SLIDER-802 add client keystore and trustore retrieval commands
diff --git a/slider-core/src/main/java/org/apache/slider/api/SliderClusterProtocol.java b/slider-core/src/main/java/org/apache/slider/api/SliderClusterProtocol.java
index b4e91fc..dbb8c99 100644
--- a/slider-core/src/main/java/org/apache/slider/api/SliderClusterProtocol.java
+++ b/slider-core/src/main/java/org/apache/slider/api/SliderClusterProtocol.java
@@ -161,7 +161,6 @@
    
   Messages.WrappedJsonProto getLiveResources(Messages.EmptyPayloadProto request) throws IOException;
 
-  Messages.SignCertificateResponseProto signCertificate(
-      Messages.SignCertificateRequestProto request) throws IOException;
-
+  Messages.GetCertificateStoreResponseProto getClientCertificateStore(Messages.GetCertificateStoreRequestProto request)
+      throws IOException;
 }
diff --git a/slider-core/src/main/java/org/apache/slider/api/proto/Messages.java b/slider-core/src/main/java/org/apache/slider/api/proto/Messages.java
index 3e1cad3..53c7d45 100644
--- a/slider-core/src/main/java/org/apache/slider/api/proto/Messages.java
+++ b/slider-core/src/main/java/org/apache/slider/api/proto/Messages.java
@@ -25129,73 +25129,88 @@
     // @@protoc_insertion_point(class_scope:org.apache.slider.api.WrappedJsonProto)
   }
 
-  public interface SignCertificateRequestProtoOrBuilder
+  public interface GetCertificateStoreRequestProtoOrBuilder
       extends com.google.protobuf.MessageOrBuilder {
 
-    // required string hostname = 1;
+    // optional string hostname = 1;
     /**
-     * <code>required string hostname = 1;</code>
+     * <code>optional string hostname = 1;</code>
      */
     boolean hasHostname();
     /**
-     * <code>required string hostname = 1;</code>
+     * <code>optional string hostname = 1;</code>
      */
     java.lang.String getHostname();
     /**
-     * <code>required string hostname = 1;</code>
+     * <code>optional string hostname = 1;</code>
      */
     com.google.protobuf.ByteString
         getHostnameBytes();
 
-    // required string certRequest = 2;
+    // required string requesterId = 2;
     /**
-     * <code>required string certRequest = 2;</code>
+     * <code>required string requesterId = 2;</code>
      */
-    boolean hasCertRequest();
+    boolean hasRequesterId();
     /**
-     * <code>required string certRequest = 2;</code>
+     * <code>required string requesterId = 2;</code>
      */
-    java.lang.String getCertRequest();
+    java.lang.String getRequesterId();
     /**
-     * <code>required string certRequest = 2;</code>
+     * <code>required string requesterId = 2;</code>
      */
     com.google.protobuf.ByteString
-        getCertRequestBytes();
+        getRequesterIdBytes();
 
-    // required string passPhrase = 3;
+    // required string password = 3;
     /**
-     * <code>required string passPhrase = 3;</code>
+     * <code>required string password = 3;</code>
      */
-    boolean hasPassPhrase();
+    boolean hasPassword();
     /**
-     * <code>required string passPhrase = 3;</code>
+     * <code>required string password = 3;</code>
      */
-    java.lang.String getPassPhrase();
+    java.lang.String getPassword();
     /**
-     * <code>required string passPhrase = 3;</code>
+     * <code>required string password = 3;</code>
      */
     com.google.protobuf.ByteString
-        getPassPhraseBytes();
+        getPasswordBytes();
+
+    // required string type = 4;
+    /**
+     * <code>required string type = 4;</code>
+     */
+    boolean hasType();
+    /**
+     * <code>required string type = 4;</code>
+     */
+    java.lang.String getType();
+    /**
+     * <code>required string type = 4;</code>
+     */
+    com.google.protobuf.ByteString
+        getTypeBytes();
   }
   /**
-   * Protobuf type {@code org.apache.slider.api.SignCertificateRequestProto}
+   * Protobuf type {@code org.apache.slider.api.GetCertificateStoreRequestProto}
    */
-  public static final class SignCertificateRequestProto extends
+  public static final class GetCertificateStoreRequestProto extends
       com.google.protobuf.GeneratedMessage
-      implements SignCertificateRequestProtoOrBuilder {
-    // Use SignCertificateRequestProto.newBuilder() to construct.
-    private SignCertificateRequestProto(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
+      implements GetCertificateStoreRequestProtoOrBuilder {
+    // Use GetCertificateStoreRequestProto.newBuilder() to construct.
+    private GetCertificateStoreRequestProto(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
       super(builder);
       this.unknownFields = builder.getUnknownFields();
     }
-    private SignCertificateRequestProto(boolean noInit) { this.unknownFields = com.google.protobuf.UnknownFieldSet.getDefaultInstance(); }
+    private GetCertificateStoreRequestProto(boolean noInit) { this.unknownFields = com.google.protobuf.UnknownFieldSet.getDefaultInstance(); }
 
-    private static final SignCertificateRequestProto defaultInstance;
-    public static SignCertificateRequestProto getDefaultInstance() {
+    private static final GetCertificateStoreRequestProto defaultInstance;
+    public static GetCertificateStoreRequestProto getDefaultInstance() {
       return defaultInstance;
     }
 
-    public SignCertificateRequestProto getDefaultInstanceForType() {
+    public GetCertificateStoreRequestProto getDefaultInstanceForType() {
       return defaultInstance;
     }
 
@@ -25205,7 +25220,7 @@
         getUnknownFields() {
       return this.unknownFields;
     }
-    private SignCertificateRequestProto(
+    private GetCertificateStoreRequestProto(
         com.google.protobuf.CodedInputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
@@ -25235,12 +25250,17 @@
             }
             case 18: {
               bitField0_ |= 0x00000002;
-              certRequest_ = input.readBytes();
+              requesterId_ = input.readBytes();
               break;
             }
             case 26: {
               bitField0_ |= 0x00000004;
-              passPhrase_ = input.readBytes();
+              password_ = input.readBytes();
+              break;
+            }
+            case 34: {
+              bitField0_ |= 0x00000008;
+              type_ = input.readBytes();
               break;
             }
           }
@@ -25257,43 +25277,43 @@
     }
     public static final com.google.protobuf.Descriptors.Descriptor
         getDescriptor() {
-      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateRequestProto_descriptor;
+      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_descriptor;
     }
 
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateRequestProto_fieldAccessorTable
+      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
-              org.apache.slider.api.proto.Messages.SignCertificateRequestProto.class, org.apache.slider.api.proto.Messages.SignCertificateRequestProto.Builder.class);
+              org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.class, org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.Builder.class);
     }
 
-    public static com.google.protobuf.Parser<SignCertificateRequestProto> PARSER =
-        new com.google.protobuf.AbstractParser<SignCertificateRequestProto>() {
-      public SignCertificateRequestProto parsePartialFrom(
+    public static com.google.protobuf.Parser<GetCertificateStoreRequestProto> PARSER =
+        new com.google.protobuf.AbstractParser<GetCertificateStoreRequestProto>() {
+      public GetCertificateStoreRequestProto parsePartialFrom(
           com.google.protobuf.CodedInputStream input,
           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
           throws com.google.protobuf.InvalidProtocolBufferException {
-        return new SignCertificateRequestProto(input, extensionRegistry);
+        return new GetCertificateStoreRequestProto(input, extensionRegistry);
       }
     };
 
     @java.lang.Override
-    public com.google.protobuf.Parser<SignCertificateRequestProto> getParserForType() {
+    public com.google.protobuf.Parser<GetCertificateStoreRequestProto> getParserForType() {
       return PARSER;
     }
 
     private int bitField0_;
-    // required string hostname = 1;
+    // optional string hostname = 1;
     public static final int HOSTNAME_FIELD_NUMBER = 1;
     private java.lang.Object hostname_;
     /**
-     * <code>required string hostname = 1;</code>
+     * <code>optional string hostname = 1;</code>
      */
     public boolean hasHostname() {
       return ((bitField0_ & 0x00000001) == 0x00000001);
     }
     /**
-     * <code>required string hostname = 1;</code>
+     * <code>optional string hostname = 1;</code>
      */
     public java.lang.String getHostname() {
       java.lang.Object ref = hostname_;
@@ -25310,7 +25330,7 @@
       }
     }
     /**
-     * <code>required string hostname = 1;</code>
+     * <code>optional string hostname = 1;</code>
      */
     public com.google.protobuf.ByteString
         getHostnameBytes() {
@@ -25326,20 +25346,20 @@
       }
     }
 
-    // required string certRequest = 2;
-    public static final int CERTREQUEST_FIELD_NUMBER = 2;
-    private java.lang.Object certRequest_;
+    // required string requesterId = 2;
+    public static final int REQUESTERID_FIELD_NUMBER = 2;
+    private java.lang.Object requesterId_;
     /**
-     * <code>required string certRequest = 2;</code>
+     * <code>required string requesterId = 2;</code>
      */
-    public boolean hasCertRequest() {
+    public boolean hasRequesterId() {
       return ((bitField0_ & 0x00000002) == 0x00000002);
     }
     /**
-     * <code>required string certRequest = 2;</code>
+     * <code>required string requesterId = 2;</code>
      */
-    public java.lang.String getCertRequest() {
-      java.lang.Object ref = certRequest_;
+    public java.lang.String getRequesterId() {
+      java.lang.Object ref = requesterId_;
       if (ref instanceof java.lang.String) {
         return (java.lang.String) ref;
       } else {
@@ -25347,42 +25367,42 @@
             (com.google.protobuf.ByteString) ref;
         java.lang.String s = bs.toStringUtf8();
         if (bs.isValidUtf8()) {
-          certRequest_ = s;
+          requesterId_ = s;
         }
         return s;
       }
     }
     /**
-     * <code>required string certRequest = 2;</code>
+     * <code>required string requesterId = 2;</code>
      */
     public com.google.protobuf.ByteString
-        getCertRequestBytes() {
-      java.lang.Object ref = certRequest_;
+        getRequesterIdBytes() {
+      java.lang.Object ref = requesterId_;
       if (ref instanceof java.lang.String) {
         com.google.protobuf.ByteString b = 
             com.google.protobuf.ByteString.copyFromUtf8(
                 (java.lang.String) ref);
-        certRequest_ = b;
+        requesterId_ = b;
         return b;
       } else {
         return (com.google.protobuf.ByteString) ref;
       }
     }
 
-    // required string passPhrase = 3;
-    public static final int PASSPHRASE_FIELD_NUMBER = 3;
-    private java.lang.Object passPhrase_;
+    // required string password = 3;
+    public static final int PASSWORD_FIELD_NUMBER = 3;
+    private java.lang.Object password_;
     /**
-     * <code>required string passPhrase = 3;</code>
+     * <code>required string password = 3;</code>
      */
-    public boolean hasPassPhrase() {
+    public boolean hasPassword() {
       return ((bitField0_ & 0x00000004) == 0x00000004);
     }
     /**
-     * <code>required string passPhrase = 3;</code>
+     * <code>required string password = 3;</code>
      */
-    public java.lang.String getPassPhrase() {
-      java.lang.Object ref = passPhrase_;
+    public java.lang.String getPassword() {
+      java.lang.Object ref = password_;
       if (ref instanceof java.lang.String) {
         return (java.lang.String) ref;
       } else {
@@ -25390,22 +25410,65 @@
             (com.google.protobuf.ByteString) ref;
         java.lang.String s = bs.toStringUtf8();
         if (bs.isValidUtf8()) {
-          passPhrase_ = s;
+          password_ = s;
         }
         return s;
       }
     }
     /**
-     * <code>required string passPhrase = 3;</code>
+     * <code>required string password = 3;</code>
      */
     public com.google.protobuf.ByteString
-        getPassPhraseBytes() {
-      java.lang.Object ref = passPhrase_;
+        getPasswordBytes() {
+      java.lang.Object ref = password_;
       if (ref instanceof java.lang.String) {
         com.google.protobuf.ByteString b = 
             com.google.protobuf.ByteString.copyFromUtf8(
                 (java.lang.String) ref);
-        passPhrase_ = b;
+        password_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+
+    // required string type = 4;
+    public static final int TYPE_FIELD_NUMBER = 4;
+    private java.lang.Object type_;
+    /**
+     * <code>required string type = 4;</code>
+     */
+    public boolean hasType() {
+      return ((bitField0_ & 0x00000008) == 0x00000008);
+    }
+    /**
+     * <code>required string type = 4;</code>
+     */
+    public java.lang.String getType() {
+      java.lang.Object ref = type_;
+      if (ref instanceof java.lang.String) {
+        return (java.lang.String) ref;
+      } else {
+        com.google.protobuf.ByteString bs = 
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        if (bs.isValidUtf8()) {
+          type_ = s;
+        }
+        return s;
+      }
+    }
+    /**
+     * <code>required string type = 4;</code>
+     */
+    public com.google.protobuf.ByteString
+        getTypeBytes() {
+      java.lang.Object ref = type_;
+      if (ref instanceof java.lang.String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        type_ = b;
         return b;
       } else {
         return (com.google.protobuf.ByteString) ref;
@@ -25414,23 +25477,24 @@
 
     private void initFields() {
       hostname_ = "";
-      certRequest_ = "";
-      passPhrase_ = "";
+      requesterId_ = "";
+      password_ = "";
+      type_ = "";
     }
     private byte memoizedIsInitialized = -1;
     public final boolean isInitialized() {
       byte isInitialized = memoizedIsInitialized;
       if (isInitialized != -1) return isInitialized == 1;
 
