private void startClient() throws IOException, GeneralSecurityException, InterruptedException {
    CertificateMaterial clientCert = new CertificateBuilder()
        .commonName("client")
        .issuedBy(caCert)
        .sanDnsName("localhost")
        .sanIpAddress(InetAddress.getByName("127.0.0.1"))
        .generate();

    clientKeyStore = createFile(rootFolder.resolve("client-keystore.jks"));
    writeCertsToKeyStore(clientKeyStore, clientCert);

    clientTrustStore = createFile(rootFolder.resolve("client-truststore.jks"));
    writeCertsToTrustStore(clientTrustStore, caCert);

    Path clientSecurityProperties = createFile(rootFolder.resolve("client-security.properties"));
    Properties properties = CertStores.propertiesWith("all", "any", "any",
        clientTrustStore, dummyStorePass, clientKeyStore, dummyStorePass, true, true);
    properties.store(new FileOutputStream(clientSecurityProperties.toFile()), "");

    clientLogFile = createFile(rootFolder.resolve("client.log"));

    client = new ClientCacheFactory(properties)
        .addPoolLocator("localhost", locatorPort)
        .set("log-file", clientLogFile.toString())
        // prevent the client from creating a connection until the first cache operation
        .setPoolMinConnections(0)
        .create();

    region = client.<String, String>createClientRegionFactory(PROXY)
        .create(regionName);

    waitForClientToLogMessage(compile(quote("Started watching " + clientKeyStore)));
    waitForClientToLogMessage(compile(quote("Started watching " + clientTrustStore)));

    /*
     * This sleep is needed to ensure that any updates to the key or trust store file are detected
     * by the client. Without it, the timestamp on the updated file might be the same as the
     * timestamp before the update, preventing the client from noticing the change.
     */
    Thread.sleep(Duration.ofSeconds(5).toMillis());
  }
This test verifies that rotating to an untrusted certificate causes an exception when the
client tries to form a new secure connection. This is a sanity check that certificates are
being dynamically updated.
geode-assembly/src/acceptanceTest/java/org/apache/geode/ssl/CertificateRotationTest.java