@Test
  public void untrustedCertificateThrows()
      throws GeneralSecurityException, IOException {
    CertificateMaterial selfSignedCert = new CertificateBuilder()
        .commonName("client")
        .sanDnsName("localhost")
        .sanIpAddress(InetAddress.getByName("127.0.0.1"))
        .generate();

    writeCertsToKeyStore(clientKeyStore, selfSignedCert);
    waitForClientToLogMessage(updatedKeyManager);

    assertThatThrownBy(() -> region.put("foo", "bar"))
        .as("The client performs an operation which requires a new connection")
        .isNotNull();
  }
This test verifies that rotating to an untrusted certificate causes an exception when the
client tries to form a new secure connection. This is a sanity check that certificates are
being dynamically updated.
geode-assembly/src/acceptanceTest/java/org/apache/geode/ssl/CertificateRotationTest.java