The other server commands (shutdown, ping, sysinfo, runtimeinfo, logconnections, maxthreads, timeslice, trace, tracedirectory) are implemented as clients, and they behave exactly as clients with regards to SSL. The SSL mode is set with the property derby.drda.sslMode or the server command option -ssl.
java -jar derbyrun.jar server shutdown -ssl basic
will shut down an SSL-enabled server.
Similarly, if you have peerAuthentication on both sides, use the following command:
java -Djavax.net.ssl.keyStore=clientKeyStore.key \ -Djavax.net.ssl.keyStorePassword=qwerty \ -Djavax.net.ssl.trustStore=clientTrustStore.key \ -Djavax.net.ssl.trustStorePassword=qwerty \ -jar derbyrun.jar server shutdown -ssl peerAuthentication