In NiFi, how does one create the necessary keystore, truststore and certificates needed to configure the StandardRestrictedSSLContextService controller service?

I need to invoke an HTTPS REST service. (Using NiFi 1.9.2 in local development mode)

Steps taken:

1. Used TLS toolkit to generate self-signed certs, truststore and keystore
2. Saved the API endpoint certificate to a .cer file (exported from chrome)
3. `$keytool -import -alias mycert -keystore /opt/nifi/conf/truststore.jks -file api-cert.cer`

After doing this, InvokeHTTP processor in NiFi indicates it cannot find the certification path:
`PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target`