The missing info is as follow:

1. The online help fails to mention that the user needs to cut and paste the
listed certificate value starting with "---BEGIN CERTIFICATE----" and ending with
"----END CERTIFICATE----" into the file.  Without this step, the save
certificate has the wrong format.

Note that there is a better way to do this.  Instead of using the -list command,
we can use the -export command.  For example,

keytool -export -keystore keystore.jks -alias amserver -rfc -file server.cer

This will automatically save the certificate in the server.cer file with the
correct format.  I suggest that this is what we tell the user to do instead of
doing cut and paste.

2. The online help fails to mention what the password for the ksystore under the
amflatfiledir is which is "secret". Without this password, importing the
client.cer into the keystore will fail with a NPE.