WebScarab reads certificates stored in the PKCS12 format, which can be created or converted to by tools such as OpenSSL. PKCS12 is also one of the formats that Internet Explorer and Mozilla/Navigator, etc can import and export.
Since the PKCS12 format requires a password, WebScarab uses a password of "password" (without the quotes). This password is hard-coded into the source of WebScarab.
Note that this is not an important password, so there is no point in changing it!
If you decide you want to create your own certificates, for whatever reason, here are some instructions for doing so using OpenSSL:
First create the private key:
openssl genrsa 1024 > server.key
Then create the corresponding self-signed certificate:
openssl req -new -x509 -nodes -sha1 -days 3650 -key server.key > server.crt
Finally, wrap both the key and the certificate into a PKCS12 formatted file:
openssl pkcs12 -export -out server.p12 -in server.crt -inkey server.key -name "WebScarab"
Place the resulting "server.p12" file in the root of the webscarab installation directory, in place of the existing server.p12 file
Initial support for client certificates exists now, so you should be able to do similar operations for the client certificate and keys, calling the file "client.p12"
NOTE that WebScarab looks for the certificate and key files IN the webscarab.jar, so you will have to rebuild the jar file with your updated certificate files, otherwise they will not be used!