code: public static X509Certificate generateX509Certificate( KeyPair pair, String dn, int days, String algorithm )
                      throws GeneralSecurityException, IOException
      {
          PrivateKey privateKey = pair.getPrivate();
          X509CertInfo info = new X509CertInfo();
          Date from = new Date();
          Date to = new Date( from.getTime() + TimeUnit.DAYS.toMillis( days ) );
          CertificateValidity interval = new CertificateValidity( from, to );
          BigInteger sn = new BigInteger( 64, new SecureRandom() );
          X500Name owner = new X500Name( dn );
  
          info.set( X509CertInfo.VALIDITY, interval );
          info.set( X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber( sn ) );
          info.set( X509CertInfo.SUBJECT, owner );
          info.set( X509CertInfo.ISSUER, owner );
          info.set( X509CertInfo.KEY, new CertificateX509Key( pair.getPublic() ) );
          info.set( X509CertInfo.VERSION, new CertificateVersion( CertificateVersion.V3 ) );
  
          AlgorithmId algo = new AlgorithmId( AlgorithmId.sha256WithRSAEncryption_oid );
          info.set( X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId( algo ) );
  
          // Sign the cert to identify the algorithm that's used.
          X509CertImpl cert = new X509CertImpl( info );
          cert.sign( privateKey, algorithm );
  
          // Update the algorithm, and resign.
          algo = (AlgorithmId) cert.get( X509CertImpl.SIG_ALG );
          info.set( CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, algo );
          cert = new X509CertImpl( info );
          cert.sign( privateKey, algorithm );
          return cert;
      }
docs: Create a self-signed X.509 cert
  
  @param dn        the X.509 Distinguished Name, eg "CN=Test, L=London, C=GB"
  @param days      how many days from now the cert is valid for
  @param algorithm the signing algorithm, eg "SHA256withRSA"