Setting up the server side is more or less the same as setting up the client side, so we won't go over it in detail. Of course, the server reads its key information from client.public and server.private, rather than from server.public and client.private.

In addition, the code to carry out the final step (establishing a connection) is a little different for the server side, as shown here:

        SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
        SSLServerSocket ss = (SSLServerSocket)sf.createServerSocket( port );
        ss.setNeedClientAuth( true );

Note that we called SSLServerSocket.setNeedClientAuth(). This is the server call indicating that the client should authenticate itself. Client applications do not authenticate themselves by default, so you must make this call if you want client authentication to be part of the handshaking process.