_CTX_new(TLS_method());
@@ -282,7 +266,7 @@ TEST(DefaultCertValidatorTest, WithVerifyDepth) {
   test_config = std::make_unique<TestCertificateValidationContextConfig>(typed_conf, false,
                                                                          san_matchers, ca_cert_str);
   default_validator = std::make_unique<Extensions::TransportSockets::Tls::DefaultCertValidator>(
-      test_config.get(), stats, context);
+      test_config.get(), stats, Event::GlobalTimeSystem().timeSystem());
 
   // Re-initialize context
   ssl_ctx = SSL_CTX_new(TLS_method());
@@ -337,8 +321,6 @@ class MockCertificateValidationContextConfig : public Ssl::CertificateValidation
 };
 
 TEST(DefaultCertValidatorTest, TestUnexpectedSanMatcherType) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   auto mock_context_config = std::make_unique<MockCertificateValidationContextConfig>();
   EXPECT_CALL(*mock_context_config.get(), trustChainVerification())
       .WillRepeatedly(testing::Return(envoy::extensions::transport_sockets::tls::v3::
@@ -347,16 +329,14 @@ TEST(DefaultCertValidatorTest, TestUnexpectedSanMatcherType) {
       std::vector<envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher>();
   Stats::TestUtil::TestStore store;
   auto ssl_stats = generateSslStats(*store.rootScope());
-  auto validator =
-      std::make_unique<DefaultCertValidator>(mock_context_config.get(), ssl_stats, context);
+  auto validator = std::make_unique<DefaultCertValidator>(mock_context_config.get(), ssl_stats,
+                                                          Event::GlobalTimeSystem().timeSystem());
   auto ctx = std::vector<SSL_CTX*>();
   EXPECT_THROW_WITH_REGEX(validator->initializeSslContexts(ctx, false), EnvoyException,
                           "Failed to create string SAN matcher of type.*");
 }
 
 TEST(DefaultCertValidatorTest, TestInitializeSslContextFailure) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   auto mock_context_config = std::make_unique<MockCertificateValidationContextConfig>(
       "-----BEGIN CERTIFICATE-----\nincomplete payload");
   EXPECT_CALL(*mock_context_config.get(), trustChainVerification())
@@ -365,8 +345,8 @@ TEST(DefaultCertValidatorTest, TestInitializeSslContextFailure) {
 
   Stats::TestUtil::TestStore store;
   auto ssl_stats = generateSslStats(*store.rootScope());
-  auto validator =
-      std::make_unique<DefaultCertValidator>(mock_context_config.get(), ssl_stats, context);
+  auto validator = std::make_unique<DefaultCertValidator>(mock_context_config.get(), ssl_stats,
+                                                          Event::GlobalTimeSystem().timeSystem());
   auto ctx = std::vector<SSL_CTX*>();
   EXPECT_THROW_WITH_REGEX(validator->initializeSslContexts(ctx, false), EnvoyException,
                           "Failed to load trusted CA certificates from.*");
diff --git a/test/common/tls/cert_validator/san_matcher_test.cc b/test/common/tls/cert_validator/san_matcher_test.cc
index 3b330866a3797..11f67e4671195 100644
--- a/test/common/tls/cert_validator/san_matcher_test.cc
+++ b/test/common/tls/cert_validator/san_matcher_test.cc
@@ -4,7 +4,6 @@
 #include "source/common/protobuf/utility.h"
 #include "source/common/tls/cert_validator/san_matcher.h"
 
-#include "test/mocks/server/server_factory_context.h"
 #include "test/test_common/utility.h"
 
 #include "gmock/gmock.h"
@@ -17,8 +16,6 @@ namespace Tls {
 
 // Verify that we get a valid string san matcher for all valid san types.
 TEST(SanMatcherConfigTest, TestValidSanType) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
-
   // Iterate over all san type enums.
   for (envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType san_type =
            envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType_MIN;
@@ -32,9 +29,9 @@ TEST(SanMatcherConfigTest, TestValidSanType) {
     san_matcher.set_san_type(san_type);
     if (san_type == envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::
                         SAN_TYPE_UNSPECIFIED) {
-      EXPECT_DEATH(createStringSanMatcher(san_matcher, context), "unhandled value");
+      EXPECT_DEATH(createStringSanMatcher(san_matcher), "unhandled value");
     } else {
-      const SanMatcherPtr matcher = createStringSanMatcher(san_matcher, context);
+      const SanMatcherPtr matcher = createStringSanMatcher(san_matcher);
       EXPECT_NE(matcher.get(), nullptr);
       // Verify that the message is valid.
       TestUtility::validate(san_matcher);
@@ -43,7 +40,6 @@ TEST(SanMatcherConfigTest, TestValidSanType) {
 }
 
 TEST(SanMatcherConfigTest, UnspecifiedSanType) {
-  NiceMock<Server::Configuration::MockServerFactoryContext> context;
   envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher san_matcher;
   san_matcher.mutable_matcher()->set_exact("foo.example");
   // Do not set san_type
@@ -58,7 +54,7 @@ TEST(SanMatcherConfigTest, UnspecifiedSanType) {
       static_cast<envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType>(
           static_cast<int>(123));
   san_matcher.set_san_type(san_type);
-  EXPECT_EQ(createStringSanMatcher(san_matcher, context), nullptr);
+  EXPECT_EQ(createStringSanMatcher(san_matcher), nullptr);
 }
 
 } // namespace Tls
diff --git a/test/common/tls/cert_validator/timed_cert_validator.h b/test/common/tls/cert_validator/timed_cert_validator.h
index 2ea320d87af2a..45a57fc5eda2f 100644
--- a/test/common/tls/cert_validator/timed_cert_validator.h
+++ b/test/common/tls/cert_validator/timed_cert_validator.h
@@ -18,9 +18,8 @@ class TimedCertValidator : public DefaultCertValidator {
 public:
   TimedCertValidator(std::chrono::milliseconds validation_time_out_ms,
                      const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                     Server::Configuration::CommonFactoryContext& context,
-                     absl::optional<std::string> expected_host_name)
-      : DefaultCertValidator(config, stats, context),
+                     TimeSource& time_source, absl::optional<std::string> expected_host_name)
+      : DefaultCertValidator(config, stats, time_source),
         validation_time_out_ms_(validation_time_out_ms), expected_host_name_(expected_host_name) {}
 
