@SuppressWarnings("nls")
    private void updateSslConfig(HttpAsyncClientBuilder asyncClientBuilder, GenericOptionsParser config) {
        try {
            // TODO(msavy): merge together with TLSOptions?
            final boolean allowSelfSigned = config.getBool(keys("client.allowSelfSigned", "client.trust.certificate"), false);
            final boolean allowAnyHost = config.getBool(keys("client.allowAnyHost", "client.trust.host"), false);
            final boolean trustAll = config.getBool(keys("client.trustAll", "client.trust-all"), false);

            Path clientKeystorePath = config.getPath(
                keys("client.keystore.path", "client.keystore"),
            null,
                Predicates.anyOk(),
                Predicates.fileExistsMsg("key store")
            );

            Optional<String> clientKeystorePassword = Optional.ofNullable(config.getString(
                keys("client.keystore.password"),
                null,
                Predicates.anyOk(), ""
            ));

            String clientKeystoreFormat = config.getString(
                keys("client.keystore.format"),
                "jks",
                Predicates.matchesAny("pkcs12", "jks"),
                "format must be jks or pkcs12"
            );

            Path trustStorePath = config.getPath(
                keys("client.truststore.path", "client.truststore"),
                null,
                Predicates.anyOk(),
                Predicates.fileExistsMsg("trust store")
            );

            Optional<String> trustStorePassword = Optional.ofNullable(config.getString(
                keys("client.truststore.password"),
                null,
                Predicates.anyOk(), ""
            ));

            String trustStoreFormat = config.getString(
                keys("client.truststore.format"),
                "jks",
                Predicates.matchesAny("pkcs12", "jks"),
                "format must be jks or pkcs12"
            );

            KeyStore truststore = KeyStore.getInstance(trustStoreFormat);
            KeyStore keyStore = KeyStore.getInstance(clientKeystoreFormat);

            if (trustStorePath != null) {
                try (InputStream is = Files.newInputStream(trustStorePath)) {
                    truststore.load(is, trustStorePassword.map(String::toCharArray).orElse(null));
                }
            }
            if (clientKeystorePath != null) {
                try (InputStream is = Files.newInputStream(clientKeystorePath)) {
                    keyStore.load(is, clientKeystorePassword.map(String::toCharArray).orElse(null));
                }
            }

            SSLContextBuilder sslContextBuilder = SSLContextBuilder.create();
            if (allowSelfSigned) {
                sslContextBuilder.loadTrustMaterial(new TrustSelfSignedStrategy());
            } else if (trustAll) {
                sslContextBuilder.loadTrustMaterial(new TrustAllStrategy());
            } else {
                sslContextBuilder.loadTrustMaterial(truststore, null);
                sslContextBuilder.loadKeyMaterial(keyStore, clientKeystorePassword.map(String::toCharArray).orElse(null));
            }
            SSLContext sslContext = sslContextBuilder.build();

            HostnameVerifier hostnameVerifier =
                allowAnyHost ? NoopHostnameVerifier.INSTANCE : new DefaultHostnameVerifier();

            asyncClientBuilder.setSSLStrategy(
                new SSLIOSessionStrategy(sslContext, hostnameVerifier)
            );
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
Configures the SSL connection to use certificates by setting the keystores.

@param asyncClientBuilder the client builder
@param config             the configuration
@see <a href="https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/_encrypted_communication.html">Elasticsearch-Docs</a>
common/es/src/main/java/io/apiman/common/es/util/DefaultEsClientFactory.java