public KeyStore generateRoot(JKS jks)
            throws KeyStoreException, CertificateException, NoSuchAlgorithmException,
            IOException, OperatorCreationException {
        KeyPair keyPair = generateKeyPair(ROOT_KEY_SIZE);

        X500NameBuilder nameBuilder = new X500NameBuilder(BCStyle.INSTANCE);
        nameBuilder.addRDN(BCStyle.CN, jks.commonName());
        nameBuilder.addRDN(BCStyle.O, jks.organization());
        nameBuilder.addRDN(BCStyle.OU, jks.organizationalUnitName());
        X500Name issuer = nameBuilder.build();

        PublicKey pubKey = keyPair.getPublic();

        X509v3CertificateBuilder generator = new JcaX509v3CertificateBuilder(
                issuer, BigInteger.valueOf(randomSerial()), NOT_BEFORE, NOT_AFTER, issuer, pubKey);
        generator.addExtension(Extension.subjectKeyIdentifier, false,
                createSubjectKeyIdentifier(pubKey));
        generator.addExtension(Extension.basicConstraints, true,
                new BasicConstraints(true));

        KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign | KeyUsage.digitalSignature |
                KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
        generator.addExtension(Extension.keyUsage, false, usage);

        ASN1EncodableVector purposes = new ASN1EncodableVector();
        purposes.add(KeyPurposeId.id_kp_serverAuth);
        purposes.add(KeyPurposeId.id_kp_clientAuth);
        purposes.add(KeyPurposeId.anyExtendedKeyUsage);
        generator.addExtension(Extension.extendedKeyUsage, false,
                new DERSequence(purposes));

        X509Certificate cert = signCertificate(generator, keyPair.getPrivate());

        KeyStore result = KeyStore.getInstance(KEY_STORE_TYPE);
        result.load(null, null);
        result.setKeyEntry(jks.alias(), keyPair.getPrivate(), jks.password(),
                new Certificate[] { cert });
        return result;
    }
Generate a root keystore by a given {@link JKS}.

@param jks A java keystore object.
@return A root {@link KeyStore}.
netbare-core/src/main/java/com/github/megatronking/netbare/ssl/CertificateGenerator.java