The other server commands (shutdown, ping, sysinfo, runtimeinfo, logconnections, maxthreads, timeslice, trace, and tracedirectory) are implemented as clients, and they behave exactly as clients with regards to SSL.
See Running the client with SSL/TLS for more information.
The SSL mode is set with the property derby.drda.sslMode or the server command option -ssl.
The following command will shut down an SSL-enabled server:
java -jar derbyrun.jar server shutdown -ssl basic
Similarly, if you have peerAuthentication on both sides, use the following command:
java -Djavax.net.ssl.keyStore=clientKeyStore.key \ -Djavax.net.ssl.keyStorePassword=qwerty \ -Djavax.net.ssl.trustStore=clientTrustStore.key \ -Djavax.net.ssl.trustStorePassword=qwerty \ -jar derbyrun.jar server shutdown -ssl peerAuthentication