How to properly create an SSLSocketFactory for 2 way TLS? (For ApplePay)

I'm trying to make a request to ApplePay but am not able to do it with Java.

Here's the curl request:

$ curl -X POST --cert-type P12 --cert cert.p12 https://apple-pay-gateway-pr-pod1.apple.com/paymentservices/startSession -d '{}'
{
  "statusMessage": "Payment Services Exception Invalid session request",
  "statusCode": "400"
}

which is normal to the extent that it's able to communicate with the apple server.

Here's my code to generate a new Feign client SSLContextFactory (written in Kotlin):

   @Bean
    fun client(): Client { // a Feign Client
        val keystoreFile = File("/path/to/cert.p12")

        val keyStore = KeyStore.getInstance("PKCS12")
        keyStore.load(keystoreFile.inputStream(), null)
        val keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyFactory.init(keyStore, null)
        val trustManagerFactory = TrustManagerFactory.getInstance(
            TrustManagerFactory.getDefaultAlgorithm()
        )
        trustManagerFactory.init(keyStore)
        val trustManagers = trustManagerFactory.trustManagers
        val trustManager = trustManagers[0] as X509TrustManager
        val sslContext: SSLContext = SSLContext.getInstance("TLS")
        sslContext.init(keyFactory.keyManagers, trustManagers, null)

        return feign.okhttp.OkHttpClient(
            FeignConfiguration.enrichOkHttpClientBuilder(logbook)
                .sslSocketFactory(sslContext.socketFactory, trustManager)
                .connectionSpecs(
                    arrayListOf(
                        ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
                            .tlsVersions(TlsVersion.TLS_1_2)
                            .cipherSuites(
                                CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
                                , CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
                                , CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
                                , CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
                                , CipherSuite.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
                                , CipherSuite.TLS_RSA_WITH_AES_128_GCM_SHA256
                                , CipherSuite.TLS_RSA_WITH_AES_128_GCM_SHA256
                            )
                            .build()
                    )
                )
            .build()
        )
    }

But when I try to make a request to the same URL, I get the following error:

feign.RetryableException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty executing POST https://apple-pay-gateway-pr-pod1.apple.com/paymentservices/startSession/paymentSession

Anyone have an idea of what I may be doing wrong?

My tech lead was able to help resolve this, but @dave_thompson_085 's answer should also help.

So I basically replaced the parts before the feign client stuff with:

        val keystoreStream = <stream>

        val keyStore = KeyStore.getInstance("PKCS12")
        keyStore.load(keystoreStream, keystorePassword.toCharArray())

        val sslContext: SSLContext = SSLContexts.custom()
            .loadTrustMaterial(null, TrustSelfSignedStrategy())
            .loadKeyMaterial(keyStore, keystorePassword.toCharArray())
            .build()

        val tmf = TrustManagerFactory
            .getInstance(TrustManagerFactory.getDefaultAlgorithm())
        tmf.init(keyStore) // can use tmf to get individual trustmanager