@Test
  public void rotateClientCertificate()
      throws GeneralSecurityException, IOException {
    CertificateMaterial newClientCert = new CertificateBuilder()
        .commonName("client")
        .issuedBy(caCert)
        .sanDnsName("localhost")
        .sanIpAddress(InetAddress.getByName("127.0.0.1"))
        .generate();

    writeCertsToKeyStore(clientKeyStore, newClientCert);
    waitForClientToLogMessage(updatedKeyManager);

    assertThatCode(() -> region.put("foo", "bar"))
        .as("The client performs an operation which requires a new secure connection")
        .doesNotThrowAnyException();
  }
This test rotates the client's certificate and verifies that the client can form a new secure
connection.
geode-assembly/src/acceptanceTest/java/org/apache/geode/ssl/CertificateRotationTest.java