   ValidationResults
@@ -50,11 +49,10 @@ class TimedCertValidator : public DefaultCertValidator {
 
 class TimedCertValidatorFactory : public CertValidatorFactory {
 public:
-  CertValidatorPtr
-  createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config, SslStats& stats,
-                      Server::Configuration::CommonFactoryContext& context) override {
+  CertValidatorPtr createCertValidator(const Envoy::Ssl::CertificateValidationContextConfig* config,
+                                       SslStats& stats, TimeSource& time_source) override {
     auto validator = std::make_unique<TimedCertValidator>(validation_time_out_ms_, config, stats,
-                                                          context, expected_host_name_);
+                                                          time_source, expected_host_name_);
     if (expected_peer_address_.has_value()) {
       validator->setExpectedPeerAddress(expected_peer_address_.value());
     }
diff --git a/test/common/tls/context_impl_test.cc b/test/common/tls/context_impl_test.cc
index faa1414733d79..dadbae2c6f7b8 100644
--- a/test/common/tls/context_impl_test.cc
+++ b/test/common/tls/context_impl_test.cc
@@ -118,8 +118,8 @@ class SslContextImplTest : public SslCertsTest {
   }
 
 protected:
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
-  ContextManagerImpl manager_{server_factory_context_};
+  Event::SimulatedTimeSystem time_system_;
+  ContextManagerImpl manager_{time_system_};
 };
 
 TEST_F(SslContextImplTest, TestCipherSuites) {
@@ -1157,8 +1157,8 @@ class ClientContextConfigImplTest : public SslCertsTest {
     }};
   }
 
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
-  ContextManagerImpl manager_{server_factory_context_};
+  Event::SimulatedTimeSystem time_system_;
+  ContextManagerImpl manager_{time_system_};
 };
 
 // Validate that empty SNI (according to C string rules) fails config validation.
@@ -1288,7 +1288,8 @@ TEST_F(ClientContextConfigImplTest, RSA3072Cert) {
   TestUtility::loadFromYaml(TestEnvironment::substitute(tls_certificate_yaml),
                             *tls_context.mutable_common_tls_context()->add_tls_certificates());
   ClientContextConfigImpl client_context_config(tls_context, factory_context_);
-  ContextManagerImpl manager(server_factory_context_);
+  Event::SimulatedTimeSystem time_system;
+  ContextManagerImpl manager(time_system);
   Stats::IsolatedStoreImpl store;
   auto context = manager_.createSslClientContext(*store.rootScope(), client_context_config);
   auto cleanup = cleanUpHelper(context);
@@ -1764,10 +1765,7 @@ TEST_F(ClientContextConfigImplTest, MissingStaticCertificateValidationContext) {
       "Unknown static certificate validation context: missing");
 }
 
-class ServerContextConfigImplTest : public SslCertsTest {
-public:
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
-};
+class ServerContextConfigImplTest : public SslCertsTest {};
 
 // Multiple TLS certificates are supported.
 TEST_F(ServerContextConfigImplTest, MultipleTlsCertificates) {
@@ -1898,7 +1896,8 @@ TEST_F(ServerContextConfigImplTest, TlsCertificateNonEmpty) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context;
   tls_context.mutable_common_tls_context()->add_tls_certificates();
   ServerContextConfigImpl client_context_config(tls_context, factory_context_);
-  ContextManagerImpl manager(server_factory_context_);
+  Event::SimulatedTimeSystem time_system;
+  ContextManagerImpl manager(time_system);
   Stats::IsolatedStoreImpl store;
   EXPECT_THROW_WITH_MESSAGE(
       Envoy::Ssl::ServerContextSharedPtr server_ctx(manager.createSslServerContext(
@@ -2003,7 +2002,8 @@ TEST_F(ServerContextConfigImplTest, PrivateKeyMethodLoadFailureNoMethod) {
   NiceMock<Ssl::MockPrivateKeyMethodManager> private_key_method_manager;
   auto private_key_method_provider_ptr =
       std::make_shared<NiceMock<Ssl::MockPrivateKeyMethodProvider>>();
-  ContextManagerImpl manager(server_factory_context_);
+  Event::SimulatedTimeSystem time_system;
+  ContextManagerImpl manager(time_system);
   EXPECT_CALL(factory_context_, sslContextManager()).WillOnce(ReturnRef(context_manager));
   EXPECT_CALL(context_manager, privateKeyMethodManager())
       .WillOnce(ReturnRef(private_key_method_manager));
@@ -2201,8 +2201,8 @@ TEST_F(ServerContextConfigImplTest, Pkcs12LoadFailureBothPkcs12AndCertChain) {
 class TestContextImpl : public ContextImpl {
 public:
   TestContextImpl(Stats::Scope& scope, const Envoy::Ssl::ContextConfig& config,
-                  Server::Configuration::ServerFactoryContext& factory_context)
-      : ContextImpl(scope, config, factory_context, nullptr), pool_(scope.symbolTable()),
+                  TimeSource& time_source)
+      : ContextImpl(scope, config, time_source, nullptr), pool_(scope.symbolTable()),
         fallback_(pool_.add("fallback")) {}
 
   void incCounter(absl::string_view name, absl::string_view value) {
@@ -2220,7 +2220,7 @@ class SslContextStatsTest : public SslContextImplTest {
     client_context_config_ =
         std::make_unique<ClientContextConfigImpl>(tls_context_, factory_context_);
     context_ = std::make_unique<TestContextImpl>(*store_.rootScope(), *client_context_config_,
-                                                 server_factory_context_);
+                                                 time_system_);
   }
 
   Stats::TestUtil::TestStore store_;
diff --git a/test/common/tls/handshaker_factory_test.cc b/test/common/tls/handshaker_factory_test.cc
index e161b5eea0475..f601137085904 100644
--- a/test/common/tls/handshaker_factory_test.cc
+++ b/test/common/tls/handshaker_factory_test.cc
@@ -92,8 +92,8 @@ class HandshakerFactoryImplForTest
 class HandshakerFactoryTest : public testing::Test {
 protected:
   HandshakerFactoryTest()
-      : context_manager_(std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-            server_factory_context_)),
+      : context_manager_(
+            std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(time_system_)),
         registered_factory_(handshaker_factory_) {
     scoped_runtime_.mergeValues(
         {{"envoy.reloadable_features.no_extension_lookup_by_name", "false"}});
@@ -111,7 +111,7 @@ class HandshakerFactoryTest : public testing::Test {
     return SSL_get_SSL_CTX(ssl);
   }
 
