${HOME}/ghidra-current is a symlink to the currently active Ghidra directory. That is, I have several versions of Ghidra installed in ${HOME} and ghidra-current points to the one I'm using.
I'm keeping the cacerts and keystore outside of the Ghidra directory to make upgrading Ghidra easier. (I also keep the repositories directory outside of the Ghidra directory for the same reason.)
The directory for the keystore and cacerts should exist and the directory for the keystore should have permissions 0700. This isn't checked.
For this to work, you need to enable PKI authentication in server.conf by setting
wrapper.app.parameter.1=-a2
wrapper.app.parameter.2=${ghidra.repositories.dir}