-J takes a server certificate. This option can be used with the strict encryption mode (-Ys). This option specifies the path to a certificate file to match against the server's connection encryption certificate. The match is done instead of standard certificate validation (expiry, host name, trust chain, etc.) The accepted certificate formats are PEM, DER, and CER. If specified, the server's certificate is checked by seeing if the server certificate provided is an exact match.