private Map<String, Object> buildPem() throws IOException, GeneralSecurityException {
            if (!createTrustStore) {
                throw new IllegalArgumentException("PEM configs cannot be created with existing trust stores");
            }

            Map<String, Object> sslConfigs = new HashMap<>();
            sslConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, tlsProtocol);
            sslConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, Collections.singletonList(tlsProtocol));

            if (connectionMode != ConnectionMode.CLIENT || useClientCert) {
                KeyPair keyPair = generateKeyPair(algorithm);
                X509Certificate cert = certBuilder.generate("CN=" + cn + ", O=A " + connectionMode.name().toLowerCase(Locale.ROOT), keyPair);

                Password privateKeyPem = new Password(pem(keyPair.getPrivate(), keyPassword));
                Password certPem = new Password(pem(cert));
                sslConfigs.put(SslConfigs.SSL_KEYSTORE_TYPE_CONFIG, PEM_TYPE);
                sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_TYPE_CONFIG, PEM_TYPE);
                sslConfigs.put(SslConfigs.SSL_KEYSTORE_KEY_CONFIG, privateKeyPem);
                sslConfigs.put(SslConfigs.SSL_KEYSTORE_CERTIFICATE_CHAIN_CONFIG, certPem);
                sslConfigs.put(SslConfigs.SSL_KEY_PASSWORD_CONFIG, keyPassword);
                sslConfigs.put(SslConfigs.SSL_TRUSTSTORE_CERTIFICATES_CONFIG, certPem);
            }
            return sslConfigs;
        }
@param dn The distinguished name to use
@param keyPair A key pair to use
@param daysBeforeNow how many days before now the Certificate is valid for
@param daysAfterNow how many days from now the Certificate is valid for
@param issuer The issuer name. if null, "dn" is used
@param parentKeyPair The parent key pair used to sign this certificate. If null, create
       self-signed certificate authority (CA)
@return A (self-) signed certificate
@throws CertificateException
clients/src/test/java/org/apache/kafka/test/TestSslUtils.java