code: public static void prepareX509Infrastructure(X509Metadata metadata, File serverKeyStore, File serverTrustStore, X509Log x509log) {
          // make the specified folder, if necessary
          File folder = serverKeyStore.getParentFile();
          folder.mkdirs();
  
          // Fathom CA certificate
          File caKeyStore = new File(folder, CA_KEY_STORE);
          if (!caKeyStore.exists()) {
              logger.info(MessageFormat.format("Generating {0} ({1})", CA_CN, caKeyStore.getAbsolutePath()));
              X509Certificate caCert = newCertificateAuthority(metadata, caKeyStore, x509log);
              saveCertificate(caCert, new File(caKeyStore.getParentFile(), "ca.cer"));
          }
  
          // Fathom CRL
          File caRevocationList = new File(folder, CA_REVOCATION_LIST);
          if (!caRevocationList.exists()) {
              logger.info(MessageFormat.format("Generating {0} CRL ({1})", CA_CN, caRevocationList.getAbsolutePath()));
              newCertificateRevocationList(caRevocationList, caKeyStore, metadata.password);
              x509log.log("new certificate revocation list created");
          }
  
          // create web SSL certificate signed by CA
          if (!serverKeyStore.exists()) {
              logger.info(MessageFormat.format("Generating SSL certificate for {0} signed by {1} ({2})", metadata.commonName, CA_CN, serverKeyStore.getAbsolutePath()));
              PrivateKey caPrivateKey = getPrivateKey(CA_ALIAS, caKeyStore, metadata.password);
              X509Certificate caCert = getCertificate(CA_ALIAS, caKeyStore, metadata.password);
              newSSLCertificate(metadata, caPrivateKey, caCert, serverKeyStore, x509log);
          }
  
          // server certificate trust store holds trusted public certificates
          if (!serverTrustStore.exists()) {
              logger.info(MessageFormat.format("Importing {0} into trust store ({1})", CA_ALIAS, serverTrustStore.getAbsolutePath()));
              X509Certificate caCert = getCertificate(CA_ALIAS, caKeyStore, metadata.password);
              addTrustedCertificate(CA_ALIAS, caCert, serverTrustStore, metadata.password);
          }
      }
docs: Prepare all the certificates and stores necessary for a Fathom server.
  
  @param metadata
  @param serverKeyStore
  @param serverTrustStore
  @param x509log