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
+  Event::GlobalTimeSystem time_system_;
   Stats::IsolatedStoreImpl stats_store_;
   std::unique_ptr<Extensions::TransportSockets::Tls::ContextManagerImpl> context_manager_;
   HandshakerFactoryImplForTest handshaker_factory_;
@@ -248,8 +248,8 @@ class HandshakerFactoryImplForDownstreamTest
 class HandshakerFactoryDownstreamTest : public testing::Test {
 protected:
   HandshakerFactoryDownstreamTest()
-      : context_manager_(std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-            server_factory_context_)) {
+      : context_manager_(
+            std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(time_system_)) {
     scoped_runtime_.mergeValues(
         {{"envoy.reloadable_features.no_extension_lookup_by_name", "false"}});
   }
@@ -262,7 +262,7 @@ class HandshakerFactoryDownstreamTest : public testing::Test {
     return SSL_get_SSL_CTX(ssl);
   }
 
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
+  Event::GlobalTimeSystem time_system_;
   Stats::IsolatedStoreImpl stats_store_;
   std::unique_ptr<Extensions::TransportSockets::Tls::ContextManagerImpl> context_manager_;
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context_;
diff --git a/test/common/tls/integration/ssl_integration_test.cc b/test/common/tls/integration/ssl_integration_test.cc
index ffae471e9e906..885494ce1f33a 100644
--- a/test/common/tls/integration/ssl_integration_test.cc
+++ b/test/common/tls/integration/ssl_integration_test.cc
@@ -66,8 +66,8 @@ void SslIntegrationTestBase::initialize() {
 
   HttpIntegrationTest::initialize();
 
-  context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      server_factory_context_);
+  context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
 
   registerTestServerPorts({"http"});
 }
diff --git a/test/common/tls/ssl_socket_test.cc b/test/common/tls/ssl_socket_test.cc
index dc231f41eaad3..b72f7ad6596b5 100644
--- a/test/common/tls/ssl_socket_test.cc
+++ b/test/common/tls/ssl_socket_test.cc
@@ -47,7 +47,6 @@
 #include "test/mocks/network/mocks.h"
 #include "test/mocks/runtime/mocks.h"
 #include "test/mocks/secret/mocks.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/server/transport_socket_factory_context.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/mocks/stats/mocks.h"
@@ -347,9 +346,8 @@ void testUtil(const TestUtilOptions& options) {
   Api::ApiPtr server_api = Api::createApiForTest(server_stats_store, time_system);
   NiceMock<Runtime::MockLoader> runtime;
   testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
-      transport_socket_factory_context;
-  ON_CALL(transport_socket_factory_context.server_context_, api())
-      .WillByDefault(ReturnRef(*server_api));
+      server_factory_context;
+  ON_CALL(server_factory_context.server_context_, api()).WillByDefault(ReturnRef(*server_api));
 
   // For private key method testing.
   NiceMock<Ssl::MockContextManager> context_manager;
@@ -358,7 +356,7 @@ void testUtil(const TestUtilOptions& options) {
       test_private_key_method_factory(test_factory);
   PrivateKeyMethodManagerImpl private_key_method_manager;
   if (options.expectedPrivateKeyMethod()) {
-    EXPECT_CALL(transport_socket_factory_context, sslContextManager())
+    EXPECT_CALL(server_factory_context, sslContextManager())
         .WillOnce(ReturnRef(context_manager))
         .WillRepeatedly(ReturnRef(context_manager));
     EXPECT_CALL(context_manager, privateKeyMethodManager())
@@ -369,10 +367,9 @@ void testUtil(const TestUtilOptions& options) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(options.serverCtxYaml()),
                             server_tls_context);
-  auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context,
-                                                              transport_socket_factory_context);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  auto server_cfg =
+      std::make_unique<ServerContextConfigImpl>(server_tls_context, server_factory_context);
+  ContextManagerImpl manager(*time_system);
   Event::DispatcherPtr dispatcher = server_api->allocateDispatcher("test_thread");
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -710,10 +707,7 @@ class TestUtilOptionsV2 : public TestUtilOptionsBase {
 
 void testUtilV2(const TestUtilOptionsV2& options) {
   Event::SimulatedTimeSystem time_system;
-  NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
-      transport_socket_factory_context;
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(*time_system);
 
   // SNI-based selection logic isn't happening in SslSocket anymore.
   ASSERT(options.listener().filter_chains().size() == 1);
@@ -722,9 +716,10 @@ void testUtilV2(const TestUtilOptionsV2& options) {
                                         filter_chain.filter_chain_match().server_names().end());
   Stats::TestUtil::TestStore server_stats_store;
   Api::ApiPtr server_api = Api::createApiForTest(server_stats_store, time_system);
+  testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
+      server_factory_context;
   NiceMock<Runtime::MockLoader> runtime;
-  ON_CALL(transport_socket_factory_context.server_context_, api())
-      .WillByDefault(ReturnRef(*server_api));
+  ON_CALL(server_factory_context.server_context_, api()).WillByDefault(ReturnRef(*server_api));
 
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context;
   const envoy::config::core::v3::TransportSocket& transport_socket =
@@ -732,8 +727,7 @@ void testUtilV2(const TestUtilOptionsV2& options) {
   ASSERT(transport_socket.has_typed_config());
   transport_socket.typed_config().UnpackTo(&tls_context);
 
-  auto server_cfg =
-      std::make_unique<ServerContextConfigImpl>(tls_context, transport_socket_factory_context);
+  auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context, server_factory_context);
 
   ServerSslSocketFactory server_ssl_socket_factory(std::move(server_cfg), manager,
                                                    *server_stats_store.rootScope(), server_names);
@@ -1022,8 +1016,7 @@ TEST_P(SslSocketTest, ServerTransportSocketOptions) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
   auto ssl_socket = server_ssl_socket_factory.createDownstreamTransportSocket();
@@ -3072,8 +3065,7 @@ TEST_P(SslSocketTest, FlushCloseDuringHandshake) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -3132,8 +3124,7 @@ TEST_P(SslSocketTest, HalfClose) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -3218,8 +3209,7 @@ TEST_P(SslSocketTest, ShutdownWithCloseNotify) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -3310,8 +3300,7 @@ TEST_P(SslSocketTest, ShutdownWithoutCloseNotify) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -3418,8 +3407,7 @@ TEST_P(SslSocketTest, ClientAuthMultipleCAs) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -3501,26 +3489,24 @@ void testTicketSessionResumption(const std::string& server_ctx_yaml1,
                                  const Network::Address::IpVersion ip_version,
                                  const uint32_t expected_lifetime_hint = 0) {
   Event::SimulatedTimeSystem time_system;
-  NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
-      transport_socket_factory_context;
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(*time_system);
 
