KeyStore:管理密钥与证书的容器边界

  KeyStore.getDefaultType() = pkcs12
  a.p12   文件头 308203da → KeyStore.getInstance(File, 密码) 自动识别为 PKCS12,别名 [srv]
  b.jks   文件头 feedfeed → KeyStore.getInstance(File, 密码) 自动识别为 JKS,别名 [srv]
  PKCS12:getKey("srv") → EC PKCS#8,isKeyEntry = true,证书链长度 = 1,别名大小写:containsAlias("SRV") = true

  PKCS12 密码错误 → IOException: keystore password was incorrect;cause = UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
  JKS 密码错误 → IOException: Keystore was tampered with, or password was incorrect
  JKS 的私钥有自己的密码(这里是 keypass1),用 store 密码取 → UnrecoverableKeyException: Cannot recover key
  用正确的私钥密码取 → RSA
  用 PKCS12 类型读一个 JKS 文件:成功(JDK 会兼容识别),类型 = PKCS12

  PKCS12:存放对称密钥(SecretKeyEntry)→ 成功,读回的类型 = AES,isKeyEntry = true,文件 415 字节
  JKS:存放对称密钥 → KeyStoreException: Cannot store non-PrivateKeys
  TrustedCertificateEntry:setCertificateEntry 之后 isCertificateEntry = true,isKeyEntry = false;getCertificateAlias(同一张证书) = trusted-demo
  getEntry 返回的类型 = PrivateKeyEntry,entry.getAttributes() 里有 2 个属性
  deleteEntry 之后 size = 0

  JDK 自带的 cacerts:类型 PKCS12,受信任的根证书 111 个;前三个别名 [actalisauthenticationrootca [jdk], addtrustexternalca [jdk], addtrustqualifiedca [jdk]](别名里常带 [jdk] 标记)
  其中 TrustedCertificateEntry 有 111 个
  javax.net.ssl.trustStore 没设置时,默认的信任库是:null(null = 用 cacerts,密码默认 changeit)