private void startCluster() throws IOException, GeneralSecurityException {
    CertificateMaterial clusterCert = new CertificateBuilder()
        .commonName("cluster")
        .issuedBy(caCert)
        .sanDnsName("localhost")
        .sanIpAddress(InetAddress.getByName("127.0.0.1"))
        .generate();

    clusterKeyStore = createFile(rootFolder.resolve("cluster-keystore.jks"));
    writeCertsToKeyStore(clusterKeyStore, clusterCert);

    clusterTrustStore = createFile(rootFolder.resolve("cluster-truststore.jks"));
    writeCertsToTrustStore(clusterTrustStore, caCert);

    clusterSecurityProperties = createFile(rootFolder.resolve("cluster-security.properties"));
    Properties properties = CertStores.propertiesWith("all", "any", "any",
        clusterTrustStore, dummyStorePass, clusterKeyStore, dummyStorePass, true, true);
    properties.store(new FileOutputStream(clusterSecurityProperties.toFile()), "");

    memberNames = new String[] {"locator", "server1", "server2"};

    startLocator(memberNames[0]);
    startServer(memberNames[1]);
    startServer(memberNames[2]);
    createRegion();
  }
This test verifies that rotating to an untrusted certificate causes an exception when the
client tries to form a new secure connection. This is a sanity check that certificates are
being dynamically updated.
geode-assembly/src/acceptanceTest/java/org/apache/geode/ssl/CertificateRotationTest.java