You don't need to do anything with certificates unless you are using a self-signed certificate.  You can check for self-signed for IMAPS by:

$openssl s_client -showcerts -connect mail.mydomain.com:993

CONNECTED(00000003)

depth=0 /CN=exchange1.mydomain.com/CN=localhost/CN=exchange1/CN=companyweb/CN=mail.mydomain.com

verify error:num=18:self signed certificate

Then you will need to download and import the certificate into your keystore:

keytool -importcert -keystore /usr/java/jdk1.6.0_05-64/jre/lib/security/cacerts -storepass changeit -alias mail.mydomain.com -file mail.mydomain.com.pem

Of course, this creates a nice time bomb because the certificate eventually expires.  Then you have to generate a new certificate and install it on both the server and your keystore.

Options:
1. Don't use imaps, but use non-secure imap (port 143)
2. Use a self-signed cert and update both client and server when it expires.
3. Use a commercial certificate and then only have to update the server when it expires.  (It is signed by a certificate authority in your keystore.)
4. Ignore host verification completely, assuming you're not worried about a man-in-the-middle attack.

Disable SSL host verification with the following code.  (It always returns true.)

    /**
     * Disable the verification of the server hostname.
     * For debugging, use -Djavax.net.debug=all
     * For HTTPS, verify name in certificate matches hostname in URL.
     * If set, JSSE calls HostnameVerifier if its matching fails.
     */
    public static void disableHostVerify()
    {
        javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier()
        {
            public boolean verify(String hostname, SSLSession session)
            {
                logger.log(Level.INFO, "Verifying host: " + hostname + " and peer host: "
                    + session.getPeerHost());
                return true;
            }
        });
    }