-      if (!hasHostname()) {
+      if (!hasRequesterId()) {
         memoizedIsInitialized = 0;
         return false;
       }
-      if (!hasCertRequest()) {
+      if (!hasPassword()) {
         memoizedIsInitialized = 0;
         return false;
       }
-      if (!hasPassPhrase()) {
+      if (!hasType()) {
         memoizedIsInitialized = 0;
         return false;
       }
@@ -25445,10 +25509,13 @@
         output.writeBytes(1, getHostnameBytes());
       }
       if (((bitField0_ & 0x00000002) == 0x00000002)) {
-        output.writeBytes(2, getCertRequestBytes());
+        output.writeBytes(2, getRequesterIdBytes());
       }
       if (((bitField0_ & 0x00000004) == 0x00000004)) {
-        output.writeBytes(3, getPassPhraseBytes());
+        output.writeBytes(3, getPasswordBytes());
+      }
+      if (((bitField0_ & 0x00000008) == 0x00000008)) {
+        output.writeBytes(4, getTypeBytes());
       }
       getUnknownFields().writeTo(output);
     }
@@ -25465,11 +25532,15 @@
       }
       if (((bitField0_ & 0x00000002) == 0x00000002)) {
         size += com.google.protobuf.CodedOutputStream
-          .computeBytesSize(2, getCertRequestBytes());
+          .computeBytesSize(2, getRequesterIdBytes());
       }
       if (((bitField0_ & 0x00000004) == 0x00000004)) {
         size += com.google.protobuf.CodedOutputStream
-          .computeBytesSize(3, getPassPhraseBytes());
+          .computeBytesSize(3, getPasswordBytes());
+      }
+      if (((bitField0_ & 0x00000008) == 0x00000008)) {
+        size += com.google.protobuf.CodedOutputStream
+          .computeBytesSize(4, getTypeBytes());
       }
       size += getUnknownFields().getSerializedSize();
       memoizedSerializedSize = size;
@@ -25488,10 +25559,10 @@
       if (obj == this) {
        return true;
       }
-      if (!(obj instanceof org.apache.slider.api.proto.Messages.SignCertificateRequestProto)) {
+      if (!(obj instanceof org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto)) {
         return super.equals(obj);
       }
-      org.apache.slider.api.proto.Messages.SignCertificateRequestProto other = (org.apache.slider.api.proto.Messages.SignCertificateRequestProto) obj;
+      org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto other = (org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto) obj;
 
       boolean result = true;
       result = result && (hasHostname() == other.hasHostname());
@@ -25499,15 +25570,20 @@
         result = result && getHostname()
             .equals(other.getHostname());
       }
-      result = result && (hasCertRequest() == other.hasCertRequest());
-      if (hasCertRequest()) {
-        result = result && getCertRequest()
-            .equals(other.getCertRequest());
+      result = result && (hasRequesterId() == other.hasRequesterId());
+      if (hasRequesterId()) {
+        result = result && getRequesterId()
+            .equals(other.getRequesterId());
       }
-      result = result && (hasPassPhrase() == other.hasPassPhrase());
-      if (hasPassPhrase()) {
-        result = result && getPassPhrase()
-            .equals(other.getPassPhrase());
+      result = result && (hasPassword() == other.hasPassword());
+      if (hasPassword()) {
+        result = result && getPassword()
+            .equals(other.getPassword());
+      }
+      result = result && (hasType() == other.hasType());
+      if (hasType()) {
+        result = result && getType()
+            .equals(other.getType());
       }
       result = result &&
           getUnknownFields().equals(other.getUnknownFields());
@@ -25526,66 +25602,70 @@
         hash = (37 * hash) + HOSTNAME_FIELD_NUMBER;
         hash = (53 * hash) + getHostname().hashCode();
       }
-      if (hasCertRequest()) {
-        hash = (37 * hash) + CERTREQUEST_FIELD_NUMBER;
-        hash = (53 * hash) + getCertRequest().hashCode();
+      if (hasRequesterId()) {
+        hash = (37 * hash) + REQUESTERID_FIELD_NUMBER;
+        hash = (53 * hash) + getRequesterId().hashCode();
       }
-      if (hasPassPhrase()) {
-        hash = (37 * hash) + PASSPHRASE_FIELD_NUMBER;
-        hash = (53 * hash) + getPassPhrase().hashCode();
+      if (hasPassword()) {
+        hash = (37 * hash) + PASSWORD_FIELD_NUMBER;
+        hash = (53 * hash) + getPassword().hashCode();
+      }
+      if (hasType()) {
+        hash = (37 * hash) + TYPE_FIELD_NUMBER;
+        hash = (53 * hash) + getType().hashCode();
       }
       hash = (29 * hash) + getUnknownFields().hashCode();
       memoizedHashCode = hash;
       return hash;
     }
 
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(
         com.google.protobuf.ByteString data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(
         com.google.protobuf.ByteString data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(byte[] data)
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(byte[] data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(
         byte[] data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(java.io.InputStream input)
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(java.io.InputStream input)
         throws java.io.IOException {
       return PARSER.parseFrom(input);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(
         java.io.InputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
       return PARSER.parseFrom(input, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseDelimitedFrom(java.io.InputStream input)
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseDelimitedFrom(java.io.InputStream input)
         throws java.io.IOException {
       return PARSER.parseDelimitedFrom(input);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseDelimitedFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseDelimitedFrom(
         java.io.InputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
       return PARSER.parseDelimitedFrom(input, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(
         com.google.protobuf.CodedInputStream input)
         throws java.io.IOException {
       return PARSER.parseFrom(input);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateRequestProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parseFrom(
         com.google.protobuf.CodedInputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
@@ -25594,7 +25674,7 @@
 
     public static Builder newBuilder() { return Builder.create(); }
     public Builder newBuilderForType() { return newBuilder(); }
-    public static Builder newBuilder(org.apache.slider.api.proto.Messages.SignCertificateRequestProto prototype) {
+    public static Builder newBuilder(org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto prototype) {
       return newBuilder().mergeFrom(prototype);
     }
     public Builder toBuilder() { return newBuilder(this); }
@@ -25606,24 +25686,24 @@
       return builder;
     }
     /**
-     * Protobuf type {@code org.apache.slider.api.SignCertificateRequestProto}
+     * Protobuf type {@code org.apache.slider.api.GetCertificateStoreRequestProto}
      */
     public static final class Builder extends
         com.google.protobuf.GeneratedMessage.Builder<Builder>
-       implements org.apache.slider.api.proto.Messages.SignCertificateRequestProtoOrBuilder {
+       implements org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProtoOrBuilder {
       public static final com.google.protobuf.Descriptors.Descriptor
           getDescriptor() {
-        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateRequestProto_descriptor;
+        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_descriptor;
       }
 
       protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
           internalGetFieldAccessorTable() {
-        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateRequestProto_fieldAccessorTable
+        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_fieldAccessorTable
             .ensureFieldAccessorsInitialized(
-                org.apache.slider.api.proto.Messages.SignCertificateRequestProto.class, org.apache.slider.api.proto.Messages.SignCertificateRequestProto.Builder.class);
+                org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.class, org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.Builder.class);
       }
 
-      // Construct using org.apache.slider.api.proto.Messages.SignCertificateRequestProto.newBuilder()
+      // Construct using org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.newBuilder()
       private Builder() {
         maybeForceBuilderInitialization();
       }
@@ -25645,10 +25725,12 @@
         super.clear();
         hostname_ = "";
         bitField0_ = (bitField0_ & ~0x00000001);
-        certRequest_ = "";
+        requesterId_ = "";
         bitField0_ = (bitField0_ & ~0x00000002);
-        passPhrase_ = "";
+        password_ = "";
         bitField0_ = (bitField0_ & ~0x00000004);
+        type_ = "";
+        bitField0_ = (bitField0_ & ~0x00000008);
         return this;
       }
 
@@ -25658,23 +25740,23 @@
 
       public com.google.protobuf.Descriptors.Descriptor
           getDescriptorForType() {
-        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateRequestProto_descriptor;
+        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_descriptor;
       }
 
-      public org.apache.slider.api.proto.Messages.SignCertificateRequestProto getDefaultInstanceForType() {
-        return org.apache.slider.api.proto.Messages.SignCertificateRequestProto.getDefaultInstance();
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto getDefaultInstanceForType() {
+        return org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.getDefaultInstance();
       }
 
-      public org.apache.slider.api.proto.Messages.SignCertificateRequestProto build() {
-        org.apache.slider.api.proto.Messages.SignCertificateRequestProto result = buildPartial();
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto build() {
+        org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto result = buildPartial();
         if (!result.isInitialized()) {
           throw newUninitializedMessageException(result);
         }
         return result;
       }
 
-      public org.apache.slider.api.proto.Messages.SignCertificateRequestProto buildPartial() {
-        org.apache.slider.api.proto.Messages.SignCertificateRequestProto result = new org.apache.slider.api.proto.Messages.SignCertificateRequestProto(this);
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto buildPartial() {
+        org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto result = new org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto(this);
         int from_bitField0_ = bitField0_;
         int to_bitField0_ = 0;
         if (((from_bitField0_ & 0x00000001) == 0x00000001)) {
@@ -25684,40 +25766,49 @@
         if (((from_bitField0_ & 0x00000002) == 0x00000002)) {
           to_bitField0_ |= 0x00000002;
         }
-        result.certRequest_ = certRequest_;
+        result.requesterId_ = requesterId_;
         if (((from_bitField0_ & 0x00000004) == 0x00000004)) {
           to_bitField0_ |= 0x00000004;
         }
-        result.passPhrase_ = passPhrase_;
+        result.password_ = password_;
+        if (((from_bitField0_ & 0x00000008) == 0x00000008)) {
+          to_bitField0_ |= 0x00000008;
+        }
+        result.type_ = type_;
         result.bitField0_ = to_bitField0_;
         onBuilt();
         return result;
       }
 
       public Builder mergeFrom(com.google.protobuf.Message other) {
-        if (other instanceof org.apache.slider.api.proto.Messages.SignCertificateRequestProto) {
-          return mergeFrom((org.apache.slider.api.proto.Messages.SignCertificateRequestProto)other);
+        if (other instanceof org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto) {
+          return mergeFrom((org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto)other);
         } else {
           super.mergeFrom(other);
           return this;
         }
       }
 
-      public Builder mergeFrom(org.apache.slider.api.proto.Messages.SignCertificateRequestProto other) {
-        if (other == org.apache.slider.api.proto.Messages.SignCertificateRequestProto.getDefaultInstance()) return this;
+      public Builder mergeFrom(org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto other) {
+        if (other == org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.getDefaultInstance()) return this;
         if (other.hasHostname()) {
           bitField0_ |= 0x00000001;
           hostname_ = other.hostname_;
           onChanged();
         }
-        if (other.hasCertRequest()) {
+        if (other.hasRequesterId()) {
           bitField0_ |= 0x00000002;
-          certRequest_ = other.certRequest_;
+          requesterId_ = other.requesterId_;
           onChanged();
         }
-        if (other.hasPassPhrase()) {
+        if (other.hasPassword()) {
           bitField0_ |= 0x00000004;
-          passPhrase_ = other.passPhrase_;
+          password_ = other.password_;
+          onChanged();
+        }
+        if (other.hasType()) {
+          bitField0_ |= 0x00000008;
+          type_ = other.type_;
           onChanged();
         }
         this.mergeUnknownFields(other.getUnknownFields());
@@ -25725,15 +25816,15 @@
       }
 
       public final boolean isInitialized() {
-        if (!hasHostname()) {
+        if (!hasRequesterId()) {
           
           return false;
         }
-        if (!hasCertRequest()) {
+        if (!hasPassword()) {
           
           return false;
         }
-        if (!hasPassPhrase()) {
+        if (!hasType()) {
           
           return false;
         }
@@ -25744,11 +25835,11 @@
           com.google.protobuf.CodedInputStream input,
           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
           throws java.io.IOException {
-        org.apache.slider.api.proto.Messages.SignCertificateRequestProto parsedMessage = null;
+        org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto parsedMessage = null;
         try {
           parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
         } catch (com.google.protobuf.InvalidProtocolBufferException e) {
-          parsedMessage = (org.apache.slider.api.proto.Messages.SignCertificateRequestProto) e.getUnfinishedMessage();
+          parsedMessage = (org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto) e.getUnfinishedMessage();
           throw e;
         } finally {
           if (parsedMessage != null) {
@@ -25759,16 +25850,16 @@
       }
       private int bitField0_;
 
-      // required string hostname = 1;
+      // optional string hostname = 1;
       private java.lang.Object hostname_ = "";
       /**
-       * <code>required string hostname = 1;</code>
+       * <code>optional string hostname = 1;</code>
        */
       public boolean hasHostname() {
         return ((bitField0_ & 0x00000001) == 0x00000001);
       }
       /**
-       * <code>required string hostname = 1;</code>
+       * <code>optional string hostname = 1;</code>
        */
       public java.lang.String getHostname() {
         java.lang.Object ref = hostname_;
@@ -25782,7 +25873,7 @@
         }
       }
       /**
-       * <code>required string hostname = 1;</code>
+       * <code>optional string hostname = 1;</code>
        */
       public com.google.protobuf.ByteString
           getHostnameBytes() {
@@ -25798,7 +25889,7 @@
         }
       }
       /**
-       * <code>required string hostname = 1;</code>
+       * <code>optional string hostname = 1;</code>
        */
       public Builder setHostname(
           java.lang.String value) {
@@ -25811,7 +25902,7 @@
         return this;
       }
       /**
-       * <code>required string hostname = 1;</code>
+       * <code>optional string hostname = 1;</code>
        */
       public Builder clearHostname() {
         bitField0_ = (bitField0_ & ~0x00000001);
@@ -25820,7 +25911,7 @@
         return this;
       }
       /**
-       * <code>required string hostname = 1;</code>
+       * <code>optional string hostname = 1;</code>
        */
       public Builder setHostnameBytes(
           com.google.protobuf.ByteString value) {
@@ -25833,232 +25924,271 @@
         return this;
       }
 
