static void startServer(int port) throws IOException, GeneralSecurityException
{
	java.io.File pemFile=new File("trusted-ca-certs.pem");
	java.io.File p12File=new java.io.File("serverkeystore.p12");
	char[] passphrase="password".toCharArray();

	KeyStore trustStore= de.elbosso.util.security.Utilities.initializeTruststoreWithPemCertificates(pemFile,false);
	KeyStore digIdent= de.elbosso.util.security.Utilities.loadDigitalIdentityFromPKCS12(p12File,passphrase);

	ServerSocketFactory factory = de.elbosso.util.security.Utilities.createSslServerSocketFactory(digIdent,trustStore, passphrase);
	try (SSLServerSocket listener = (SSLServerSocket) factory.createServerSocket(port)) {
		configurePort(listener);
		System.out.println("listening for messages...");
		de.netsysit.util.threads.ThreadManager tm=new de.netsysit.util.threads.ThreadManager("TLS-Chat",-1);
		while(true)
		{
			try
			{
				Socket socket = listener.accept();
				tm.execute(new ServiceThread(socket));
			}
			catch(java.lang.Throwable t)
			{
				t.printStackTrace();
			}
		}
	}
}

<dependency>
	<groupId>de.elbosso</groupId>
	<artifactId>util</artifactId>
	<version>2.1.0-SNAPSHOT</version>
</dependency>

<repository>
	<id>repsy</id>
	<name>EL BOSSOs (https://elbosso.github.io/index.html) Maven Repository on Repsy</name>
	<url>https://repo.repsy.io/mvn/elbosso/default</url>
</repository>

public static java.security.KeyStore createKeystoreWithJDKsTrustedRoots() throws NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException
{
	javax.net.ssl.TrustManagerFactory trustManagerFactory = javax.net.ssl.TrustManagerFactory.getInstance(javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm());
	trustManagerFactory.init((java.security.KeyStore) null);

	java.util.List<javax.net.ssl.TrustManager> trustManagers = java.util.Arrays.asList(trustManagerFactory.getTrustManagers());
	java.util.List<java.security.cert.X509Certificate> certs = trustManagers.stream()
			.filter(javax.net.ssl.X509TrustManager.class::isInstance)
			.map(javax.net.ssl.X509TrustManager.class::cast)
			.map(trustManager -> java.util.Arrays.asList(trustManager.getAcceptedIssuers()))
			.flatMap(java.util.Collection::stream)
			.collect(java.util.stream.Collectors.toList());

	// Create a KeyStore containing our trusted CAs
	java.security.KeyStore keystore = de.elbosso.util.security.Utilities.createKeystoreUseCnAsAlias(certs);
	return keystore;
}

public static java.util.Collection<X509Certificate> loadCertificates(File certificateFile) throws IOException, CertificateException
{
	try (FileInputStream inputStream = new FileInputStream(certificateFile)) {
		return (java.util.Collection<X509Certificate>) CertificateFactory.getInstance("X509").generateCertificates(inputStream);
	}
}

public static void addDefaultTrustedCertificates(KeyStore trustStore) throws GeneralSecurityException, IOException
{
	java.security.KeyStore trusted=de.elbosso.util.security.Utilities.createKeystoreWithJDKsTrustedRoots();
	java.util.Enumeration<java.lang.String> en=trusted.aliases();
	while(en.hasMoreElements())
	{
		java.lang.String alias=en.nextElement();
		java.security.cert.Certificate cert=trusted.getCertificate(alias);
		if((cert!=null)&&(X509Certificate.class.isAssignableFrom(cert.getClass())))
			trustStore.setCertificateEntry(alias, (X509Certificate) cert);
	}
}

public static KeyStore initializeTruststoreWithPemCertificates(File pemFile, boolean addDefaultRootCaCertificates) throws GeneralSecurityException, IOException
{
	// Create a new trust store, use getDefaultType for .jks files or "pkcs12" for .p12 files
	KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
	// Create a new trust store, use getDefaultType for .jks files or "pkcs12" for .p12 files
	trustStore.load(null, null);

