implementing SSL clientAuth in Java

I'm new to SSL and trying to figure out how to get it working with Java Netty server. I want to do essentially this: Correctly creating a new certificate with an intermediate certificate using bouny castle I want to create certificates for different clients and have them talk to my server. I generate unique certificates per client, but I have two basic questions regarding SSL implementation in Java.

1. When I create my intermediate certificate to sign the client certs, is this basically a one time thing similar to creating the root cert? Meaning, in the example, the author generates an KeyPair intermediatePair. Do I regenerate this KeyPair when I sign for different client certs? My guess is no and that I should save this intermediate cert somewhere and then load it when my server starts.

2. How do clients actually get trusted by the server? Is it the fact that the certificate they have is signed by the server rootcert->intermediatecert and creates the chain of trust? Or after I create my certificate, so I need to add that cert to the KeyStore trustStore I'm using when my server starts? Something like this (pseudocode)

   KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
   trustStore.load(null, null);
   CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
   Path p = Paths.get(path);
   byte[] bytes = Files.readAllBytes(p);
   InputStream in = new ByteArrayInputStream(bytes);
   X509Certificate certificate = null;
   if (in != null) {
       certificate = (X509Certificate) certificateFactory.generateCertificate(in);
       in.close();
   }
   trustStore.setCertificateEntry("certficateName", certificate);