-      // required string certRequest = 2;
-      private java.lang.Object certRequest_ = "";
+      // required string requesterId = 2;
+      private java.lang.Object requesterId_ = "";
       /**
-       * <code>required string certRequest = 2;</code>
+       * <code>required string requesterId = 2;</code>
        */
-      public boolean hasCertRequest() {
+      public boolean hasRequesterId() {
         return ((bitField0_ & 0x00000002) == 0x00000002);
       }
       /**
-       * <code>required string certRequest = 2;</code>
+       * <code>required string requesterId = 2;</code>
        */
-      public java.lang.String getCertRequest() {
-        java.lang.Object ref = certRequest_;
+      public java.lang.String getRequesterId() {
+        java.lang.Object ref = requesterId_;
         if (!(ref instanceof java.lang.String)) {
           java.lang.String s = ((com.google.protobuf.ByteString) ref)
               .toStringUtf8();
-          certRequest_ = s;
+          requesterId_ = s;
           return s;
         } else {
           return (java.lang.String) ref;
         }
       }
       /**
-       * <code>required string certRequest = 2;</code>
+       * <code>required string requesterId = 2;</code>
        */
       public com.google.protobuf.ByteString
-          getCertRequestBytes() {
-        java.lang.Object ref = certRequest_;
+          getRequesterIdBytes() {
+        java.lang.Object ref = requesterId_;
         if (ref instanceof String) {
           com.google.protobuf.ByteString b = 
               com.google.protobuf.ByteString.copyFromUtf8(
                   (java.lang.String) ref);
-          certRequest_ = b;
+          requesterId_ = b;
           return b;
         } else {
           return (com.google.protobuf.ByteString) ref;
         }
       }
       /**
-       * <code>required string certRequest = 2;</code>
+       * <code>required string requesterId = 2;</code>
        */
-      public Builder setCertRequest(
+      public Builder setRequesterId(
           java.lang.String value) {
         if (value == null) {
     throw new NullPointerException();
   }
   bitField0_ |= 0x00000002;
-        certRequest_ = value;
+        requesterId_ = value;
         onChanged();
         return this;
       }
       /**
-       * <code>required string certRequest = 2;</code>
+       * <code>required string requesterId = 2;</code>
        */
-      public Builder clearCertRequest() {
+      public Builder clearRequesterId() {
         bitField0_ = (bitField0_ & ~0x00000002);
-        certRequest_ = getDefaultInstance().getCertRequest();
+        requesterId_ = getDefaultInstance().getRequesterId();
         onChanged();
         return this;
       }
       /**
-       * <code>required string certRequest = 2;</code>
+       * <code>required string requesterId = 2;</code>
        */
-      public Builder setCertRequestBytes(
+      public Builder setRequesterIdBytes(
           com.google.protobuf.ByteString value) {
         if (value == null) {
     throw new NullPointerException();
   }
   bitField0_ |= 0x00000002;
-        certRequest_ = value;
+        requesterId_ = value;
         onChanged();
         return this;
       }
 
-      // required string passPhrase = 3;
-      private java.lang.Object passPhrase_ = "";
+      // required string password = 3;
+      private java.lang.Object password_ = "";
       /**
-       * <code>required string passPhrase = 3;</code>
+       * <code>required string password = 3;</code>
        */
-      public boolean hasPassPhrase() {
+      public boolean hasPassword() {
         return ((bitField0_ & 0x00000004) == 0x00000004);
       }
       /**
-       * <code>required string passPhrase = 3;</code>
+       * <code>required string password = 3;</code>
        */
-      public java.lang.String getPassPhrase() {
-        java.lang.Object ref = passPhrase_;
+      public java.lang.String getPassword() {
+        java.lang.Object ref = password_;
         if (!(ref instanceof java.lang.String)) {
           java.lang.String s = ((com.google.protobuf.ByteString) ref)
               .toStringUtf8();
-          passPhrase_ = s;
+          password_ = s;
           return s;
         } else {
           return (java.lang.String) ref;
         }
       }
       /**
-       * <code>required string passPhrase = 3;</code>
+       * <code>required string password = 3;</code>
        */
       public com.google.protobuf.ByteString
-          getPassPhraseBytes() {
-        java.lang.Object ref = passPhrase_;
+          getPasswordBytes() {
+        java.lang.Object ref = password_;
         if (ref instanceof String) {
           com.google.protobuf.ByteString b = 
               com.google.protobuf.ByteString.copyFromUtf8(
                   (java.lang.String) ref);
-          passPhrase_ = b;
+          password_ = b;
           return b;
         } else {
           return (com.google.protobuf.ByteString) ref;
         }
       }
       /**
-       * <code>required string passPhrase = 3;</code>
+       * <code>required string password = 3;</code>
        */
-      public Builder setPassPhrase(
+      public Builder setPassword(
           java.lang.String value) {
         if (value == null) {
     throw new NullPointerException();
   }
   bitField0_ |= 0x00000004;
-        passPhrase_ = value;
+        password_ = value;
         onChanged();
         return this;
       }
       /**
-       * <code>required string passPhrase = 3;</code>
+       * <code>required string password = 3;</code>
        */
-      public Builder clearPassPhrase() {
+      public Builder clearPassword() {
         bitField0_ = (bitField0_ & ~0x00000004);
-        passPhrase_ = getDefaultInstance().getPassPhrase();
+        password_ = getDefaultInstance().getPassword();
         onChanged();
         return this;
       }
       /**
-       * <code>required string passPhrase = 3;</code>
+       * <code>required string password = 3;</code>
        */
-      public Builder setPassPhraseBytes(
+      public Builder setPasswordBytes(
           com.google.protobuf.ByteString value) {
         if (value == null) {
     throw new NullPointerException();
   }
   bitField0_ |= 0x00000004;
-        passPhrase_ = value;
+        password_ = value;
         onChanged();
         return this;
       }
 
-      // @@protoc_insertion_point(builder_scope:org.apache.slider.api.SignCertificateRequestProto)
+      // required string type = 4;
+      private java.lang.Object type_ = "";
+      /**
+       * <code>required string type = 4;</code>
+       */
+      public boolean hasType() {
+        return ((bitField0_ & 0x00000008) == 0x00000008);
+      }
+      /**
+       * <code>required string type = 4;</code>
+       */
+      public java.lang.String getType() {
+        java.lang.Object ref = type_;
+        if (!(ref instanceof java.lang.String)) {
+          java.lang.String s = ((com.google.protobuf.ByteString) ref)
+              .toStringUtf8();
+          type_ = s;
+          return s;
+        } else {
+          return (java.lang.String) ref;
+        }
+      }
+      /**
+       * <code>required string type = 4;</code>
+       */
+      public com.google.protobuf.ByteString
+          getTypeBytes() {
+        java.lang.Object ref = type_;
+        if (ref instanceof String) {
+          com.google.protobuf.ByteString b = 
+              com.google.protobuf.ByteString.copyFromUtf8(
+                  (java.lang.String) ref);
+          type_ = b;
+          return b;
+        } else {
+          return (com.google.protobuf.ByteString) ref;
+        }
+      }
+      /**
+       * <code>required string type = 4;</code>
+       */
+      public Builder setType(
+          java.lang.String value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  bitField0_ |= 0x00000008;
+        type_ = value;
+        onChanged();
+        return this;
+      }
+      /**
+       * <code>required string type = 4;</code>
+       */
+      public Builder clearType() {
+        bitField0_ = (bitField0_ & ~0x00000008);
+        type_ = getDefaultInstance().getType();
+        onChanged();
+        return this;
+      }
+      /**
+       * <code>required string type = 4;</code>
+       */
+      public Builder setTypeBytes(
+          com.google.protobuf.ByteString value) {
+        if (value == null) {
+    throw new NullPointerException();
+  }
+  bitField0_ |= 0x00000008;
+        type_ = value;
+        onChanged();
+        return this;
+      }
+
+      // @@protoc_insertion_point(builder_scope:org.apache.slider.api.GetCertificateStoreRequestProto)
     }
 
     static {
-      defaultInstance = new SignCertificateRequestProto(true);
+      defaultInstance = new GetCertificateStoreRequestProto(true);
       defaultInstance.initFields();
     }
 
-    // @@protoc_insertion_point(class_scope:org.apache.slider.api.SignCertificateRequestProto)
+    // @@protoc_insertion_point(class_scope:org.apache.slider.api.GetCertificateStoreRequestProto)
   }
 
-  public interface SignCertificateResponseProtoOrBuilder
+  public interface GetCertificateStoreResponseProtoOrBuilder
       extends com.google.protobuf.MessageOrBuilder {
 
-    // required string result = 1;
+    // required bytes store = 1;
     /**
-     * <code>required string result = 1;</code>
+     * <code>required bytes store = 1;</code>
      */
-    boolean hasResult();
+    boolean hasStore();
     /**
-     * <code>required string result = 1;</code>
+     * <code>required bytes store = 1;</code>
      */
-    java.lang.String getResult();
-    /**
-     * <code>required string result = 1;</code>
-     */
-    com.google.protobuf.ByteString
-        getResultBytes();
-
-    // required string signedCertificate = 2;
-    /**
-     * <code>required string signedCertificate = 2;</code>
-     */
-    boolean hasSignedCertificate();
-    /**
-     * <code>required string signedCertificate = 2;</code>
-     */
-    java.lang.String getSignedCertificate();
-    /**
-     * <code>required string signedCertificate = 2;</code>
-     */
-    com.google.protobuf.ByteString
-        getSignedCertificateBytes();
-
-    // required string signingMessage = 3;
-    /**
-     * <code>required string signingMessage = 3;</code>
-     */
-    boolean hasSigningMessage();
-    /**
-     * <code>required string signingMessage = 3;</code>
-     */
-    java.lang.String getSigningMessage();
-    /**
-     * <code>required string signingMessage = 3;</code>
-     */
-    com.google.protobuf.ByteString
-        getSigningMessageBytes();
+    com.google.protobuf.ByteString getStore();
   }
   /**
-   * Protobuf type {@code org.apache.slider.api.SignCertificateResponseProto}
+   * Protobuf type {@code org.apache.slider.api.GetCertificateStoreResponseProto}
    */
-  public static final class SignCertificateResponseProto extends
+  public static final class GetCertificateStoreResponseProto extends
       com.google.protobuf.GeneratedMessage
-      implements SignCertificateResponseProtoOrBuilder {
-    // Use SignCertificateResponseProto.newBuilder() to construct.
-    private SignCertificateResponseProto(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
+      implements GetCertificateStoreResponseProtoOrBuilder {
+    // Use GetCertificateStoreResponseProto.newBuilder() to construct.
+    private GetCertificateStoreResponseProto(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
       super(builder);
       this.unknownFields = builder.getUnknownFields();
     }
-    private SignCertificateResponseProto(boolean noInit) { this.unknownFields = com.google.protobuf.UnknownFieldSet.getDefaultInstance(); }
+    private GetCertificateStoreResponseProto(boolean noInit) { this.unknownFields = com.google.protobuf.UnknownFieldSet.getDefaultInstance(); }
 
-    private static final SignCertificateResponseProto defaultInstance;
-    public static SignCertificateResponseProto getDefaultInstance() {
+    private static final GetCertificateStoreResponseProto defaultInstance;
+    public static GetCertificateStoreResponseProto getDefaultInstance() {
       return defaultInstance;
     }
 
-    public SignCertificateResponseProto getDefaultInstanceForType() {
+    public GetCertificateStoreResponseProto getDefaultInstanceForType() {
       return defaultInstance;
     }
 
@@ -26068,7 +26198,7 @@
         getUnknownFields() {
       return this.unknownFields;
     }
-    private SignCertificateResponseProto(
+    private GetCertificateStoreResponseProto(
         com.google.protobuf.CodedInputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
@@ -26093,17 +26223,7 @@
             }
             case 10: {
               bitField0_ |= 0x00000001;
-              result_ = input.readBytes();
-              break;
-            }
-            case 18: {
-              bitField0_ |= 0x00000002;
-              signedCertificate_ = input.readBytes();
-              break;
-            }
-            case 26: {
-              bitField0_ |= 0x00000004;
-              signingMessage_ = input.readBytes();
+              store_ = input.readBytes();
               break;
             }
           }
@@ -26120,180 +26240,57 @@
     }
     public static final com.google.protobuf.Descriptors.Descriptor
         getDescriptor() {
-      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateResponseProto_descriptor;
+      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_descriptor;
     }
 
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateResponseProto_fieldAccessorTable
+      return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
-              org.apache.slider.api.proto.Messages.SignCertificateResponseProto.class, org.apache.slider.api.proto.Messages.SignCertificateResponseProto.Builder.class);
+              org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.class, org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.Builder.class);
     }
 
-    public static com.google.protobuf.Parser<SignCertificateResponseProto> PARSER =
-        new com.google.protobuf.AbstractParser<SignCertificateResponseProto>() {
-      public SignCertificateResponseProto parsePartialFrom(
+    public static com.google.protobuf.Parser<GetCertificateStoreResponseProto> PARSER =
+        new com.google.protobuf.AbstractParser<GetCertificateStoreResponseProto>() {
+      public GetCertificateStoreResponseProto parsePartialFrom(
           com.google.protobuf.CodedInputStream input,
           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
           throws com.google.protobuf.InvalidProtocolBufferException {
-        return new SignCertificateResponseProto(input, extensionRegistry);
+        return new GetCertificateStoreResponseProto(input, extensionRegistry);
       }
     };
 
