To listen for incoming connections, we must carry out a similar set of steps:

1. Create a SecureRandom, a source of secure random numbers.
   
   
2. Create a KeyStore object containing the remote client's public key. This is read from client.public.
   
   
3. Create a KeyStore object containing the server's public/private key pair, including its public key certificate. This is read from server.private.
   
   
4. Create a TrustManagerFactory from the remote client's KeyStore. This is used to authenticate the remote client.
   
   
5. Create a KeyManagerFactory from the server's KeyStore. This is used for encrypting and decrypting data.
   
   
6. Create an SSLContext object, using the KeyManagerFactory, the TrustManagerFactory, and the SecureRandom.
   
   
7. Use the SSLContext to create an SSLServerSocketFactory.
   
   
8. Use the SSLServerSocketFactory to create an SSLServerSocket, which acts just like a regular ServerSocket, except that it is secure.
   
   
9. Call the accept() method of the SSLServerSocket to wait for an incoming connection.

It's all pretty complicated, but the process is the same each time, so it makes sense to follow along and see how it all works. In the panels that follow, we'll walk through the code that carries out these steps. We'll examine only the client-side process in detail, because the server-side process is nearly the same. Afterwards, we'll note the differences between the two sides.