docs: protected void createKeystore() {
  
  		java.security.cert.Certificate signingCert = null;
  		PrivateKey  caPrivKey  = null;
  
  		if(_caCert == null || _caPrivKey == null)
  		{
  			try
  			{
  				log.debug("Keystore or signing cert & keypair not found.  Generating...");
  
  				KeyPair caKeypair = getRSAKeyPair();
  				caPrivKey = caKeypair.getPrivate();
  				signingCert = CertificateCreator.createTypicalMasterCert(caKeypair);
  
  				log.debug("Done generating signing cert");
  				log.debug(signingCert);
  
  				_ks.load(null, _keystorepass);
  
  				_ks.setCertificateEntry(_caCertAlias, signingCert);
  				_ks.setKeyEntry(_caPrivKeyAlias, caPrivKey, _keypassword, new java.security.cert.Certificate[] {signingCert});
  
  				File caKsFile = new File(root, _caPrivateKeystore);
  
  				OutputStream os = new FileOutputStream(caKsFile);
  				_ks.store(os, _keystorepass);
  
  				log.debug("Wrote JKS keystore to: " +
  						caKsFile.getAbsolutePath());
  
  				// also export a .cer that can be imported as a trusted root
  				// to disable all warning dialogs for interception
  
  				File signingCertFile = new File(root, EXPORTED_CERT_NAME);
  
  				FileOutputStream cerOut = new FileOutputStream(signingCertFile);
  
  				byte[] buf = signingCert.getEncoded();
  
  				log.debug("Wrote signing cert to: " + signingCertFile.getAbsolutePath());
  
  				cerOut.write(buf);
  				cerOut.flush();
  				cerOut.close();
  
  				_caCert = (X509Certificate)signingCert;
  				_caPrivKey  = caPrivKey;
  			}
  			catch(Exception e)
  			{
  				log.error("Fatal error creating/storing keystore or signing cert.", e);
  				throw new Error(e);
  			}
  		}
  		else
  		{
  			log.debug("Successfully loaded keystore.");
  			log.debug(_caCert);
  
  		}
  
  	}