     @java.lang.Override
-    public com.google.protobuf.Parser<SignCertificateResponseProto> getParserForType() {
+    public com.google.protobuf.Parser<GetCertificateStoreResponseProto> getParserForType() {
       return PARSER;
     }
 
     private int bitField0_;
-    // required string result = 1;
-    public static final int RESULT_FIELD_NUMBER = 1;
-    private java.lang.Object result_;
+    // required bytes store = 1;
+    public static final int STORE_FIELD_NUMBER = 1;
+    private com.google.protobuf.ByteString store_;
     /**
-     * <code>required string result = 1;</code>
+     * <code>required bytes store = 1;</code>
      */
-    public boolean hasResult() {
+    public boolean hasStore() {
       return ((bitField0_ & 0x00000001) == 0x00000001);
     }
     /**
-     * <code>required string result = 1;</code>
+     * <code>required bytes store = 1;</code>
      */
-    public java.lang.String getResult() {
-      java.lang.Object ref = result_;
-      if (ref instanceof java.lang.String) {
-        return (java.lang.String) ref;
-      } else {
-        com.google.protobuf.ByteString bs = 
-            (com.google.protobuf.ByteString) ref;
-        java.lang.String s = bs.toStringUtf8();
-        if (bs.isValidUtf8()) {
-          result_ = s;
-        }
-        return s;
-      }
-    }
-    /**
-     * <code>required string result = 1;</code>
-     */
-    public com.google.protobuf.ByteString
-        getResultBytes() {
-      java.lang.Object ref = result_;
-      if (ref instanceof java.lang.String) {
-        com.google.protobuf.ByteString b = 
-            com.google.protobuf.ByteString.copyFromUtf8(
-                (java.lang.String) ref);
-        result_ = b;
-        return b;
-      } else {
-        return (com.google.protobuf.ByteString) ref;
-      }
-    }
-
-    // required string signedCertificate = 2;
-    public static final int SIGNEDCERTIFICATE_FIELD_NUMBER = 2;
-    private java.lang.Object signedCertificate_;
-    /**
-     * <code>required string signedCertificate = 2;</code>
-     */
-    public boolean hasSignedCertificate() {
-      return ((bitField0_ & 0x00000002) == 0x00000002);
-    }
-    /**
-     * <code>required string signedCertificate = 2;</code>
-     */
-    public java.lang.String getSignedCertificate() {
-      java.lang.Object ref = signedCertificate_;
-      if (ref instanceof java.lang.String) {
-        return (java.lang.String) ref;
-      } else {
-        com.google.protobuf.ByteString bs = 
-            (com.google.protobuf.ByteString) ref;
-        java.lang.String s = bs.toStringUtf8();
-        if (bs.isValidUtf8()) {
-          signedCertificate_ = s;
-        }
-        return s;
-      }
-    }
-    /**
-     * <code>required string signedCertificate = 2;</code>
-     */
-    public com.google.protobuf.ByteString
-        getSignedCertificateBytes() {
-      java.lang.Object ref = signedCertificate_;
-      if (ref instanceof java.lang.String) {
-        com.google.protobuf.ByteString b = 
-            com.google.protobuf.ByteString.copyFromUtf8(
-                (java.lang.String) ref);
-        signedCertificate_ = b;
-        return b;
-      } else {
-        return (com.google.protobuf.ByteString) ref;
-      }
-    }
-
-    // required string signingMessage = 3;
-    public static final int SIGNINGMESSAGE_FIELD_NUMBER = 3;
-    private java.lang.Object signingMessage_;
-    /**
-     * <code>required string signingMessage = 3;</code>
-     */
-    public boolean hasSigningMessage() {
-      return ((bitField0_ & 0x00000004) == 0x00000004);
-    }
-    /**
-     * <code>required string signingMessage = 3;</code>
-     */
-    public java.lang.String getSigningMessage() {
-      java.lang.Object ref = signingMessage_;
-      if (ref instanceof java.lang.String) {
-        return (java.lang.String) ref;
-      } else {
-        com.google.protobuf.ByteString bs = 
-            (com.google.protobuf.ByteString) ref;
-        java.lang.String s = bs.toStringUtf8();
-        if (bs.isValidUtf8()) {
-          signingMessage_ = s;
-        }
-        return s;
-      }
-    }
-    /**
-     * <code>required string signingMessage = 3;</code>
-     */
-    public com.google.protobuf.ByteString
-        getSigningMessageBytes() {
-      java.lang.Object ref = signingMessage_;
-      if (ref instanceof java.lang.String) {
-        com.google.protobuf.ByteString b = 
-            com.google.protobuf.ByteString.copyFromUtf8(
-                (java.lang.String) ref);
-        signingMessage_ = b;
-        return b;
-      } else {
-        return (com.google.protobuf.ByteString) ref;
-      }
+    public com.google.protobuf.ByteString getStore() {
+      return store_;
     }
 
     private void initFields() {
-      result_ = "";
-      signedCertificate_ = "";
-      signingMessage_ = "";
+      store_ = com.google.protobuf.ByteString.EMPTY;
     }
     private byte memoizedIsInitialized = -1;
     public final boolean isInitialized() {
       byte isInitialized = memoizedIsInitialized;
       if (isInitialized != -1) return isInitialized == 1;
 
-      if (!hasResult()) {
-        memoizedIsInitialized = 0;
-        return false;
-      }
-      if (!hasSignedCertificate()) {
-        memoizedIsInitialized = 0;
-        return false;
-      }
-      if (!hasSigningMessage()) {
+      if (!hasStore()) {
         memoizedIsInitialized = 0;
         return false;
       }
@@ -26305,13 +26302,7 @@
                         throws java.io.IOException {
       getSerializedSize();
       if (((bitField0_ & 0x00000001) == 0x00000001)) {
-        output.writeBytes(1, getResultBytes());
-      }
-      if (((bitField0_ & 0x00000002) == 0x00000002)) {
-        output.writeBytes(2, getSignedCertificateBytes());
-      }
-      if (((bitField0_ & 0x00000004) == 0x00000004)) {
-        output.writeBytes(3, getSigningMessageBytes());
+        output.writeBytes(1, store_);
       }
       getUnknownFields().writeTo(output);
     }
@@ -26324,15 +26315,7 @@
       size = 0;
       if (((bitField0_ & 0x00000001) == 0x00000001)) {
         size += com.google.protobuf.CodedOutputStream
-          .computeBytesSize(1, getResultBytes());
-      }
-      if (((bitField0_ & 0x00000002) == 0x00000002)) {
-        size += com.google.protobuf.CodedOutputStream
-          .computeBytesSize(2, getSignedCertificateBytes());
-      }
-      if (((bitField0_ & 0x00000004) == 0x00000004)) {
-        size += com.google.protobuf.CodedOutputStream
-          .computeBytesSize(3, getSigningMessageBytes());
+          .computeBytesSize(1, store_);
       }
       size += getUnknownFields().getSerializedSize();
       memoizedSerializedSize = size;
@@ -26351,26 +26334,16 @@
       if (obj == this) {
        return true;
       }
-      if (!(obj instanceof org.apache.slider.api.proto.Messages.SignCertificateResponseProto)) {
+      if (!(obj instanceof org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto)) {
         return super.equals(obj);
       }
-      org.apache.slider.api.proto.Messages.SignCertificateResponseProto other = (org.apache.slider.api.proto.Messages.SignCertificateResponseProto) obj;
+      org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto other = (org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto) obj;
 
       boolean result = true;
-      result = result && (hasResult() == other.hasResult());
-      if (hasResult()) {
-        result = result && getResult()
-            .equals(other.getResult());
-      }
-      result = result && (hasSignedCertificate() == other.hasSignedCertificate());
-      if (hasSignedCertificate()) {
-        result = result && getSignedCertificate()
-            .equals(other.getSignedCertificate());
-      }
-      result = result && (hasSigningMessage() == other.hasSigningMessage());
-      if (hasSigningMessage()) {
-        result = result && getSigningMessage()
-            .equals(other.getSigningMessage());
+      result = result && (hasStore() == other.hasStore());
+      if (hasStore()) {
+        result = result && getStore()
+            .equals(other.getStore());
       }
       result = result &&
           getUnknownFields().equals(other.getUnknownFields());
@@ -26385,70 +26358,62 @@
       }
       int hash = 41;
       hash = (19 * hash) + getDescriptorForType().hashCode();
-      if (hasResult()) {
-        hash = (37 * hash) + RESULT_FIELD_NUMBER;
-        hash = (53 * hash) + getResult().hashCode();
-      }
-      if (hasSignedCertificate()) {
-        hash = (37 * hash) + SIGNEDCERTIFICATE_FIELD_NUMBER;
-        hash = (53 * hash) + getSignedCertificate().hashCode();
-      }
-      if (hasSigningMessage()) {
-        hash = (37 * hash) + SIGNINGMESSAGE_FIELD_NUMBER;
-        hash = (53 * hash) + getSigningMessage().hashCode();
+      if (hasStore()) {
+        hash = (37 * hash) + STORE_FIELD_NUMBER;
+        hash = (53 * hash) + getStore().hashCode();
       }
       hash = (29 * hash) + getUnknownFields().hashCode();
       memoizedHashCode = hash;
       return hash;
     }
 
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(
         com.google.protobuf.ByteString data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(
         com.google.protobuf.ByteString data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(byte[] data)
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(byte[] data)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(
         byte[] data,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws com.google.protobuf.InvalidProtocolBufferException {
       return PARSER.parseFrom(data, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(java.io.InputStream input)
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(java.io.InputStream input)
         throws java.io.IOException {
       return PARSER.parseFrom(input);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(
         java.io.InputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
       return PARSER.parseFrom(input, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseDelimitedFrom(java.io.InputStream input)
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseDelimitedFrom(java.io.InputStream input)
         throws java.io.IOException {
       return PARSER.parseDelimitedFrom(input);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseDelimitedFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseDelimitedFrom(
         java.io.InputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
       return PARSER.parseDelimitedFrom(input, extensionRegistry);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(
         com.google.protobuf.CodedInputStream input)
         throws java.io.IOException {
       return PARSER.parseFrom(input);
     }
-    public static org.apache.slider.api.proto.Messages.SignCertificateResponseProto parseFrom(
+    public static org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parseFrom(
         com.google.protobuf.CodedInputStream input,
         com.google.protobuf.ExtensionRegistryLite extensionRegistry)
         throws java.io.IOException {
@@ -26457,7 +26422,7 @@
 
     public static Builder newBuilder() { return Builder.create(); }
     public Builder newBuilderForType() { return newBuilder(); }
-    public static Builder newBuilder(org.apache.slider.api.proto.Messages.SignCertificateResponseProto prototype) {
+    public static Builder newBuilder(org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto prototype) {
       return newBuilder().mergeFrom(prototype);
     }
     public Builder toBuilder() { return newBuilder(this); }
@@ -26469,24 +26434,24 @@
       return builder;
     }
     /**
-     * Protobuf type {@code org.apache.slider.api.SignCertificateResponseProto}
+     * Protobuf type {@code org.apache.slider.api.GetCertificateStoreResponseProto}
      */
     public static final class Builder extends
         com.google.protobuf.GeneratedMessage.Builder<Builder>
-       implements org.apache.slider.api.proto.Messages.SignCertificateResponseProtoOrBuilder {
+       implements org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProtoOrBuilder {
       public static final com.google.protobuf.Descriptors.Descriptor
           getDescriptor() {
-        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateResponseProto_descriptor;
+        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_descriptor;
       }
 
       protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
           internalGetFieldAccessorTable() {
-        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateResponseProto_fieldAccessorTable
+        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_fieldAccessorTable
             .ensureFieldAccessorsInitialized(
-                org.apache.slider.api.proto.Messages.SignCertificateResponseProto.class, org.apache.slider.api.proto.Messages.SignCertificateResponseProto.Builder.class);
+                org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.class, org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.Builder.class);
       }
 
-      // Construct using org.apache.slider.api.proto.Messages.SignCertificateResponseProto.newBuilder()
+      // Construct using org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.newBuilder()
       private Builder() {
         maybeForceBuilderInitialization();
       }
@@ -26506,12 +26471,8 @@
 
       public Builder clear() {
         super.clear();
-        result_ = "";
+        store_ = com.google.protobuf.ByteString.EMPTY;
         bitField0_ = (bitField0_ & ~0x00000001);
-        signedCertificate_ = "";
-        bitField0_ = (bitField0_ & ~0x00000002);
-        signingMessage_ = "";
-        bitField0_ = (bitField0_ & ~0x00000004);
         return this;
       }
 
@@ -26521,82 +26482,54 @@
 
       public com.google.protobuf.Descriptors.Descriptor
           getDescriptorForType() {
-        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_SignCertificateResponseProto_descriptor;
+        return org.apache.slider.api.proto.Messages.internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_descriptor;
       }
 
-      public org.apache.slider.api.proto.Messages.SignCertificateResponseProto getDefaultInstanceForType() {
-        return org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance();
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto getDefaultInstanceForType() {
+        return org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance();
       }
 
-      public org.apache.slider.api.proto.Messages.SignCertificateResponseProto build() {
-        org.apache.slider.api.proto.Messages.SignCertificateResponseProto result = buildPartial();
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto build() {
+        org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto result = buildPartial();
         if (!result.isInitialized()) {
           throw newUninitializedMessageException(result);
         }
         return result;
       }
 
-      public org.apache.slider.api.proto.Messages.SignCertificateResponseProto buildPartial() {
-        org.apache.slider.api.proto.Messages.SignCertificateResponseProto result = new org.apache.slider.api.proto.Messages.SignCertificateResponseProto(this);
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto buildPartial() {
+        org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto result = new org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto(this);
         int from_bitField0_ = bitField0_;
         int to_bitField0_ = 0;
         if (((from_bitField0_ & 0x00000001) == 0x00000001)) {
           to_bitField0_ |= 0x00000001;
         }
-        result.result_ = result_;
-        if (((from_bitField0_ & 0x00000002) == 0x00000002)) {
-          to_bitField0_ |= 0x00000002;
-        }
-        result.signedCertificate_ = signedCertificate_;
-        if (((from_bitField0_ & 0x00000004) == 0x00000004)) {
-          to_bitField0_ |= 0x00000004;
-        }
-        result.signingMessage_ = signingMessage_;
+        result.store_ = store_;
         result.bitField0_ = to_bitField0_;
         onBuilt();
         return result;
       }
 
       public Builder mergeFrom(com.google.protobuf.Message other) {
-        if (other instanceof org.apache.slider.api.proto.Messages.SignCertificateResponseProto) {
-          return mergeFrom((org.apache.slider.api.proto.Messages.SignCertificateResponseProto)other);
+        if (other instanceof org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto) {
+          return mergeFrom((org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto)other);
         } else {
           super.mergeFrom(other);
           return this;
         }
       }
 