   Stats::TestUtil::TestStore server_stats_store;
   Api::ApiPtr server_api = Api::createApiForTest(server_stats_store, time_system);
   NiceMock<Runtime::MockLoader> runtime;
-  ON_CALL(transport_socket_factory_context.server_context_, api())
-      .WillByDefault(ReturnRef(*server_api));
+  testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
+      server_factory_context;
+  ON_CALL(server_factory_context.server_context_, api()).WillByDefault(ReturnRef(*server_api));
 
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context1;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml1), server_tls_context1);
-  auto server_cfg1 = std::make_unique<ServerContextConfigImpl>(server_tls_context1,
-                                                               transport_socket_factory_context);
+  auto server_cfg1 =
+      std::make_unique<ServerContextConfigImpl>(server_tls_context1, server_factory_context);
 
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context2;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml2), server_tls_context2);
-  auto server_cfg2 = std::make_unique<ServerContextConfigImpl>(server_tls_context2,
-                                                               transport_socket_factory_context);
+  auto server_cfg2 =
+      std::make_unique<ServerContextConfigImpl>(server_tls_context2, server_factory_context);
   ServerSslSocketFactory server_ssl_socket_factory1(std::move(server_cfg1), manager,
                                                     *server_stats_store.rootScope(), server_names1);
   ServerSslSocketFactory server_ssl_socket_factory2(std::move(server_cfg2), manager,
@@ -3661,21 +3647,19 @@ void testSupportForSessionResumption(const std::string& server_ctx_yaml,
                                      bool expect_stateful,
                                      const Network::Address::IpVersion ip_version) {
   Event::SimulatedTimeSystem time_system;
-  NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
-      transport_socket_factory_context;
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(*time_system);
 
   Stats::IsolatedStoreImpl server_stats_store;
   Api::ApiPtr server_api = Api::createApiForTest(server_stats_store, time_system);
   NiceMock<Runtime::MockLoader> runtime;
-  ON_CALL(transport_socket_factory_context.server_context_, api())
-      .WillByDefault(ReturnRef(*server_api));
+  testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
+      server_factory_context;
+  ON_CALL(server_factory_context.server_context_, api()).WillByDefault(ReturnRef(*server_api));
 
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
-  auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context,
-                                                              transport_socket_factory_context);
+  auto server_cfg =
+      std::make_unique<ServerContextConfigImpl>(server_tls_context, server_factory_context);
 
   ServerSslSocketFactory server_ssl_socket_factory(std::move(server_cfg), manager,
                                                    *server_stats_store.rootScope(), {});
@@ -4321,8 +4305,7 @@ TEST_P(SslSocketTest, ClientAuthCrossListenerSessionResumption) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context2;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server2_ctx_yaml), tls_context2);
   auto server2_cfg = std::make_unique<ServerContextConfigImpl>(tls_context2, factory_context_);
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -4439,20 +4422,18 @@ void SslSocketTest::testClientSessionResumption(const std::string& server_ctx_ya
                                                 const Network::Address::IpVersion version) {
   InSequence s;
 
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  ContextManagerImpl manager(server_factory_context);
+  ContextManagerImpl manager(time_system_);
 
   Stats::TestUtil::TestStore server_stats_store;
   Api::ApiPtr server_api = Api::createApiForTest(server_stats_store, time_system_);
   testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext>
-      transport_socket_factory_context;
-  ON_CALL(transport_socket_factory_context.server_context_, api())
-      .WillByDefault(ReturnRef(*server_api));
+      server_factory_context;
+  ON_CALL(server_factory_context.server_context_, api()).WillByDefault(ReturnRef(*server_api));
 
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_ctx_proto;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_ctx_proto);
   auto server_cfg =
-      std::make_unique<ServerContextConfigImpl>(server_ctx_proto, transport_socket_factory_context);
+      std::make_unique<ServerContextConfigImpl>(server_ctx_proto, server_factory_context);
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
 
@@ -4717,7 +4698,7 @@ TEST_P(SslSocketTest, SslError) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(tls_context, factory_context_);
-  ContextManagerImpl manager(factory_context_.serverFactoryContext());
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -5249,7 +5230,7 @@ TEST_P(SslSocketTest, SetSignatureAlgorithms) {
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext server_tls_context;
   TestUtility::loadFromYaml(TestEnvironment::substitute(server_ctx_yaml), server_tls_context);
   auto server_cfg = std::make_unique<ServerContextConfigImpl>(server_tls_context, factory_context_);
-  ContextManagerImpl manager(factory_context_.serverFactoryContext());
+  ContextManagerImpl manager(time_system_);
   Stats::TestUtil::TestStore server_stats_store;
   ServerSslSocketFactory server_ssl_socket_factory(
       std::move(server_cfg), manager, *server_stats_store.rootScope(), std::vector<std::string>{});
@@ -5864,7 +5845,7 @@ TEST_P(SslSocketTest, DownstreamNotReadySslSocket) {
   EXPECT_TRUE(server_cfg->tlsCertificates().empty());
   EXPECT_FALSE(server_cfg->isReady());
 
-  ContextManagerImpl manager(factory_context_.serverFactoryContext());
+  ContextManagerImpl manager(time_system_);
   ServerSslSocketFactory server_ssl_socket_factory(std::move(server_cfg), manager,
                                                    *factory_context_.store_.rootScope(),
                                                    std::vector<std::string>{});
@@ -5902,7 +5883,7 @@ TEST_P(SslSocketTest, UpstreamNotReadySslSocket) {
   EXPECT_TRUE(client_cfg->tlsCertificates().empty());
   EXPECT_FALSE(client_cfg->isReady());
 
