New To SSL

Question

I have a client/server application (Not HTTP) that uses sockets to communicate with each other. Ports are opened and objects are passed from the client to the server and vise versa. I have successfully converted the application to use SSL by following the very simple example in the Java Secure Socket Extension Reference Guide. It appears that the application only works when I create a keystore and truststore; and the client and the server are initiated with the keystore and truststore options (-Djavax.net.ssl.trustStore=, -Djavax.net.ssl.keyStore=, -Djavax.net.ssl.keyStorePassword=).
My question is: Why does the client application need anything? Again, I'm a novice with SSL. I have been doing web development for years and have created public/private keys with a CA signed certificates, and the source (a web-browser) never needs anything. It is passed the public key by Apache to do the decryption. Going back to the Java application... Is this typically how client applications connect to their server counterparts (the client needing the keystore and truststore files)? The reason I ask is that there may be many client application installations, each requiring this file. I can't see this as being reasonable to need these two files for every client installation. Secondly, this application can also run as an applet. Can the applet read these files? If it is packed in a signed JAR file then I guess one could grab the files from the JAR file.
I would think the better approach is the private/public key encryption. The client doesn't need anything that way. If this way can be achieved, does anyone have an example of this (not using HTTP, but SSL sockets passing simple objects back and forth to each other). I want this application to be generic enough that it could be plopped into any company that requires SSL and this thing will work. I'm not sure if that is easily achievable.
Any help appreciated.
Thanks.
-Jim

Answer 1

Question: When I created a self-signed certificate I ran keytool with -genkey. That created a keystore with 1 key entry. Then I exported the generated certificate into a file. Then I ran keytool again with the "-import". That created a truststore.
From what I have seen, my server application requires a keystore and a truststore. I have a CA certificate with an RSA private key . I am trying to create a keystore and a truststore, as above, so that my application can be executed against an authenticated certificate, not the self-signed one. Since I am not generating a certificate, I didn't run the keytool with the "genkey" option (and also obviously didn't export the key from the keystore since I haven't created one yet). Instead, I ran keytool with the "-import", which appears to have created a truststore (no keystore). How do I create a keystore, and where does this private key come into play (or doesn't it)? Nothing asks me for the private key file.
Sorry if I'm asking level 1 questions. I'm trying to figure out how this all works. I really need to take a class to help me understand the components and relationships. I've read some of the docs, but I'm not quite getting it.
-Jim