-      public Builder mergeFrom(org.apache.slider.api.proto.Messages.SignCertificateResponseProto other) {
-        if (other == org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance()) return this;
-        if (other.hasResult()) {
-          bitField0_ |= 0x00000001;
-          result_ = other.result_;
-          onChanged();
-        }
-        if (other.hasSignedCertificate()) {
-          bitField0_ |= 0x00000002;
-          signedCertificate_ = other.signedCertificate_;
-          onChanged();
-        }
-        if (other.hasSigningMessage()) {
-          bitField0_ |= 0x00000004;
-          signingMessage_ = other.signingMessage_;
-          onChanged();
+      public Builder mergeFrom(org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto other) {
+        if (other == org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance()) return this;
+        if (other.hasStore()) {
+          setStore(other.getStore());
         }
         this.mergeUnknownFields(other.getUnknownFields());
         return this;
       }
 
       public final boolean isInitialized() {
-        if (!hasResult()) {
-          
-          return false;
-        }
-        if (!hasSignedCertificate()) {
-          
-          return false;
-        }
-        if (!hasSigningMessage()) {
+        if (!hasStore()) {
           
           return false;
         }
@@ -26607,11 +26540,11 @@
           com.google.protobuf.CodedInputStream input,
           com.google.protobuf.ExtensionRegistryLite extensionRegistry)
           throws java.io.IOException {
-        org.apache.slider.api.proto.Messages.SignCertificateResponseProto parsedMessage = null;
+        org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto parsedMessage = null;
         try {
           parsedMessage = PARSER.parsePartialFrom(input, extensionRegistry);
         } catch (com.google.protobuf.InvalidProtocolBufferException e) {
-          parsedMessage = (org.apache.slider.api.proto.Messages.SignCertificateResponseProto) e.getUnfinishedMessage();
+          parsedMessage = (org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto) e.getUnfinishedMessage();
           throw e;
         } finally {
           if (parsedMessage != null) {
@@ -26622,237 +26555,51 @@
       }
       private int bitField0_;
 
-      // required string result = 1;
-      private java.lang.Object result_ = "";
+      // required bytes store = 1;
+      private com.google.protobuf.ByteString store_ = com.google.protobuf.ByteString.EMPTY;
       /**
-       * <code>required string result = 1;</code>
+       * <code>required bytes store = 1;</code>
        */
-      public boolean hasResult() {
+      public boolean hasStore() {
         return ((bitField0_ & 0x00000001) == 0x00000001);
       }
       /**
-       * <code>required string result = 1;</code>
+       * <code>required bytes store = 1;</code>
        */
-      public java.lang.String getResult() {
-        java.lang.Object ref = result_;
-        if (!(ref instanceof java.lang.String)) {
-          java.lang.String s = ((com.google.protobuf.ByteString) ref)
-              .toStringUtf8();
-          result_ = s;
-          return s;
-        } else {
-          return (java.lang.String) ref;
-        }
+      public com.google.protobuf.ByteString getStore() {
+        return store_;
       }
       /**
-       * <code>required string result = 1;</code>
+       * <code>required bytes store = 1;</code>
        */
-      public com.google.protobuf.ByteString
-          getResultBytes() {
-        java.lang.Object ref = result_;
-        if (ref instanceof String) {
-          com.google.protobuf.ByteString b = 
-              com.google.protobuf.ByteString.copyFromUtf8(
-                  (java.lang.String) ref);
-          result_ = b;
-          return b;
-        } else {
-          return (com.google.protobuf.ByteString) ref;
-        }
-      }
-      /**
-       * <code>required string result = 1;</code>
-       */
-      public Builder setResult(
-          java.lang.String value) {
+      public Builder setStore(com.google.protobuf.ByteString value) {
         if (value == null) {
     throw new NullPointerException();
   }
   bitField0_ |= 0x00000001;
-        result_ = value;
+        store_ = value;
         onChanged();
         return this;
       }
       /**
-       * <code>required string result = 1;</code>
+       * <code>required bytes store = 1;</code>
        */
-      public Builder clearResult() {
+      public Builder clearStore() {
         bitField0_ = (bitField0_ & ~0x00000001);
-        result_ = getDefaultInstance().getResult();
-        onChanged();
-        return this;
-      }
-      /**
-       * <code>required string result = 1;</code>
-       */
-      public Builder setResultBytes(
-          com.google.protobuf.ByteString value) {
-        if (value == null) {
-    throw new NullPointerException();
-  }
-  bitField0_ |= 0x00000001;
-        result_ = value;
+        store_ = getDefaultInstance().getStore();
         onChanged();
         return this;
       }
 
-      // required string signedCertificate = 2;
-      private java.lang.Object signedCertificate_ = "";
-      /**
-       * <code>required string signedCertificate = 2;</code>
-       */
-      public boolean hasSignedCertificate() {
-        return ((bitField0_ & 0x00000002) == 0x00000002);
-      }
-      /**
-       * <code>required string signedCertificate = 2;</code>
-       */
-      public java.lang.String getSignedCertificate() {
-        java.lang.Object ref = signedCertificate_;
-        if (!(ref instanceof java.lang.String)) {
-          java.lang.String s = ((com.google.protobuf.ByteString) ref)
-              .toStringUtf8();
-          signedCertificate_ = s;
-          return s;
-        } else {
-          return (java.lang.String) ref;
-        }
-      }
-      /**
-       * <code>required string signedCertificate = 2;</code>
-       */
-      public com.google.protobuf.ByteString
-          getSignedCertificateBytes() {
-        java.lang.Object ref = signedCertificate_;
-        if (ref instanceof String) {
-          com.google.protobuf.ByteString b = 
-              com.google.protobuf.ByteString.copyFromUtf8(
-                  (java.lang.String) ref);
-          signedCertificate_ = b;
-          return b;
-        } else {
-          return (com.google.protobuf.ByteString) ref;
-        }
-      }
-      /**
-       * <code>required string signedCertificate = 2;</code>
-       */
-      public Builder setSignedCertificate(
-          java.lang.String value) {
-        if (value == null) {
-    throw new NullPointerException();
-  }
-  bitField0_ |= 0x00000002;
-        signedCertificate_ = value;
-        onChanged();
-        return this;
-      }
-      /**
-       * <code>required string signedCertificate = 2;</code>
-       */
-      public Builder clearSignedCertificate() {
-        bitField0_ = (bitField0_ & ~0x00000002);
-        signedCertificate_ = getDefaultInstance().getSignedCertificate();
-        onChanged();
-        return this;
-      }
-      /**
-       * <code>required string signedCertificate = 2;</code>
-       */
-      public Builder setSignedCertificateBytes(
-          com.google.protobuf.ByteString value) {
-        if (value == null) {
-    throw new NullPointerException();
-  }
-  bitField0_ |= 0x00000002;
-        signedCertificate_ = value;
-        onChanged();
-        return this;
-      }
-
-      // required string signingMessage = 3;
-      private java.lang.Object signingMessage_ = "";
-      /**
-       * <code>required string signingMessage = 3;</code>
-       */
-      public boolean hasSigningMessage() {
-        return ((bitField0_ & 0x00000004) == 0x00000004);
-      }
-      /**
-       * <code>required string signingMessage = 3;</code>
-       */
-      public java.lang.String getSigningMessage() {
-        java.lang.Object ref = signingMessage_;
-        if (!(ref instanceof java.lang.String)) {
-          java.lang.String s = ((com.google.protobuf.ByteString) ref)
-              .toStringUtf8();
-          signingMessage_ = s;
-          return s;
-        } else {
-          return (java.lang.String) ref;
-        }
-      }
-      /**
-       * <code>required string signingMessage = 3;</code>
-       */
-      public com.google.protobuf.ByteString
-          getSigningMessageBytes() {
-        java.lang.Object ref = signingMessage_;
-        if (ref instanceof String) {
-          com.google.protobuf.ByteString b = 
-              com.google.protobuf.ByteString.copyFromUtf8(
-                  (java.lang.String) ref);
-          signingMessage_ = b;
-          return b;
-        } else {
-          return (com.google.protobuf.ByteString) ref;
-        }
-      }
-      /**
-       * <code>required string signingMessage = 3;</code>
-       */
-      public Builder setSigningMessage(
-          java.lang.String value) {
-        if (value == null) {
-    throw new NullPointerException();
-  }
-  bitField0_ |= 0x00000004;
-        signingMessage_ = value;
-        onChanged();
-        return this;
-      }
-      /**
-       * <code>required string signingMessage = 3;</code>
-       */
-      public Builder clearSigningMessage() {
-        bitField0_ = (bitField0_ & ~0x00000004);
-        signingMessage_ = getDefaultInstance().getSigningMessage();
-        onChanged();
-        return this;
-      }
-      /**
-       * <code>required string signingMessage = 3;</code>
-       */
-      public Builder setSigningMessageBytes(
-          com.google.protobuf.ByteString value) {
-        if (value == null) {
-    throw new NullPointerException();
-  }
-  bitField0_ |= 0x00000004;
-        signingMessage_ = value;
-        onChanged();
-        return this;
-      }
-
-      // @@protoc_insertion_point(builder_scope:org.apache.slider.api.SignCertificateResponseProto)
+      // @@protoc_insertion_point(builder_scope:org.apache.slider.api.GetCertificateStoreResponseProto)
     }
 
     static {
-      defaultInstance = new SignCertificateResponseProto(true);
+      defaultInstance = new GetCertificateStoreResponseProto(true);
       defaultInstance.initFields();
     }
 
-    // @@protoc_insertion_point(class_scope:org.apache.slider.api.SignCertificateResponseProto)
+    // @@protoc_insertion_point(class_scope:org.apache.slider.api.GetCertificateStoreResponseProto)
   }
 
   private static com.google.protobuf.Descriptors.Descriptor
@@ -27061,15 +26808,15 @@
     com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internal_static_org_apache_slider_api_WrappedJsonProto_fieldAccessorTable;
   private static com.google.protobuf.Descriptors.Descriptor
-    internal_static_org_apache_slider_api_SignCertificateRequestProto_descriptor;
+    internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_descriptor;
   private static
     com.google.protobuf.GeneratedMessage.FieldAccessorTable
-      internal_static_org_apache_slider_api_SignCertificateRequestProto_fieldAccessorTable;
+      internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_fieldAccessorTable;
   private static com.google.protobuf.Descriptors.Descriptor
-    internal_static_org_apache_slider_api_SignCertificateResponseProto_descriptor;
+    internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_descriptor;
   private static
     com.google.protobuf.GeneratedMessage.FieldAccessorTable
-      internal_static_org_apache_slider_api_SignCertificateResponseProto_fieldAccessorTable;
+      internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_fieldAccessorTable;
 
   public static com.google.protobuf.Descriptors.FileDescriptor
       getDescriptor() {
@@ -27148,13 +26895,12 @@
       "etLiveComponentRequestProto\022\014\n\004name\030\001 \002(" +
       "\t\"$\n\"GetApplicationLivenessRequestProto\"" +
       "\023\n\021EmptyPayloadProto\" \n\020WrappedJsonProto" +
-      "\022\014\n\004json\030\001 \002(\t\"X\n\033SignCertificateRequest",
-      "Proto\022\020\n\010hostname\030\001 \002(\t\022\023\n\013certRequest\030\002" +
-      " \002(\t\022\022\n\npassPhrase\030\003 \002(\t\"a\n\034SignCertific" +
-      "ateResponseProto\022\016\n\006result\030\001 \002(\t\022\031\n\021sign" +
-      "edCertificate\030\002 \002(\t\022\026\n\016signingMessage\030\003 " +
-      "\002(\tB-\n\033org.apache.slider.api.protoB\010Mess" +
-      "ages\210\001\001\240\001\001"
+      "\022\014\n\004json\030\001 \002(\t\"h\n\037GetCertificateStoreReq",
+      "uestProto\022\020\n\010hostname\030\001 \001(\t\022\023\n\013requester" +
+      "Id\030\002 \002(\t\022\020\n\010password\030\003 \002(\t\022\014\n\004type\030\004 \002(\t" +
+      "\"1\n GetCertificateStoreResponseProto\022\r\n\005" +
+      "store\030\001 \002(\014B-\n\033org.apache.slider.api.pro" +
+      "toB\010Messages\210\001\001\240\001\001"
     };
     com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner assigner =
       new com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner() {
@@ -27407,18 +27153,18 @@
             com.google.protobuf.GeneratedMessage.FieldAccessorTable(
               internal_static_org_apache_slider_api_WrappedJsonProto_descriptor,
               new java.lang.String[] { "Json", });
-          internal_static_org_apache_slider_api_SignCertificateRequestProto_descriptor =
+          internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_descriptor =
             getDescriptor().getMessageTypes().get(41);
-          internal_static_org_apache_slider_api_SignCertificateRequestProto_fieldAccessorTable = new
+          internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_fieldAccessorTable = new
             com.google.protobuf.GeneratedMessage.FieldAccessorTable(
-              internal_static_org_apache_slider_api_SignCertificateRequestProto_descriptor,
-              new java.lang.String[] { "Hostname", "CertRequest", "PassPhrase", });
-          internal_static_org_apache_slider_api_SignCertificateResponseProto_descriptor =
+              internal_static_org_apache_slider_api_GetCertificateStoreRequestProto_descriptor,
+              new java.lang.String[] { "Hostname", "RequesterId", "Password", "Type", });
+          internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_descriptor =
             getDescriptor().getMessageTypes().get(42);
-          internal_static_org_apache_slider_api_SignCertificateResponseProto_fieldAccessorTable = new
+          internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_fieldAccessorTable = new
             com.google.protobuf.GeneratedMessage.FieldAccessorTable(
-              internal_static_org_apache_slider_api_SignCertificateResponseProto_descriptor,
-              new java.lang.String[] { "Result", "SignedCertificate", "SigningMessage", });
+              internal_static_org_apache_slider_api_GetCertificateStoreResponseProto_descriptor,
+              new java.lang.String[] { "Store", });
           return null;
         }
       };
diff --git a/slider-core/src/main/java/org/apache/slider/api/proto/RestTypeMarshalling.java b/slider-core/src/main/java/org/apache/slider/api/proto/RestTypeMarshalling.java
index f5dff8f..84a950d 100644
--- a/slider-core/src/main/java/org/apache/slider/api/proto/RestTypeMarshalling.java
+++ b/slider-core/src/main/java/org/apache/slider/api/proto/RestTypeMarshalling.java
@@ -18,6 +18,8 @@
 
 package org.apache.slider.api.proto;
 