-  ContextManagerImpl manager(factory_context_.serverFactoryContext());
+  ContextManagerImpl manager(time_system_);
   ClientSslSocketFactory client_ssl_socket_factory(std::move(client_cfg), manager,
                                                    *factory_context_.store_.rootScope());
   auto transport_socket = client_ssl_socket_factory.createTransportSocket(nullptr, nullptr);
@@ -5930,7 +5911,7 @@ TEST_P(SslSocketTest, TestTransportSocketCallback) {
   envoy::extensions::transport_sockets::tls::v3::UpstreamTlsContext tls_context;
   auto client_cfg = std::make_unique<ClientContextConfigImpl>(tls_context, factory_context_);
 
-  ContextManagerImpl manager(factory_context_.serverFactoryContext());
+  ContextManagerImpl manager(time_system_);
   ClientSslSocketFactory client_ssl_socket_factory(std::move(client_cfg), manager,
                                                    *factory_context_.store_.rootScope());
 
@@ -5954,7 +5935,7 @@ class SslReadBufferLimitTest : public SslSocketTest {
                               downstream_tls_context_);
     auto server_cfg =
         std::make_unique<ServerContextConfigImpl>(downstream_tls_context_, factory_context_);
-    manager_ = std::make_unique<ContextManagerImpl>(factory_context_.serverFactoryContext());
+    manager_ = std::make_unique<ContextManagerImpl>(time_system_);
     server_ssl_socket_factory_ = std::make_unique<ServerSslSocketFactory>(
         std::move(server_cfg), *manager_, *server_stats_store_.rootScope(),
         std::vector<std::string>{});
diff --git a/test/common/upstream/hds_test.cc b/test/common/upstream/hds_test.cc
index c58700be552a7..82acb9d72e8d6 100644
--- a/test/common/upstream/hds_test.cc
+++ b/test/common/upstream/hds_test.cc
@@ -61,7 +61,8 @@ class HdsTest : public testing::Test {
   HdsTest()
       : retry_timer_(new Event::MockTimer()), server_response_timer_(new Event::MockTimer()),
         async_client_(new Grpc::MockAsyncClient()),
-        api_(Api::createApiForTest(stats_store_, random_)), ssl_context_manager_(server_context_) {
+        api_(Api::createApiForTest(stats_store_, random_)),
+        ssl_context_manager_(api_->timeSource()) {
     ON_CALL(server_context_, api()).WillByDefault(ReturnRef(*api_));
     node_.set_id("hds-node");
   }
diff --git a/test/common/upstream/test_cluster_manager.h b/test/common/upstream/test_cluster_manager.h
index a8e232eacb9eb..eb110f9d672e1 100644
--- a/test/common/upstream/test_cluster_manager.h
+++ b/test/common/upstream/test_cluster_manager.h
@@ -146,7 +146,8 @@ class TestClusterManagerFactory : public ClusterManagerFactory {
       new NiceMock<Network::MockDnsResolver>};
   NiceMock<Runtime::MockLoader>& runtime_ = server_context_.runtime_loader_;
   NiceMock<Event::MockDispatcher>& dispatcher_ = server_context_.dispatcher_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_{server_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_{
+      dispatcher_.timeSource()};
   NiceMock<LocalInfo::MockLocalInfo>& local_info_ = server_context_.local_info_;
   NiceMock<Server::MockAdmin>& admin_ = server_context_.admin_;
   NiceMock<Secret::MockSecretManager> secret_manager_;
diff --git a/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc b/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
index 1b7e15d0ffe0d..90d2e7acde2ac 100644
--- a/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
+++ b/test/extensions/access_loggers/grpc/tcp_grpc_access_log_integration_test.cc
@@ -143,8 +143,8 @@ class TcpGrpcAccessLogIntegrationTest : public Grpc::GrpcClientIntegrationParamT
                           const Ssl::ClientSslTransportOptions& ssl_options = {},
                           const std::string& curves_list = "") {
     // Set up the SSL client.
-    context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-        server_factory_context_);
+    context_manager_ =
+        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
     Network::Address::InstanceConstSharedPtr address =
         Ssl::getSslAddress(version_, lookupPort("tcp_proxy"));
     context_ = Ssl::createClientSslTransportSocketFactory(ssl_options, *context_manager_, *api_);
diff --git a/test/extensions/filters/listener/tls_inspector/tls_inspector_integration_test.cc b/test/extensions/filters/listener/tls_inspector/tls_inspector_integration_test.cc
index aa2279c708393..78b57390d80db 100644
--- a/test/extensions/filters/listener/tls_inspector/tls_inspector_integration_test.cc
+++ b/test/extensions/filters/listener/tls_inspector/tls_inspector_integration_test.cc
@@ -90,8 +90,8 @@ class TlsInspectorIntegrationTest : public testing::TestWithParam<Network::Addre
     useListenerAccessLog(log_format);
     BaseIntegrationTest::initialize();
 
-    context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-        server_factory_context_);
+    context_manager_ =
+        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
   }
 
   void setupConnections(bool listener_filter_disabled, bool expect_connection_open, bool ssl_client,
diff --git a/test/extensions/string_matcher/lua/lua_test.cc b/test/extensions/string_matcher/lua/lua_test.cc
index 3842b89f3469a..4e834e0d6d710 100644
--- a/test/extensions/string_matcher/lua/lua_test.cc
+++ b/test/extensions/string_matcher/lua/lua_test.cc
@@ -88,20 +88,21 @@ TEST(LuaStringMatcher, LuaStdLib) {
 }
 
 TEST(LuaStringMatcher, NoCode) {
-  Api::MockApi api;
-  ThreadLocal::MockInstance tls;
+  ScopedInjectableLoader<Api::Api> api_inject(std::make_unique<Api::MockApi>());
+  ScopedInjectableLoader<ThreadLocal::SlotAllocator> tls_inject(
+      std::make_unique<ThreadLocal::MockInstance>());
 
