diff --git a/samples/certificates/Readme.txt b/samples/certificates/Readme.txt
new file mode 100644
index 0000000000..64b415cf83
--- /dev/null
+++ b/samples/certificates/Readme.txt
@@ -0,0 +1,10 @@
+This directory contains certificates and keys for use with SSL in the sample applications. Certificates are issued by
+our "Spring Security Test CA" certificate authority.
+
+ca.pem     - the certificate authority's certificate.
+server.jks - Java keystore containing the server certificate and privatekey. It Also contains the certificate authority
+             file and this is used as both keystore and truststore for they jetty server when running the samples with
+             the maven jetty plugin ("mvn jetty:run").
+
+rod.p12, dianne.p12, scott.p12 are all certificate/key combinations for client authentication and can be installed in
+your browser if you want to try out support for X.509 authentication.
\ No newline at end of file
diff --git a/samples/certificates/ca.pem b/samples/certificates/ca.pem
new file mode 100644
index 0000000000..a5b52ca9d7
--- /dev/null
+++ b/samples/certificates/ca.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDojCCAoqgAwIBAgIEMKX1dzANBgkqhkiG9w0BAQUFADCBiTELMAkGA1UEBhMC
+R0IxETAPBgNVBAgTCFNjb3RsYW5kMRAwDgYDVQQHEwdHbGFzZ293MRkwFwYDVQQK
+ExBTcHJpbmcgRnJhbWV3b3JrMRgwFgYDVQQLEw9TcHJpbmcgU2VjdXJpdHkxIDAe
+BgNVBAMTF1NwcmluZyBTZWN1cml0eSBUZXN0IENBMB4XDTA4MDEyNTExMTIyMVoX
+DTE4MDIyNTAwMDAwMFowgYkxCzAJBgNVBAYTAkdCMREwDwYDVQQIEwhTY290bGFu
+ZDEQMA4GA1UEBxMHR2xhc2dvdzEZMBcGA1UEChMQU3ByaW5nIEZyYW1ld29yazEY
+MBYGA1UECxMPU3ByaW5nIFNlY3VyaXR5MSAwHgYDVQQDExdTcHJpbmcgU2VjdXJp
+dHkgVGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALzl/wEe
+snYrwqaGZuB8hmwACtptazh1+eXCfd66FkioxlLF7yTnjCC7DT+vmMgSuThIEIsN
+xlxLpEgyU3bU8GIuR8wyYIyvuSMcptdFJLV7NKYuRycxpDuqimTM7Br0nfNgKVEv
+1QwguGWr6YN3aZ68/xe/D5xyPhakKu++7VFXIXw9f0+nqojdrFTqQ6l9GAVRgfX6
+h4JOaV1VFx83y2pnFj0iFneVxRcvXyWnyXlcOvJDIyVuyS/hYxb+E5rtBvp5XQ0o
+5CP4OMwCZGx/jEqlL8oO7BwEgu9aEBxKvoIKJmHDTHgWIxgawTrKabmong4utnMI
+yNrhsI77bmh2U7UCAwEAAaMQMA4wDAYDVR0PBAUDAwcGADANBgkqhkiG9w0BAQUF
+AAOCAQEAuD8W9Ukkfyi0y65mwguFVAqBC3RSTMRXcjbLQV4rMDM/Q9kjA6acY4Ta
+WgxGTwNCydqaqwDVsmn+6Je8Lp2xm9KLDLypVdNopGs+Mlfo55dhwqymXkQw1oJI
+CPhR3nBmGEnSWW0UY9bPlpxRF2D5GDVwpuxDtXvWa4baPwRRI9MxwPWHA3ITl+fc
+s9QVKy+pRAnuP9MSIp755cJ1CODOn2ElNCqnxxsZmcWcmI3LkHAwTmegl3PVvhrk
+MKMEA/neshh/M/hWGNTFt77Hoa7pU9dv5RCWFvZPqsUgPrwGrmUvcmSDir3lSWQm
+SuSED2LKVo+BFqwWS+jp49AR9b8B/Q==
+-----END CERTIFICATE-----
diff --git a/samples/tutorial/dianne.p12 b/samples/certificates/dianne.p12
similarity index 100%
rename from samples/tutorial/dianne.p12
rename to samples/certificates/dianne.p12
diff --git a/samples/tutorial/rod.p12 b/samples/certificates/rod.p12
similarity index 100%
rename from samples/tutorial/rod.p12
rename to samples/certificates/rod.p12
diff --git a/samples/certificates/scott.p12 b/samples/certificates/scott.p12
new file mode 100644
index 0000000000..f0a6357e73
Binary files /dev/null and b/samples/certificates/scott.p12 differ
diff --git a/samples/tutorial/server.jks b/samples/certificates/server.jks
similarity index 100%
rename from samples/tutorial/server.jks
rename to samples/certificates/server.jks
diff --git a/samples/tutorial/pom.xml b/samples/tutorial/pom.xml
index b87d27f50e..2d5b504422 100644
--- a/samples/tutorial/pom.xml
+++ b/samples/tutorial/pom.xml
@@ -103,10 +103,10 @@
                         </connector>
                         <connector implementation="org.mortbay.jetty.security.SslSocketConnector">
                             <port>8443</port>
-                            <keystore>server.jks</keystore>
+                            <keystore>../certificates/server.jks</keystore>
                             <password>password</password>
                             <keyPassword>password</keyPassword>
-                            <truststore>server.jks</truststore>
+                            <truststore>../certificates/server.jks</truststore>
                             <trustPassword>password</trustPassword>
                             <wantClientAuth>true</wantClientAuth>
                             <needClientAuth>false</needClientAuth>