+import com.google.protobuf.ByteString;
+import org.apache.commons.io.IOUtils;
 import org.apache.slider.api.types.ApplicationLivenessInformation;
 import org.apache.slider.api.types.ComponentInformation;
 import org.apache.slider.api.types.ContainerInformation;
@@ -26,8 +28,12 @@
 import org.apache.slider.core.conf.ConfTreeOperations;
 import org.apache.slider.core.persist.AggregateConfSerDeser;
 import org.apache.slider.core.persist.ConfTreeSerDeser;
+import org.apache.slider.server.services.security.SecurityStore;
 
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -80,6 +86,24 @@
     return info;
   }
 
+  public static Messages.GetCertificateStoreResponseProto marshall(
+      SecurityStore securityStore) throws IOException {
+    Messages.GetCertificateStoreResponseProto.Builder builder =
+        Messages.GetCertificateStoreResponseProto.newBuilder();
+    builder.setStore(ByteString.copyFrom(getStoreBytes(securityStore)));
+
+    return builder.build();
+  }
+
+  private static byte[] getStoreBytes(SecurityStore securityStore)
+      throws IOException {
+    InputStream is = new FileInputStream(securityStore.getFile());
+    return IOUtils.toByteArray(is);
+  }
+
+  public static byte[] unmarshall(Messages.GetCertificateStoreResponseProto response) {
+    return response.getStore().toByteArray();
+  }
 
   public static Messages.ComponentInformationProto
   marshall(ComponentInformation info) {
diff --git a/slider-core/src/main/java/org/apache/slider/api/proto/SliderClusterAPI.java b/slider-core/src/main/java/org/apache/slider/api/proto/SliderClusterAPI.java
index 0d473fc..3441625 100644
--- a/slider-core/src/main/java/org/apache/slider/api/proto/SliderClusterAPI.java
+++ b/slider-core/src/main/java/org/apache/slider/api/proto/SliderClusterAPI.java
@@ -274,12 +274,12 @@
           com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.WrappedJsonProto> done);
 
       /**
-       * <code>rpc signCertificate(.org.apache.slider.api.SignCertificateRequestProto) returns (.org.apache.slider.api.SignCertificateResponseProto);</code>
+       * <code>rpc getClientCertificateStore(.org.apache.slider.api.GetCertificateStoreRequestProto) returns (.org.apache.slider.api.GetCertificateStoreResponseProto);</code>
        */
-      public abstract void signCertificate(
+      public abstract void getClientCertificateStore(
           com.google.protobuf.RpcController controller,
-          org.apache.slider.api.proto.Messages.SignCertificateRequestProto request,
-          com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.SignCertificateResponseProto> done);
+          org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto request,
+          com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto> done);
 
     }
 
@@ -463,11 +463,11 @@
         }
 
         @java.lang.Override
-        public  void signCertificate(
+        public  void getClientCertificateStore(
             com.google.protobuf.RpcController controller,
-            org.apache.slider.api.proto.Messages.SignCertificateRequestProto request,
-            com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.SignCertificateResponseProto> done) {
-          impl.signCertificate(controller, request, done);
+            org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto request,
+            com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto> done) {
+          impl.getClientCertificateStore(controller, request, done);
         }
 
       };
@@ -537,7 +537,7 @@
             case 21:
               return impl.getLiveResources(controller, (org.apache.slider.api.proto.Messages.EmptyPayloadProto)request);
             case 22:
-              return impl.signCertificate(controller, (org.apache.slider.api.proto.Messages.SignCertificateRequestProto)request);
+              return impl.getClientCertificateStore(controller, (org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto)request);
             default:
               throw new java.lang.AssertionError("Can't get here.");
           }
@@ -597,7 +597,7 @@
             case 21:
               return org.apache.slider.api.proto.Messages.EmptyPayloadProto.getDefaultInstance();
             case 22:
-              return org.apache.slider.api.proto.Messages.SignCertificateRequestProto.getDefaultInstance();
+              return org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.getDefaultInstance();
             default:
               throw new java.lang.AssertionError("Can't get here.");
           }
@@ -657,7 +657,7 @@
             case 21:
               return org.apache.slider.api.proto.Messages.WrappedJsonProto.getDefaultInstance();
             case 22:
-              return org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance();
+              return org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance();
             default:
               throw new java.lang.AssertionError("Can't get here.");
           }
@@ -919,12 +919,12 @@
         com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.WrappedJsonProto> done);
 
     /**
-     * <code>rpc signCertificate(.org.apache.slider.api.SignCertificateRequestProto) returns (.org.apache.slider.api.SignCertificateResponseProto);</code>
+     * <code>rpc getClientCertificateStore(.org.apache.slider.api.GetCertificateStoreRequestProto) returns (.org.apache.slider.api.GetCertificateStoreResponseProto);</code>
      */
-    public abstract void signCertificate(
+    public abstract void getClientCertificateStore(
         com.google.protobuf.RpcController controller,
-        org.apache.slider.api.proto.Messages.SignCertificateRequestProto request,
-        com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.SignCertificateResponseProto> done);
+        org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto request,
+        com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto> done);
 
     public static final
         com.google.protobuf.Descriptors.ServiceDescriptor
@@ -1059,8 +1059,8 @@
               done));
           return;
         case 22:
-          this.signCertificate(controller, (org.apache.slider.api.proto.Messages.SignCertificateRequestProto)request,
-            com.google.protobuf.RpcUtil.<org.apache.slider.api.proto.Messages.SignCertificateResponseProto>specializeCallback(
+          this.getClientCertificateStore(controller, (org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto)request,
+            com.google.protobuf.RpcUtil.<org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto>specializeCallback(
               done));
           return;
         default:
@@ -1122,7 +1122,7 @@
         case 21:
           return org.apache.slider.api.proto.Messages.EmptyPayloadProto.getDefaultInstance();
         case 22:
-          return org.apache.slider.api.proto.Messages.SignCertificateRequestProto.getDefaultInstance();
+          return org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto.getDefaultInstance();
         default:
           throw new java.lang.AssertionError("Can't get here.");
       }
@@ -1182,7 +1182,7 @@
         case 21:
           return org.apache.slider.api.proto.Messages.WrappedJsonProto.getDefaultInstance();
         case 22:
-          return org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance();
+          return org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance();
         default:
           throw new java.lang.AssertionError("Can't get here.");
       }
@@ -1534,19 +1534,19 @@
             org.apache.slider.api.proto.Messages.WrappedJsonProto.getDefaultInstance()));
       }
 
-      public  void signCertificate(
+      public  void getClientCertificateStore(
           com.google.protobuf.RpcController controller,
-          org.apache.slider.api.proto.Messages.SignCertificateRequestProto request,
-          com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.SignCertificateResponseProto> done) {
+          org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto request,
+          com.google.protobuf.RpcCallback<org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto> done) {
         channel.callMethod(
           getDescriptor().getMethods().get(22),
           controller,
           request,
-          org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance(),
+          org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance(),
           com.google.protobuf.RpcUtil.generalizeCallback(
             done,
-            org.apache.slider.api.proto.Messages.SignCertificateResponseProto.class,
-            org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance()));
+            org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.class,
+            org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance()));
       }
     }
 
@@ -1666,9 +1666,9 @@
           org.apache.slider.api.proto.Messages.EmptyPayloadProto request)
           throws com.google.protobuf.ServiceException;
 
-      public org.apache.slider.api.proto.Messages.SignCertificateResponseProto signCertificate(
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto getClientCertificateStore(
           com.google.protobuf.RpcController controller,
-          org.apache.slider.api.proto.Messages.SignCertificateRequestProto request)
+          org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto request)
           throws com.google.protobuf.ServiceException;
     }
 
@@ -1943,15 +1943,15 @@
       }
 
 
-      public org.apache.slider.api.proto.Messages.SignCertificateResponseProto signCertificate(
+      public org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto getClientCertificateStore(
           com.google.protobuf.RpcController controller,
-          org.apache.slider.api.proto.Messages.SignCertificateRequestProto request)
+          org.apache.slider.api.proto.Messages.GetCertificateStoreRequestProto request)
           throws com.google.protobuf.ServiceException {
-        return (org.apache.slider.api.proto.Messages.SignCertificateResponseProto) channel.callBlockingMethod(
+        return (org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto) channel.callBlockingMethod(
           getDescriptor().getMethods().get(22),
           controller,
           request,
-          org.apache.slider.api.proto.Messages.SignCertificateResponseProto.getDefaultInstance());
+          org.apache.slider.api.proto.Messages.GetCertificateStoreResponseProto.getDefaultInstance());
       }
 
     }
@@ -1970,7 +1970,7 @@
     java.lang.String[] descriptorData = {
       "\n\033SliderClusterProtocol.proto\022\025org.apach" +
       "e.slider.api\032\033SliderClusterMessages.prot" +
-      "o2\260\025\n\027SliderClusterProtocolPB\022n\n\013stopClu" +
+      "o2\303\025\n\027SliderClusterProtocolPB\022n\n\013stopClu" +
       "ster\022..org.apache.slider.api.StopCluster" +
       "RequestProto\032/.org.apache.slider.api.Sto" +
       "pClusterResponseProto\022n\n\013flexCluster\022..o" +
@@ -2035,11 +2035,12 @@
       "pache.slider.api.WrappedJsonProto\022e\n\020get" +
       "LiveResources\022(.org.apache.slider.api.Em" +
       "ptyPayloadProto\032\'.org.apache.slider.api." +
-      "WrappedJsonProto\022z\n\017signCertificate\0222.or" +
-      "g.apache.slider.api.SignCertificateReque" +
-      "stProto\0323.org.apache.slider.api.SignCert",
-      "ificateResponseProtoB5\n\033org.apache.slide" +
-      "r.api.protoB\020SliderClusterAPI\210\001\001\240\001\001"
+      "WrappedJsonProto\022\214\001\n\031getClientCertificat" +
+      "eStore\0226.org.apache.slider.api.GetCertif" +
+      "icateStoreRequestProto\0327.org.apache.slid",
+      "er.api.GetCertificateStoreResponseProtoB" +
+      "5\n\033org.apache.slider.api.protoB\020SliderCl" +
+      "usterAPI\210\001\001\240\001\001"
     };
     com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner assigner =
       new com.google.protobuf.Descriptors.FileDescriptor.InternalDescriptorAssigner() {
diff --git a/slider-core/src/main/java/org/apache/slider/client/SliderClient.java b/slider-core/src/main/java/org/apache/slider/client/SliderClient.java
index dfa7cd6..8c1a9b2 100644
--- a/slider-core/src/main/java/org/apache/slider/client/SliderClient.java
+++ b/slider-core/src/main/java/org/apache/slider/client/SliderClient.java
@@ -21,6 +21,7 @@
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Preconditions;
 
+import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang.StringUtils;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.FileStatus;
@@ -154,6 +155,7 @@
 import org.apache.slider.providers.slideram.SliderAMClientProvider;
 import org.apache.slider.server.appmaster.SliderAppMaster;
 import org.apache.slider.server.appmaster.rpc.RpcBinder;
+import org.apache.slider.server.services.security.SecurityStore;
 import org.apache.slider.server.services.utility.AbstractSliderLaunchedService;
 import org.apache.zookeeper.CreateMode;
 import org.apache.zookeeper.KeeperException;
@@ -172,8 +174,10 @@
 import java.io.PrintStream;
 import java.io.StringWriter;
 import java.io.Writer;
+import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.URISyntaxException;
+import java.net.UnknownHostException;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
 import java.util.ArrayList;
@@ -916,15 +920,85 @@
 
   @Override
   public int actionClient(ActionClientArgs clientInfo) throws
-      SliderException,
+      YarnException,
       IOException {
-
-    if(!clientInfo.install) {
+    if (clientInfo.install) {
+      return doClientInstall(clientInfo);
+    } else if (clientInfo.getCertStore) {
+      return doCertificateStoreRetrieval(clientInfo);
+    } else {
       throw new BadCommandArgumentsException(
-          "Only install command is supported for the client.\n"
+          "Only install, keystore, and truststore commands are supported for the client.\n"
+          + CommonArgs.usage(serviceArgs, ACTION_CLIENT));
+
+    }
+  }
+
+  private int doCertificateStoreRetrieval(ActionClientArgs clientInfo)
+      throws YarnException, IOException {
+    if (clientInfo.keystore != null && clientInfo.truststore != null) {
+      throw new BadCommandArgumentsException(
+          "Only one of either keystore or truststore can be retrieved at one time.  "
+          + "Retrieval of both should be done separately\n"
           + CommonArgs.usage(serviceArgs, ACTION_CLIENT));
     }
 