   LuaStringMatcherFactory factory;
   ::envoy::extensions::string_matcher::lua::v3::Lua empty_config;
   ProtobufWkt::Any any;
   any.PackFrom(empty_config);
-  EXPECT_THROW_WITH_MESSAGE(factory.createStringMatcher(any, tls, api), EnvoyException,
+  EXPECT_THROW_WITH_MESSAGE(factory.createStringMatcher(any), EnvoyException,
                             "Failed to get lua string matcher code from source: INVALID_ARGUMENT: "
                             "Unexpected DataSource::specifier_case(): 0");
 
   empty_config.mutable_source_code()->set_inline_string("");
   any.PackFrom(empty_config);
-  EXPECT_THROW_WITH_MESSAGE(factory.createStringMatcher(any, tls, api), EnvoyException,
+  EXPECT_THROW_WITH_MESSAGE(factory.createStringMatcher(any), EnvoyException,
                             "Failed to get lua string matcher code from source: INVALID_ARGUMENT: "
                             "DataSource cannot be empty");
 }
diff --git a/test/extensions/transport_sockets/starttls/starttls_integration_test.cc b/test/extensions/transport_sockets/starttls/starttls_integration_test.cc
index 01a27199c184a..cb2564e38286e 100644
--- a/test/extensions/transport_sockets/starttls/starttls_integration_test.cc
+++ b/test/extensions/transport_sockets/starttls/starttls_integration_test.cc
@@ -208,8 +208,8 @@ void StartTlsIntegrationTest::initialize() {
       factory->createTransportSocketFactory(*config, factory_context_)};
 
   // Setup factories and contexts for tls transport socket.
-  tls_context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      server_factory_context_);
+  tls_context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
   tls_context_ = Ssl::createClientSslTransportSocketFactory({}, *tls_context_manager_, *api_);
   payload_reader_ = std::make_shared<WaitForPayloadReader>(*dispatcher_);
 
diff --git a/test/extensions/transport_sockets/starttls/upstream_starttls_integration_test.cc b/test/extensions/transport_sockets/starttls/upstream_starttls_integration_test.cc
index b106d0043f30f..f3efba23db8d3 100644
--- a/test/extensions/transport_sockets/starttls/upstream_starttls_integration_test.cc
+++ b/test/extensions/transport_sockets/starttls/upstream_starttls_integration_test.cc
@@ -249,8 +249,8 @@ void StartTlsIntegrationTest::initialize() {
   // Setup factory and context for tls transport socket.
   // The tls transport socket will be inserted into fake_upstream when
   // upstream starttls transport socket is converted to secure mode.
-  tls_context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      server_factory_context_);
+  tls_context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
 
   envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext downstream_tls_context;
 
diff --git a/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD b/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
index c95555b9be371..9f9644768aee1 100644
--- a/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
+++ b/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
@@ -25,7 +25,6 @@ envoy_extension_cc_test(
         "//source/extensions/transport_sockets/tls/cert_validator/spiffe:config",
         "//test/common/tls:ssl_test_utils",
         "//test/common/tls/cert_validator:test_common",
-        "//test/mocks/server:server_factory_context_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:simulated_time_system_lib",
         "//test/test_common:test_runtime_lib",
diff --git a/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc b/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc
index db9af217a43bb..1806d0985ed10 100644
--- a/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc
+++ b/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc
@@ -21,8 +21,8 @@ void SslSPIFFECertValidatorIntegrationTest::initialize() {
                                   .setAllowExpiredCertificate(allow_expired_cert_));
   HttpIntegrationTest::initialize();
 
-  context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      server_factory_context_);
+  context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
   registerTestServerPorts({"http"});
 }
 
diff --git a/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc b/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc
index 327298a3efe61..51cc1ad97016f 100644
--- a/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc
+++ b/test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc
@@ -13,7 +13,6 @@
 
 #include "test/common/tls/cert_validator/test_common.h"
 #include "test/common/tls/ssl_test_utility.h"
-#include "test/mocks/server/server_factory_context.h"
 #include "test/test_common/environment.h"
 #include "test/test_common/simulated_time_system.h"
 #include "test/test_common/test_runtime.h"
@@ -45,8 +44,7 @@ class TestSPIFFEValidator : public testing::Test {
     TestUtility::loadFromYaml(yaml, typed_conf);
     config_ = std::make_unique<TestCertificateValidationContextConfig>(
         typed_conf, allow_expired_certificate_, san_matchers_);
-    ON_CALL(factory_context_, timeSource()).WillByDefault(testing::ReturnRef(time_source));
-    validator_ = std::make_unique<SPIFFEValidator>(config_.get(), stats_, factory_context_);
+    validator_ = std::make_unique<SPIFFEValidator>(config_.get(), stats_, time_source);
   }
 
   void initialize(std::string yaml) {
@@ -54,7 +52,8 @@ class TestSPIFFEValidator : public testing::Test {
     TestUtility::loadFromYaml(yaml, typed_conf);
     config_ = std::make_unique<TestCertificateValidationContextConfig>(
         typed_conf, allow_expired_certificate_, san_matchers_);
-    validator_ = std::make_unique<SPIFFEValidator>(config_.get(), stats_, factory_context_);
+    validator_ =
+        std::make_unique<SPIFFEValidator>(config_.get(), stats_, config_->api().timeSource());
   };
 
   void initialize() { validator_ = std::make_unique<SPIFFEValidator>(stats_, time_system_); }
@@ -91,7 +90,6 @@ class TestSPIFFEValidator : public testing::Test {
   };
 
 private:
-  NiceMock<Server::Configuration::MockServerFactoryContext> factory_context_;
   bool allow_expired_certificate_{false};
   TestCertificateValidationContextConfigPtr config_;
   std::vector<envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher> san_matchers_{};
diff --git a/test/integration/base_integration_test.h b/test/integration/base_integration_test.h
index c5eb1129d41bd..1f1df3f7c765e 100644
--- a/test/integration/base_integration_test.h
+++ b/test/integration/base_integration_test.h
@@ -525,8 +525,7 @@ class BaseIntegrationTest : protected Logger::Loggable<Logger::Id::testing> {
   createUpstreamTlsContext(const FakeUpstreamConfig& upstream_config);
   testing::NiceMock<ThreadLocal::MockInstance> thread_local_;
   testing::NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context_;
-  testing::NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{timeSystem()};
 
   // The fake upstreams_ are created using the context_manager, so make sure
   // they are destroyed before it is.
diff --git a/test/integration/sds_static_integration_test.cc b/test/integration/sds_static_integration_test.cc
index 0e63eb3d42676..49d42c1eb6c25 100644
--- a/test/integration/sds_static_integration_test.cc
+++ b/test/integration/sds_static_integration_test.cc
@@ -89,7 +89,7 @@ class SdsStaticDownstreamIntegrationTest
   }
 
 private:
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{timeSystem()};
 
