well, first of all, thx for the instructions. 
 
with ApexDC 1.1.0 it's possible to create the certificates. 
with some other clients not - maybe they still have bugs in the TLS section. 
 
but now I have some more questions: 
 
1. is it really true, that, if two clients have generated these certificates in the right folder, an TLS encrypted connection is used automatically between them without exchanging the users client certificate (client.crt) ?  Does ApexDC send this 'public key' automatically to the other client? 
 
2. is it really true, that, only if unticking the "allow TLS connections to ..." checkboxes, I need to put the other users certificate into my trusted certificate folder ? 
 
3. how to do that exactly?  the other users certificate will have the same filename like my own certificate in the same folder. I guess, I should not overwrite my own certificate with that other users one. 
 
4. if really everything is right and the connection is TLS encrypted, how can I see that?  what is the proof for an encrypted connection? 
 
hopefully there is somebody out there, who has experiences already with that.