title: Keystore's password management
body: <p>A keystore (no matter if it's used for "keystores" or "truststores") is initialized after creation using the <code>load()</code> method. One version expects an <code>InputStream</code> corresponding to the keystore file, and the password to decrypt the file. Providing the password to the method programmatically seems strange to me.</p>
  
  <p>For example, a server uses a keystore to store its private keys and the associated certificates. The information present in the keystore is sensible so it is protected by a password. What are the problems of passing the password to the <code>load()</code> method programmatically? What is the best practice?</p>
  
  <p>The other example, but for now concerning truststores. The client has a truststore where it stores the certificates of trusted CAs. As I understand it, the truststore doesn't contain the certificate of the server but only the certificates of the CAs that allow verifying the server's certificate. One truststore example I see is the one present with the JRE (in the <code>security</code> folder - <code>cacerts</code>). By looking at the configuration, I can see it is protected by the default password <code>changeit</code>. I understand that a truststore is implemented using a keystore, so it has (or maybe it's optional?) to be encrypted using a password. But, since truststores generally store public information (trusted CA's certificates) in the file, why changing the password is recommended?</p>
  
  <p>Thanks</p>