+    if (clientInfo.name == null) {
+      throw new BadCommandArgumentsException("No applicaiton name specified\n"
+                                             + CommonArgs.usage(serviceArgs,
+                                                                ACTION_CLIENT));
+    }
+
+    File storeFile = null;
+    SecurityStore.StoreType type;
+    if (clientInfo.keystore != null) {
+      storeFile = clientInfo.keystore;
+      type = SecurityStore.StoreType.keystore;
+    } else {
+      storeFile = clientInfo.truststore;
+      type = SecurityStore.StoreType.truststore;
+    }
+
+    if (storeFile.exists()) {
+      throw new BadCommandArgumentsException("File %s already exists.  "
+                                             + "Please remove that file or select a different file name.",
+                                             storeFile.getAbsolutePath());
+    }
+    String hostname = null;
+    if (type == SecurityStore.StoreType.keystore) {
+      hostname = clientInfo.hostname;
+      if (hostname == null) {
+        hostname = InetAddress.getLocalHost().getCanonicalHostName();
+        log.info("No hostname specified via command line. Using {}", hostname);
+      }
+    }
+
+    String password = clientInfo.password;
+    if (password == null) {
+      // get a password
+      BufferedReader br = new BufferedReader(new InputStreamReader(System.in));
+      try {
+        password = String.valueOf(readPassword(type.name(), br));
+      } finally {
+        if (br != null) {
+          br.close();
+        }
+      }
+    }
+
+    byte[]
+        keystore =
+        createClusterOperations(clientInfo.name).getClientCertificateStore(
+            hostname, "client", password, type.name());
+    // persist to file
+    IOUtils.write(keystore, new FileOutputStream(storeFile));
+
+    return EXIT_SUCCESS;
+  }
+
+  private int doClientInstall(ActionClientArgs clientInfo)
+      throws IOException, SliderException {
+
     if (clientInfo.installLocation == null) {
       throw new BadCommandArgumentsException(
           "A valid install location must be provided for the client.\n"
@@ -963,7 +1037,8 @@
     }
 
     // Only INSTALL is supported
-    AbstractClientProvider provider = createClientProvider(SliderProviderFactory.DEFAULT_CLUSTER_TYPE);
+    AbstractClientProvider
+        provider = createClientProvider(SliderProviderFactory.DEFAULT_CLUSTER_TYPE);
     provider.processClientOperation(sliderFileSystem,
                                     "INSTALL",
                                     clientInfo.installLocation,
diff --git a/slider-core/src/main/java/org/apache/slider/client/SliderClientAPI.java b/slider-core/src/main/java/org/apache/slider/client/SliderClientAPI.java
index efb1f7f..c7756da 100644
--- a/slider-core/src/main/java/org/apache/slider/client/SliderClientAPI.java
+++ b/slider-core/src/main/java/org/apache/slider/client/SliderClientAPI.java
@@ -134,7 +134,7 @@
    * @throws IOException problems related to package and destination folders
    */
   int actionClient(ActionClientArgs clientInfo)
-      throws IOException, SliderException;
+      throws IOException, YarnException;
 
   /**
    * Managing slider application package
diff --git a/slider-core/src/main/java/org/apache/slider/client/ipc/SliderClusterOperations.java b/slider-core/src/main/java/org/apache/slider/client/ipc/SliderClusterOperations.java
index dae93b3..ae95b17 100644
--- a/slider-core/src/main/java/org/apache/slider/client/ipc/SliderClusterOperations.java
+++ b/slider-core/src/main/java/org/apache/slider/client/ipc/SliderClusterOperations.java
@@ -39,6 +39,7 @@
 import org.apache.slider.core.exceptions.SliderException;
 import org.apache.slider.core.exceptions.WaitTimeoutException;
 import org.apache.slider.core.persist.ConfTreeSerDeser;
+import org.apache.slider.server.services.security.SecurityStore;
 import org.apache.slider.server.services.security.SignCertResponse;
 import org.codehaus.jackson.JsonParseException;
 import org.slf4j.Logger;
@@ -512,18 +513,22 @@
     return unmarshall(proto);
   }
 
-  public SignCertResponse signCertificate(String hostname, String request,
-      String passphrase) throws IOException {
-    Messages.SignCertificateRequestProto requestProto =
-        Messages.SignCertificateRequestProto.newBuilder()
-                                            .setHostname(hostname)
-                                            .setCertRequest(request)
-                                            .setPassPhrase(passphrase)
-                                            .build();
-    Messages.SignCertificateResponseProto response =
-        appMaster.signCertificate(requestProto);
-    // JON
-    return new SignCertResponse();
+  public byte[] getClientCertificateStore(String hostname, String clientId,
+      String password, String type) throws IOException {
+    Messages.GetCertificateStoreRequestProto.Builder
+        builder = Messages.GetCertificateStoreRequestProto.newBuilder();
+    if (hostname != null) {
+      builder.setHostname(hostname);
+    }
+    Messages.GetCertificateStoreRequestProto requestProto =
+        builder.setRequesterId(clientId)
+               .setPassword(password)
+               .setType(type)
+               .build();
+    Messages.GetCertificateStoreResponseProto response =
+        appMaster.getClientCertificateStore(requestProto);
+
+    return unmarshall(response);
   }
 
 }
diff --git a/slider-core/src/main/java/org/apache/slider/common/params/ActionClientArgs.java b/slider-core/src/main/java/org/apache/slider/common/params/ActionClientArgs.java
index 4154c9f..c7f8c2e 100644
--- a/slider-core/src/main/java/org/apache/slider/common/params/ActionClientArgs.java
+++ b/slider-core/src/main/java/org/apache/slider/common/params/ActionClientArgs.java
@@ -37,6 +37,30 @@
       description = "Install client")
   public boolean install;
 
+  @Parameter(names = {ARG_GETCERTSTORE},
+      description = "Get a certificate store")
+  public boolean getCertStore;
+
+  @Parameter(names = {ARG_KEYSTORE},
+      description = "Retrieve keystore to specified location")
+  public File keystore;
+
+  @Parameter(names = {ARG_TRUSTSTORE},
+      description = "Retrieve truststore to specified location")
+  public File truststore;
+
+  @Parameter(names = {ARG_HOSTNAME},
+      description = "(Optional) Specify the hostname to use for generation of keystore certificate")
+  public String hostname;
+
+  @Parameter(names = {ARG_NAME},
+      description = "The name of the application")
+  public String name;
+
+  @Parameter(names = {ARG_PASSWORD},
+      description = "The certificate store password")
+  public String password;
+
   @Parameter(names = {ARG_PACKAGE},
       description = "Path to app package")
   public String packageURI;
diff --git a/slider-core/src/main/java/org/apache/slider/common/params/Arguments.java b/slider-core/src/main/java/org/apache/slider/common/params/Arguments.java
index b8414e3..14be81e 100644
--- a/slider-core/src/main/java/org/apache/slider/common/params/Arguments.java
+++ b/slider-core/src/main/java/org/apache/slider/common/params/Arguments.java
@@ -52,14 +52,17 @@
   String ARG_FOLDER = "--folder";
   String ARG_FORCE = "--force";
   String ARG_FORMAT = "--format";
+  String ARG_GETCERTSTORE = "--getcertstore";
   String ARG_GETCONF = "--getconf";
   String ARG_GETEXP = "--getexp";
   String ARG_GETFILES = "--getfiles";
   String ARG_HELP = "--help";
+  String ARG_HOSTNAME = "--hostname";
   String ARG_ID = "--id";
   String ARG_IMAGE = "--image";
   String ARG_INTERNAL = "--internal";
   String ARG_KEYTAB = "--keytab";
+  String ARG_KEYSTORE = "--keystore";
   String ARG_KEYTABINSTALL = "--install";
   String ARG_KEYTABDELETE = "--delete";
   String ARG_KEYTABLIST = "--list";
@@ -80,6 +83,7 @@
   String ARG_OUTPUT_SHORT = "-o";
   String ARG_OVERWRITE = "--overwrite";
   String ARG_PACKAGE = "--package";
+  String ARG_PASSWORD = "--password";
   String ARG_PATH = "--path";
   String ARG_PKGDELETE = "--delete";
   String ARG_INSTALL = "--install";
@@ -99,6 +103,7 @@
   String ARG_STATE = "--state";
   String ARG_SYSPROP = "-S";
   String ARG_TEMPLATE = "--template";
+  String ARG_TRUSTSTORE = "--truststore";
   String ARG_USER = "--user";
   String ARG_VERBOSE = "--verbose";
   String ARG_WAIT = "--wait";
diff --git a/slider-core/src/main/java/org/apache/slider/common/params/SliderActions.java b/slider-core/src/main/java/org/apache/slider/common/params/SliderActions.java
index 2599927..f7b97d5 100644
--- a/slider-core/src/main/java/org/apache/slider/common/params/SliderActions.java
+++ b/slider-core/src/main/java/org/apache/slider/common/params/SliderActions.java
@@ -88,10 +88,10 @@
                         "Print the Slider version information";
   String DESCRIBE_ACTION_INSTALL_PACKAGE = "Install the application package in the home directory under sub-folder packages";
   String DESCRIBE_ACTION_PACKAGE = "Install/list/delete application packages and list app instances that use this package";
-  String DESCRIBE_ACTION_CLIENT = "Install the application client in the specified directory";
+  String DESCRIBE_ACTION_CLIENT = "Install the application client in the specified directory or obtain a client keystore or truststore";
   String DESCRIBE_ACTION_INSTALL_KEYTAB = "Install the Kerberos keytab file in the sub-folder 'keytabs' of the user's Slider base directory";
   String DESCRIBE_ACTION_KEYTAB = "Manage a Kerberos keytab file (install, delete, list) in the sub-folder 'keytabs' of the user's Slider base directory";
   String DESCRIBE_ACTION_DIAGNOSTIC = "Diagnose the configuration of the running slider application and slider client";
-  
+
 }
 
diff --git a/slider-core/src/main/java/org/apache/slider/server/appmaster/SliderAppMaster.java b/slider-core/src/main/java/org/apache/slider/server/appmaster/SliderAppMaster.java
index 35ab1d4..34bf20c 100644
--- a/slider-core/src/main/java/org/apache/slider/server/appmaster/SliderAppMaster.java
+++ b/slider-core/src/main/java/org/apache/slider/server/appmaster/SliderAppMaster.java
@@ -720,7 +720,9 @@
           getConfig().set(KEY_PROTOCOL_ACL, "*");
         }
       }
-      
+
+      certificateManager = new CertificateManager();
+
       //bring up the Slider RPC service
       buildPortScanner(instanceDefinition);
       startSliderRPCServer(instanceDefinition);
@@ -744,7 +746,6 @@
       providerRoles.addAll(SliderAMClientProvider.ROLES);
 
       // Start up the WebApp and track the URL for it
-      certificateManager = new CertificateManager();
       MapOperations component = instanceDefinition.getAppConfOperations()
           .getComponent(SliderKeys.COMPONENT_AM);
       certificateManager.initialize(component, appMasterHostname,
@@ -1502,6 +1503,7 @@
 
     sliderIPCService = new SliderIPCService(
         this,
+        certificateManager,
         stateForProviders,
         actionQueues,
         metricsAndMonitoring,
diff --git a/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolPBImpl.java b/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolPBImpl.java
index ca0d21e..14b2bef 100644
--- a/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolPBImpl.java
+++ b/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolPBImpl.java
@@ -282,12 +282,13 @@
     }
   }
 
-
   @Override
-  public Messages.SignCertificateResponseProto signCertificate(RpcController controller,
-      Messages.SignCertificateRequestProto request) throws ServiceException {
+  public Messages.GetCertificateStoreResponseProto getClientCertificateStore(
+      RpcController controller,
+      Messages.GetCertificateStoreRequestProto request)
+      throws ServiceException {
     try {
-      return real.signCertificate(request);
+      return real.getClientCertificateStore(request);
     } catch (Exception e) {
       throw wrap(e);
     }
diff --git a/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolProxy.java b/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolProxy.java
index 901e4ad..ad4cca4 100644
--- a/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolProxy.java
+++ b/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderClusterProtocolProxy.java
@@ -316,10 +316,10 @@
   }
 
   @Override
-  public Messages.SignCertificateResponseProto signCertificate(Messages.SignCertificateRequestProto request) throws
+  public Messages.GetCertificateStoreResponseProto getClientCertificateStore(Messages.GetCertificateStoreRequestProto request) throws
       IOException {
     try {
-      return endpoint.signCertificate(NULL_CONTROLLER, request);
+      return endpoint.getClientCertificateStore(NULL_CONTROLLER, request);
     } catch (ServiceException e) {
       throw convert(e);
     }
diff --git a/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderIPCService.java b/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderIPCService.java
index 1cc44bc..a924940 100644
--- a/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderIPCService.java
+++ b/slider-core/src/main/java/org/apache/slider/server/appmaster/rpc/SliderIPCService.java
@@ -34,6 +34,7 @@
 import org.apache.slider.core.conf.ConfTree;
 import org.apache.slider.core.exceptions.NoSuchNodeException;
 import org.apache.slider.core.exceptions.ServiceNotReadyException;
+import org.apache.slider.core.exceptions.SliderException;
 import org.apache.slider.core.main.LauncherExitCodes;
 import org.apache.slider.core.persist.AggregateConfSerDeser;
 import org.apache.slider.core.persist.ConfTreeSerDeser;
@@ -48,6 +49,9 @@
 import org.apache.slider.server.appmaster.state.RoleInstance;
 import org.apache.slider.server.appmaster.state.StateAccessForProviders;
 import org.apache.slider.server.appmaster.web.rest.application.resources.ContentCache;
+import org.apache.slider.server.services.security.CertificateManager;
+import org.apache.slider.server.services.security.KeystoreGenerator;
+import org.apache.slider.server.services.security.SecurityStore;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -84,6 +88,7 @@
   private final MetricsAndMonitoring metricsAndMonitoring;
   private final AppMasterActionOperations amOperations;
   private final ContentCache cache;
+  private final CertificateManager certificateManager;
 
