@Test
  public void rotateCaCertificate()
      throws GeneralSecurityException, IOException {
    /*
     * First, create a new CA certificate and add it to both the cluster's and the client's trust
     * stores. The trust stores will contain both the old and the new CA certificates.
     */

    CertificateMaterial newCaCert = new CertificateBuilder()
        .commonName("ca")
        .isCA()
        .generate();

    writeCertsToTrustStore(clusterTrustStore, caCert, newCaCert);
    writeCertsToTrustStore(clientTrustStore, caCert, newCaCert);

    waitForMembersToLogMessage(updatedTrustManager);
    waitForClientToLogMessage(updatedTrustManager);

    /*
     * Next, create new certificates for the cluster and the client which are signed by the new CA,
     * and replace the certificates in the cluster's and the client's key stores.
     */

    CertificateMaterial newClusterCert = new CertificateBuilder()
        .commonName("cluster")
        .issuedBy(newCaCert)
        .sanDnsName("localhost")
        .sanIpAddress(InetAddress.getByName("127.0.0.1"))
        .generate();

    CertificateMaterial newClientCert = new CertificateBuilder()
        .commonName("client")
        .issuedBy(newCaCert)
        .sanDnsName("localhost")
        .sanIpAddress(InetAddress.getByName("127.0.0.1"))
        .generate();

    writeCertsToKeyStore(clusterKeyStore, newClusterCert);
    writeCertsToKeyStore(clientKeyStore, newClientCert);

    waitForMembersToLogMessage(updatedKeyManager);
    waitForClientToLogMessage(updatedKeyManager);

    /*
     * Finally, remove the old CA certificate from both the cluster's and the client's trust stores.
     */

    writeCertsToTrustStore(clusterTrustStore, newCaCert);
    writeCertsToTrustStore(clientTrustStore, newCaCert);

    for (String name : memberNames) {
      await().untilAsserted(() -> assertThat(logsForMember(name))
          .as("The cluster's trust manager has been updated twice")
          .haveExactly(2, linesMatching(updatedTrustManager)));
    }

    await().untilAsserted(() -> assertThat(logsForClient())
        .as("The client's trust manager has been updated twice")
        .haveExactly(2, linesMatching(updatedTrustManager)));

    assertThatCode(() -> region.put("foo", "bar"))
        .as("The client performs an operation which requires a new secure connection")
        .doesNotThrowAnyException();
  }
This test rotates the CA certificate in both the cluster and the client. It verifies that the
client can form a new secure connection after the new CA certificate has been added and the old
CA certificate removed.
geode-assembly/src/acceptanceTest/java/org/apache/geode/ssl/CertificateRotationTest.java