   Network::UpstreamTransportSocketFactoryPtr client_ssl_ctx_;
 };
@@ -148,7 +148,7 @@ class SdsStaticUpstreamIntegrationTest : public testing::TestWithParam<Network::
   }
 
 private:
-  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl context_manager_{timeSystem()};
 };
 
 INSTANTIATE_TEST_SUITE_P(IpVersions, SdsStaticUpstreamIntegrationTest,
diff --git a/test/integration/tcp_proxy_integration_test.cc b/test/integration/tcp_proxy_integration_test.cc
index c87c43a39caae..f383cc5b5ecac 100644
--- a/test/integration/tcp_proxy_integration_test.cc
+++ b/test/integration/tcp_proxy_integration_test.cc
@@ -1429,8 +1429,8 @@ void TcpProxySslIntegrationTest::initialize() {
   config_helper_.addSslConfig();
   TcpProxyIntegrationTest::initialize();
 
-  context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      server_factory_context_);
+  context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
   payload_reader_ = std::make_shared<WaitForPayloadReader>(*dispatcher_);
 }
 
diff --git a/test/integration/utility.cc b/test/integration/utility.cc
index 85019c6f45c23..3d06c513d7fac 100644
--- a/test/integration/utility.cc
+++ b/test/integration/utility.cc
@@ -239,8 +239,7 @@ IntegrationUtil::makeSingleRequest(const Network::Address::InstanceConstSharedPt
 
 #ifdef ENVOY_ENABLE_QUIC
   testing::NiceMock<ThreadLocal::MockInstance> threadlocal;
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
-  Extensions::TransportSockets::Tls::ContextManagerImpl manager(server_factory_context);
+  Extensions::TransportSockets::Tls::ContextManagerImpl manager(time_system);
   Network::UpstreamTransportSocketFactoryPtr transport_socket_factory =
       createQuicUpstreamTransportSocketFactory(api, mock_stats_store, manager, threadlocal,
                                                "spiffe://lyft.com/backend-team");
diff --git a/test/integration/xds_integration_test.cc b/test/integration/xds_integration_test.cc
index 497c0e6522fac..5435bb17d55e9 100644
--- a/test/integration/xds_integration_test.cc
+++ b/test/integration/xds_integration_test.cc
@@ -193,7 +193,7 @@ class LdsInplaceUpdateTcpProxyIntegrationTest
     BaseIntegrationTest::initialize();
 
     context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-        server_factory_context_);
+        BaseIntegrationTest::timeSystem());
     context_ = Ssl::createClientSslTransportSocketFactory({}, *context_manager_, *api_);
   }
 
@@ -462,8 +462,8 @@ class LdsInplaceUpdateHttpIntegrationTest
 
     BaseIntegrationTest::initialize();
 
-    context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-        server_factory_context_);
+    context_manager_ =
+        std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
     context_ = Ssl::createClientSslTransportSocketFactory({}, *context_manager_, *api_);
     address_ = Ssl::getSslAddress(version_, lookupPort("http"));
   }
diff --git a/test/integration/xfcc_integration_test.cc b/test/integration/xfcc_integration_test.cc
index 689611d5345a7..eeec6cf876b5e 100644
--- a/test/integration/xfcc_integration_test.cc
+++ b/test/integration/xfcc_integration_test.cc
@@ -169,8 +169,8 @@ void XfccIntegrationTest::initialize() {
     config_helper_.addSslConfig();
   }
 
-  context_manager_ = std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(
-      server_factory_context_);
+  context_manager_ =
+      std::make_unique<Extensions::TransportSockets::Tls::ContextManagerImpl>(timeSystem());
   client_tls_ssl_ctx_ = createClientSslContext(false);
   client_mtls_ssl_ctx_ = createClientSslContext(true);
   HttpIntegrationTest::initialize();
diff --git a/test/mocks/server/instance.cc b/test/mocks/server/instance.cc
index eca664bd89a8f..e40b1e1253314 100644
--- a/test/mocks/server/instance.cc
+++ b/test/mocks/server/instance.cc
@@ -13,7 +13,7 @@ using ::testing::ReturnRef;
 
 MockInstance::MockInstance()
     : secret_manager_(std::make_unique<Secret::SecretManagerImpl>(admin_.getConfigTracker())),
-      cluster_manager_(timeSource()),
+      cluster_manager_(timeSource()), ssl_context_manager_(timeSource()),
       singleton_manager_(new Singleton::ManagerImpl(Thread::threadFactoryForTest())),
       grpc_context_(stats_store_.symbolTable()), http_context_(stats_store_.symbolTable()),
       router_context_(stats_store_.symbolTable()), quic_stat_names_(stats_store_.symbolTable()),
@@ -21,8 +21,7 @@ MockInstance::MockInstance()
       server_factory_context_(
           std::make_shared<NiceMock<Configuration::MockServerFactoryContext>>()),
       transport_socket_factory_context_(
-          std::make_shared<NiceMock<Configuration::MockTransportSocketFactoryContext>>()),
-      ssl_context_manager_(*server_factory_context_) {
+          std::make_shared<NiceMock<Configuration::MockTransportSocketFactoryContext>>()) {
   ON_CALL(*this, threadLocal()).WillByDefault(ReturnRef(thread_local_));
   ON_CALL(*this, stats()).WillByDefault(ReturnRef(stats_store_));
   ON_CALL(*this, grpcContext()).WillByDefault(ReturnRef(grpc_context_));
diff --git a/test/mocks/server/instance.h b/test/mocks/server/instance.h
index de109c9c5a974..a8561d534b9c4 100644
--- a/test/mocks/server/instance.h
+++ b/test/mocks/server/instance.h
@@ -52,7 +52,6 @@ class MockInstance : public Instance {
   MOCK_METHOD(ThreadLocal::Instance&, threadLocal, ());
   MOCK_METHOD(LocalInfo::LocalInfo&, localInfo, (), (const));
   MOCK_METHOD(Configuration::StatsConfig&, statsConfig, (), ());
-  MOCK_METHOD(Regex::Engine&, regexEngine, ());
   MOCK_METHOD(void, flushStats, ());
   MOCK_METHOD(ProtobufMessage::ValidationContext&, messageValidationContext, ());
   MOCK_METHOD(Configuration::ServerFactoryContext&, serverFactoryContext, ());
@@ -79,6 +78,7 @@ class MockInstance : public Instance {
   testing::NiceMock<Upstream::MockClusterManager> cluster_manager_;
   Thread::MutexBasicLockable access_log_lock_;
   testing::NiceMock<Runtime::MockLoader> runtime_loader_;
+  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_;
   testing::NiceMock<Event::MockDispatcher> dispatcher_;
   testing::NiceMock<MockDrainManager> drain_manager_;
   testing::NiceMock<AccessLog::MockAccessLogManager> access_log_manager_;
@@ -101,7 +101,6 @@ class MockInstance : public Instance {
       server_factory_context_;
   std::shared_ptr<testing::NiceMock<Configuration::MockTransportSocketFactoryContext>>
       transport_socket_factory_context_;
-  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager_;
 };
 