   /**
    * This is the prefix used for metrics
@@ -100,6 +105,7 @@
    * @param cache
    */
   public SliderIPCService(AppMasterActionOperations amOperations,
+      CertificateManager certificateManager,
       StateAccessForProviders state,
       QueueAccess actionQueues,
       MetricsAndMonitoring metricsAndMonitoring, ContentCache cache) {
@@ -115,6 +121,7 @@
     this.metricsAndMonitoring = metricsAndMonitoring;
     this.amOperations = amOperations;
     this.cache = cache;
+    this.certificateManager = certificateManager;
   }
 
   @Override   //SliderClusterProtocol
@@ -463,8 +470,33 @@
   }
 
   @Override
-  public Messages.SignCertificateResponseProto signCertificate(Messages.SignCertificateRequestProto request) throws
+  public Messages.GetCertificateStoreResponseProto getClientCertificateStore(Messages.GetCertificateStoreRequestProto request) throws
       IOException {
-    return null;
+    String hostname = request.getHostname();
+    String clientId = request.getRequesterId();
+    String password = request.getPassword();
+    String type = request.getType();
+
+    SecurityStore store = null;
+    try {
+      if ( SecurityStore.StoreType.keystore.equals(
+          SecurityStore.StoreType.valueOf(type))) {
+        store = certificateManager.generateContainerKeystore(hostname,
+                                                             clientId,
+                                                             null,
+                                                             password);
+      } else if (SecurityStore.StoreType.truststore.equals(
+          SecurityStore.StoreType.valueOf(type))) {
+        store = certificateManager.generateContainerTruststore(clientId,
+                                                               null,
+                                                               password);
+
+      } else {
+        throw new IOException("Illegal store type");
+      }
+    } catch (SliderException e) {
+      throw new IOException(e);
+    }
+    return marshall(store);
   }
 }
diff --git a/slider-core/src/main/java/org/apache/slider/server/services/security/CertificateManager.java b/slider-core/src/main/java/org/apache/slider/server/services/security/CertificateManager.java
index 8d8dfec..2cdcbec 100644
--- a/slider-core/src/main/java/org/apache/slider/server/services/security/CertificateManager.java
+++ b/slider-core/src/main/java/org/apache/slider/server/services/security/CertificateManager.java
@@ -203,18 +203,18 @@
   }
 
   public synchronized void generateContainerCertificate(String hostname,
-                                                        String containerId) {
-    LOG.info("Generation of agent certificate for {}", hostname);
+                                                        String identifier) {
+    LOG.info("Generation of certificate for {}", hostname);
 
     String srvrKstrDir = SecurityUtils.getSecurityDir();
-    Object[] scriptArgs = {srvrKstrDir, getSubjectDN(hostname, containerId,
-        this.applicationName), containerId};
+    Object[] scriptArgs = {srvrKstrDir, getSubjectDN(hostname, identifier,
+        this.applicationName), identifier};
 
     try {
       String command = MessageFormat.format(GEN_AGENT_KEY, scriptArgs);
       runCommand(command);
 
-      signAgentCertificate(containerId);
+      signAgentCertificate(identifier);
 
     } catch (SliderException e) {
       LOG.error("Error generating the agent certificate", e);
@@ -222,21 +222,21 @@
   }
 
   public synchronized SecurityStore generateContainerKeystore(String hostname,
-                                                              String containerId,
+                                                              String requesterId,
                                                               String role,
                                                               String keystorePass)
       throws SliderException {
     LOG.info("Generation of container keystore for container {} on {}",
-             containerId, hostname);
+             requesterId, hostname);
 
-    generateContainerCertificate(hostname, containerId);
+    generateContainerCertificate(hostname, requesterId);
 
     // come up with correct args to invoke keystore command
     String srvrCrtPass = SecurityUtils.getKeystorePass();
     String srvrKstrDir = SecurityUtils.getSecurityDir();
-    String containerCrtName = containerId + ".crt";
-    String containerKeyName = containerId + ".key";
-    String kstrName = getKeystoreFileName(containerId, role);
+    String containerCrtName = requesterId + ".crt";
+    String containerKeyName = requesterId + ".key";
+    String kstrName = getKeystoreFileName(requesterId, role);
 
     Object[] scriptArgs = {srvrCrtPass, keystorePass, srvrKstrDir,
         containerKeyName, containerCrtName, kstrName};
@@ -250,7 +250,8 @@
 
   private static String getKeystoreFileName(String containerId,
                                             String role) {
-    return String.format("keystore-%s-%s.p12", containerId, role);
+    return String.format("keystore-%s-%s.p12", containerId,
+                         role != null ? role : "");
   }
 
   private void generateAMKeystore(String hostname, String containerId)
@@ -306,7 +307,8 @@
   }
 
   private static String getTruststoreFileName(String role, String containerId) {
-    return String.format("truststore-%s-%s.p12", containerId, role);
+    return String.format("truststore-%s-%s.p12", containerId,
+                         role != null ? role : "");
   }
 
   /**
diff --git a/slider-core/src/main/proto/SliderClusterMessages.proto b/slider-core/src/main/proto/SliderClusterMessages.proto
index 0b95de9..9f8f20f 100644
--- a/slider-core/src/main/proto/SliderClusterMessages.proto
+++ b/slider-core/src/main/proto/SliderClusterMessages.proto
@@ -319,14 +319,13 @@
   required string json = 1;
 }
 
-message SignCertificateRequestProto {
-  required string hostname = 1;
-  required string certRequest = 2;
-  required string passPhrase = 3;
+message GetCertificateStoreRequestProto {
+  optional string hostname = 1;
+  required string requesterId = 2;
+  required string password = 3;
+  required string type = 4;
 }
 
-message SignCertificateResponseProto {
-  required string result = 1;
-  required string signedCertificate = 2;
-  required string signingMessage = 3;
+message GetCertificateStoreResponseProto {
+  required bytes store = 1;
 }
\ No newline at end of file
diff --git a/slider-core/src/main/proto/SliderClusterProtocol.proto b/slider-core/src/main/proto/SliderClusterProtocol.proto
index 974bcd5..d2ba723 100644
--- a/slider-core/src/main/proto/SliderClusterProtocol.proto
+++ b/slider-core/src/main/proto/SliderClusterProtocol.proto
@@ -164,8 +164,8 @@
   rpc getLiveResources(EmptyPayloadProto) 
     returns(WrappedJsonProto);
 
-  rpc signCertificate(SignCertificateRequestProto) 
-    returns(SignCertificateResponseProto);
+  rpc getClientCertificateStore(GetCertificateStoreRequestProto)
+    returns(GetCertificateStoreResponseProto);
 
   
   
diff --git a/slider-core/src/test/java/org/apache/slider/providers/agent/TestAgentClientProvider2.java b/slider-core/src/test/java/org/apache/slider/providers/agent/TestAgentClientProvider2.java
index 1e4d834..6f637d8 100644
--- a/slider-core/src/test/java/org/apache/slider/providers/agent/TestAgentClientProvider2.java
+++ b/slider-core/src/test/java/org/apache/slider/providers/agent/TestAgentClientProvider2.java
@@ -204,13 +204,6 @@
     SliderClient client = new SliderClient();
     client.bindArgs(new Configuration(), "client", "--dest", "a_random_path/none", "--package", "a_random_pkg.zip");
     ActionClientArgs args = new ActionClientArgs();
-    args.install = false;
-    try {
-      client.actionClient(args);
-    }catch(BadCommandArgumentsException e) {
-      log.info(e.getMessage());
-      Assert.assertTrue(e.getMessage().contains("Only install command is supported for the client"));
-    }
 
     args.install = true;
     try {
diff --git a/slider-funtest/src/test/groovy/org/apache/slider/funtest/lifecycle/AMClientCertStoreRetrievalIT.groovy b/slider-funtest/src/test/groovy/org/apache/slider/funtest/lifecycle/AMClientCertStoreRetrievalIT.groovy
new file mode 100644
index 0000000..ab632d2
--- /dev/null
+++ b/slider-funtest/src/test/groovy/org/apache/slider/funtest/lifecycle/AMClientCertStoreRetrievalIT.groovy
@@ -0,0 +1,174 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.slider.funtest.lifecycle
+
+import com.jcraft.jsch.Session
+import groovy.transform.CompileStatic
+import groovy.util.logging.Slf4j
+import org.apache.bigtop.itest.shell.Shell
+import org.apache.chaos.remote.RemoteServer
+import org.apache.chaos.remote.SshCommands
+import org.apache.hadoop.security.UserGroupInformation
+import org.apache.hadoop.yarn.api.records.YarnApplicationState
+import org.apache.hadoop.yarn.conf.YarnConfiguration
+import org.apache.slider.common.SliderExitCodes
+import org.apache.slider.common.params.Arguments
+import org.apache.slider.common.params.SliderActions
+import org.apache.slider.funtest.framework.AgentCommandTestBase
+import org.apache.slider.funtest.framework.FuntestProperties
+import org.apache.slider.funtest.framework.SliderShell
+import org.junit.After
+import org.junit.Assert
+import org.junit.BeforeClass
+import org.junit.Test
+
+import javax.net.ssl.TrustManager
+import javax.net.ssl.TrustManagerFactory
+import javax.net.ssl.X509TrustManager
+import java.security.KeyStore
+import java.security.KeyStoreException
+import java.security.NoSuchAlgorithmException
+import java.security.Principal
+import java.security.cert.Certificate
+import java.security.cert.CertificateException
+import java.security.cert.X509Certificate
+
+@CompileStatic
+@Slf4j
+public class AMClientCertStoreRetrievalIT extends AgentCommandTestBase
+implements FuntestProperties, Arguments, SliderExitCodes, SliderActions {
+
+  private static String COMMAND_LOGGER = "COMMAND_LOGGER"
+  private static String APPLICATION_NAME = "certs-retrieval"
+
+
+  @After
+  public void destroyCluster() {
+    cleanup(APPLICATION_NAME)
+  }
+
+  @Test
+  public void testRetrieveCertificateStores() throws Throwable {
+    cleanup(APPLICATION_NAME)
+    File launchReportFile = createTempJsonFile();
+
+    SliderShell shell = createTemplatedSliderApplication(
+        APPLICATION_NAME, APP_TEMPLATE, APP_RESOURCE,
+        [],
+        launchReportFile)
+    logShell(shell)
+
+    def appId = ensureYarnApplicationIsUp(launchReportFile)
+    expectContainerRequestedCountReached(APPLICATION_NAME, COMMAND_LOGGER, 1,
+        CONTAINER_LAUNCH_TIMEOUT)
+
+    def cd = assertContainersLive(APPLICATION_NAME, COMMAND_LOGGER, 1)
+    def loggerInstances = cd.instances[COMMAND_LOGGER]
+    assert loggerInstances.size() == 1
+
+    def loggerStats = cd.statistics[COMMAND_LOGGER]
+
+    assert loggerStats["containers.requested"] == 1
+    assert loggerStats["containers.live"] == 1
+
+
+    String filename = "/tmp/test.keystore"
+    String password = "welcome";
+
+    // ensure file doesn't exist
+    new File(filename).delete();
+
+    shell = slider(EXIT_SUCCESS,
+                   [
+                       ACTION_CLIENT,
+                       ARG_GETCERTSTORE,
+                       ARG_KEYSTORE, filename,
+                       ARG_NAME, APPLICATION_NAME,
+                       ARG_PASSWORD, password
+                   ])
+
+    assert new File(filename).exists()
+
+    FileInputStream is = new FileInputStream(filename);
+    KeyStore keystore = KeyStore.getInstance("pkcs12");
+    keystore.load(is, password.toCharArray());
+
+    Certificate certificate = keystore.getCertificate(
+        keystore.aliases().nextElement());
+    Assert.assertNotNull(certificate);
+
+    String hostname = InetAddress.localHost.canonicalHostName;
+
+    if (certificate instanceof X509Certificate) {
+      X509Certificate x509cert = (X509Certificate) certificate;
+
+      // Get subject
+      Principal principal = x509cert.getSubjectDN();
+      String subjectDn = principal.getName();
+      Assert.assertEquals("wrong DN",
+                          "CN=" + hostname + ", OU=" + APPLICATION_NAME + ", OU=client",
+                          subjectDn);
+
+    }
+
+    filename = "/tmp/test.truststore"
+    // ensure file doesn't exist
+    new File(filename).delete();
+
+    shell = slider(EXIT_SUCCESS,
+                   [
+                       ACTION_CLIENT,
+                       ARG_GETCERTSTORE,
+                       ARG_TRUSTSTORE, filename,
+                       ARG_NAME, APPLICATION_NAME,
+                       ARG_PASSWORD, password
+                   ])
+
+    assert new File(filename).exists()
+
+    is = new FileInputStream(filename);
+    KeyStore truststore = KeyStore.getInstance("pkcs12");
+    truststore.load(is, password.toCharArray());
+
+    validateTruststore(keystore, truststore);
+
+  }
+
+  private void validateTruststore(KeyStore keystore, KeyStore truststore)
+      throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {
+    // obtain server cert
+    Certificate certificate = keystore.getCertificate(
+        keystore.aliases().nextElement());
+    Assert.assertNotNull(certificate);
+
+    // validate keystore cert using trust store
+      TrustManagerFactory trustManagerFactory =
+          TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+      trustManagerFactory.init(truststore);
+
+      for (TrustManager trustManager: trustManagerFactory.getTrustManagers()) {
+        if (trustManager instanceof X509TrustManager) {
+          X509TrustManager x509TrustManager = (X509TrustManager)trustManager;
+          x509TrustManager.checkServerTrusted(
+              [(X509Certificate) certificate] as X509Certificate[],
+              "RSA_EXPORT");
+        }
+      }
+  }
+}