Keytool

glassfish

Change the following JVM options so that they point to the location and name of the new keystore. Add this in domain.xml under java-config:
  <jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks</jvm-options>
  <jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks</jvm-options>

keytool

# Generate Certificate
keytool -genkey -alias server-alias -keyalg RSA -keypass changeit --storepass changeit -keystore keystore.jks

# Export generated server certificate in keystore.jks into the file server.cer
keytool -export -alias server-alias -storepass changeit -file server.cer -keystore keystore.jks 

# Create the trust-store file cacerts.jks and add server certificate to it
keytool -import -v -trustcacerts -alias server-alias -file server.cer -keystore cacerts.jks -keypass changeit -storepass changeit