 } // namespace Server
diff --git a/test/mocks/server/server_factory_context.h b/test/mocks/server/server_factory_context.h
index 128afe221c26f..7e69dbad447e2 100644
--- a/test/mocks/server/server_factory_context.h
+++ b/test/mocks/server/server_factory_context.h
@@ -79,7 +79,6 @@ class MockServerFactoryContext : public virtual ServerFactoryContext {
   MOCK_METHOD(Server::DrainManager&, drainManager, ());
   MOCK_METHOD(Init::Manager&, initManager, ());
   MOCK_METHOD(ServerLifecycleNotifier&, lifecycleNotifier, ());
-  Regex::Engine& regexEngine() override { return regex_engine_; }
   MOCK_METHOD(StatsConfig&, statsConfig, (), ());
   MOCK_METHOD(AccessLog::AccessLogManager&, accessLogManager, (), ());
   MOCK_METHOD(OverloadManager&, overloadManager, ());
@@ -108,7 +107,6 @@ class MockServerFactoryContext : public virtual ServerFactoryContext {
   Router::ContextImpl router_context_;
   envoy::config::bootstrap::v3::Bootstrap bootstrap_;
   testing::NiceMock<MockOptions> options_;
-  Regex::GoogleReEngine regex_engine_;
 };
 
 class MockGenericFactoryContext : public GenericFactoryContext {
@@ -157,7 +155,6 @@ class StatelessMockServerFactoryContext : public virtual ServerFactoryContext {
   MOCK_METHOD(Server::DrainManager&, drainManager, ());
   MOCK_METHOD(Init::Manager&, initManager, ());
   MOCK_METHOD(ServerLifecycleNotifier&, lifecycleNotifier, ());
-  MOCK_METHOD(Regex::Engine&, regexEngine, ());
   MOCK_METHOD(StatsConfig&, statsConfig, (), ());
   MOCK_METHOD(AccessLog::AccessLogManager&, accessLogManager, (), ());
   MOCK_METHOD(OverloadManager&, overloadManager, ());
diff --git a/test/per_file_coverage.sh b/test/per_file_coverage.sh
index cd8604d486dc0..5ab396837967a 100755
--- a/test/per_file_coverage.sh
+++ b/test/per_file_coverage.sh
@@ -62,7 +62,7 @@ declare -a KNOWN_LOW_COVERAGE=(
 "source/extensions/listener_managers/validation_listener_manager:70.5"
 "source/extensions/watchdog/profile_action:83.3"
 "source/server:91.0" # flaky: be careful adjusting. See https://github.com/envoyproxy/envoy/issues/15239
-"source/server/config_validation:88.9"
+"source/server/config_validation:89.2"
 "source/extensions/health_checkers:96.0"
 "source/extensions/health_checkers/http:93.9"
 "source/extensions/health_checkers/grpc:92.0"
diff --git a/test/server/BUILD b/test/server/BUILD
index 2938f1dd3429d..9cceee1474dc5 100644
--- a/test/server/BUILD
+++ b/test/server/BUILD
@@ -368,7 +368,6 @@ envoy_cc_test(
     srcs = ["ssl_context_manager_test.cc"],
     deps = [
         "//source/server:ssl_context_manager_lib",
-        "//test/mocks/server:server_factory_context_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/stats:stats_mocks",
         "//test/test_common:simulated_time_system_lib",
diff --git a/test/server/config_validation/cluster_manager_test.cc b/test/server/config_validation/cluster_manager_test.cc
index 12db1d70e5533..02442808b2301 100644
--- a/test/server/config_validation/cluster_manager_test.cc
+++ b/test/server/config_validation/cluster_manager_test.cc
@@ -40,8 +40,7 @@ TEST(ValidationClusterManagerTest, MockedMethods) {
 
   testing::NiceMock<Secret::MockSecretManager> secret_manager;
   auto dns_resolver = std::make_shared<NiceMock<Network::MockDnsResolver>>();
-  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager{
-      *server.server_factory_context_};
+  Extensions::TransportSockets::Tls::ContextManagerImpl ssl_context_manager{api->timeSource()};
 
   Http::ContextImpl http_context(stats_store.symbolTable());
   Quic::QuicStatNames quic_stat_names(stats_store.symbolTable());
diff --git a/test/server/ssl_context_manager_test.cc b/test/server/ssl_context_manager_test.cc
index 4a651e61dc316..dbe2bdc8db6ee 100644
--- a/test/server/ssl_context_manager_test.cc
+++ b/test/server/ssl_context_manager_test.cc
@@ -2,9 +2,9 @@
 
 #include "source/server/ssl_context_manager.h"
 
-#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/mocks/stats/mocks.h"
+#include "test/test_common/simulated_time_system.h"
 #include "test/test_common/utility.h"
 
 #include "gtest/gtest.h"
@@ -14,15 +14,14 @@ namespace Server {
 namespace {
 
 TEST(SslContextManager, createStub) {
+  Event::SimulatedTimeSystem time_system;
   Stats::MockStore store;
   Stats::Scope& scope(*store.rootScope());
   Ssl::MockClientContextConfig client_config;
   Ssl::MockServerContextConfig server_config;
   std::vector<std::string> server_names;
-  NiceMock<Server::Configuration::MockServerFactoryContext> server_factory_context;
 
-  Ssl::ContextManagerPtr manager =
-      createContextManager("fake_factory_name", server_factory_context);
+  Ssl::ContextManagerPtr manager = createContextManager("fake_factory_name", time_system);
 
   // Check we've created a stub, not real manager.
   EXPECT_EQ(manager->daysUntilFirstCertExpires().value(), std::numeric_limits<uint32_t>::max());
