I have found the clues I guess... keystore stuff should be in
<agent-dir>/conf according to the java default prefs
<entry key="rhq.agent.client.security.keystore.file"
value="/opt/rhq-agent/conf/keystore.dat"/>
<entry key="rhq.agent.client.security.truststore.file"
value="/opt/rhq-agent/conf/truststore.dat"/>
That's only used for agenet-server communications - its not for anything else - like
plugins trying to make SSL connections to other endpoints.