Some years ago, I was scared of the certificates and had no idea how to set it up. I remember just following my colleagues commands. Later on, I have received a task to set up servers and renew a lot of certificates. It was not that complicated to do the basic set up/renewals.
I use keystore and truststore terms to differentiate the keystores for tomcat (java). The keystore usually contains SSL certificate with chain, where truststore contains the ROOT certificates for connected applications and domains.