	// If you comment out the following, the request will fail
	java.util.Collection<X509Certificate> certificateCollection=loadCertificates(pemFile);
	for(X509Certificate x509Certificate:certificateCollection)
	{
		trustStore.setCertificateEntry(
				x509Certificate.getSubjectX500Principal().getName(X500Principal.RFC2253),
				x509Certificate
		);
	}
	if(addDefaultRootCaCertificates)
		addDefaultTrustedCertificates(trustStore);
	return trustStore;
}

public static KeyStore loadDigitalIdentityFromPKCS12(File p12File, char[] passphrase) throws IOException, CertificateException, NoSuchAlgorithmException, KeyStoreException
{
	// Create a new trust store, use getDefaultType for .jks files or "pkcs12" for .p12 files
	KeyStore digIdent = KeyStore.getInstance("pkcs12");
	FileInputStream fis=new FileInputStream(p12File);
	digIdent.load(fis, passphrase);
	fis.close();
	return digIdent;
}

public static SSLContext createSslContext(KeyStore digIdent, KeyStore trustStore, char[] passphraseForDigIdent) throws KeyManagementException, UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException
{
	TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
	tmf.init(trustStore);
	TrustManager[] trustManagers = tmf.getTrustManagers();

	SSLContext sslContext = SSLContext.getInstance("SSL");

	KeyManagerFactory kmf=KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
	kmf.init(digIdent,passphraseForDigIdent);
	KeyManager[] keyManagers = kmf.getKeyManagers();

	sslContext.init(keyManagers, trustManagers, null);
	return sslContext;
}

public static SSLServerSocketFactory createSslServerSocketFactory(KeyStore digIdent, KeyStore trustStore, char[] passphraseForDigIdent) throws GeneralSecurityException
{
	return createSslContext(digIdent,trustStore,passphraseForDigIdent).getServerSocketFactory();
}
public static SSLSocketFactory createSslSocketFactory(KeyStore digIdent, KeyStore trustStore, char[] passphraseForDigIdent) throws GeneralSecurityException
{
	return createSslContext(digIdent,trustStore,passphraseForDigIdent).getSocketFactory();
}

static void configurePort(SSLServerSocket listener)
{
	listener.setNeedClientAuth(true);
	listener.setEnabledCipherSuites(new String[] {
			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
			//... https://www.java.com/en/configure_crypto.html
			"TLS_RSA_WITH_AES_128_CBC_SHA",
			"TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
	});
	listener.setEnabledProtocols(new String[] { "TLSv1.3", "TLSv1.2" });
}

static void startClient(String host,int port) throws IOException, GeneralSecurityException
{
	java.io.File pemFile=new File("trusted-ca-certs.pem");
	java.io.File p12File=new java.io.File("clientkeystore.p12");
	char[] passphrase= "password".toCharArray();

	KeyStore trustStore = de.elbosso.util.security.Utilities.initializeTruststoreWithPemCertificates(pemFile,false);
	KeyStore digIdent = de.elbosso.util.security.Utilities.loadDigitalIdentityFromPKCS12(p12File,passphrase);

	SocketFactory factory = de.elbosso.util.security.Utilities.createSslSocketFactory(digIdent,trustStore,passphrase);
	try (SSLSocket socket = (SSLSocket) factory.createSocket(host, port)) {
		configurePort(socket);
		String message = "Hello World Message";
		OutputStream os = new BufferedOutputStream(socket.getOutputStream());
		os.write(message.getBytes());
		os.flush();

		InputStream is = new BufferedInputStream(socket.getInputStream());
		byte[] data = new byte[2048];
		int len = is.read(data);
	}
}

import ssl
import socket
import pprint

def sslClient():
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    context.load_verify_locations("trusted-ca-certs.pem")
    context.load_cert_chain("client-certificate.pem","clientprivkey.pem","password")
    conn = context.wrap_socket(socket.socket(socket.AF_INET),server_hostname="localhost")
    conn.connect(("localhost", 2222))
    cert = conn.getpeercert()
    pprint.pprint(cert)
    conn.sendall(b"huhu, server!")
    result=conn.recv(1024)
    print(result)
    conn.shutdown(socket.SHUT_RDWR)
    conn.close()

if __name__ == '__main__':
    sslClient()