title: JKS with multiple PrivateKeyEntries
body: <p>I'm running a basic web app within Tomcat and Java 6. In my app I have to connect to two different remote systems and each requires a unique client certificate.  Over a year ago, someone on the team was able to import both PFX files into 1 JKS file, and we could successfully communicate to the remote systems.  Unfortunately, the team-member that created this JKS file isn't around anymore and both of the certificates have expired.</p>
  
  <p>When I tried to re-create the combined JKS file, only 1 certificate was ever used, regardless of the system we were connecting to.  That obviously caused one of the connections to fail.  Here's a list of the keystore entries</p>
  
  <pre><code>comodo-root, Jul 18, 2012, trustedCertEntry,
  Certificate fingerprint (MD5): 1D:35:54:04:85:78:B0:3F:42:42:4D:BF:20:73:0A:3F
  comodo-intermediate, Jul 18, 2012, trustedCertEntry,
  Certificate fingerprint (MD5): 2B:EE:B7:93:D7:C5:DD:65:E3:16:E9:98:EF:85:9B:F7
  le-2f6efe10-57f8-4224-ba41-59940bd5422a, May 20, 2014, PrivateKeyEntry, 
  Certificate fingerprint (MD5): 75:1C:60:72:4A:23:33:19:26:15:7F:27:8B:C6:65:A6
  aa, May 20, 2014, PrivateKeyEntry, 
  Certificate fingerprint (MD5): D2:D8:73:DA:FD:A0:09:42:12:27:B0:50:E8:98:4C:48
  </code></pre>
  
  <p>Where <code>le-2f6efe10-57f8-4224-ba41-59940bd5422a</code> and <code>aa</code> are the two client certificates/stores that I imported.  </p>
  
  <p>I have validated that both certificates work independently if I use them outside of the JKS.  I have also verified that if I import only one of the PFX files into the JKS I'm able to successfully connect to that system that has the certificate imported.</p>
  
  <p>I'm setting the keystore properties at runtime during JVM start</p>
  
  <pre><code> System.setProperty("javax.net.ssl.keyStore", "path to my keystore" );
   System.setProperty("javax.net.ssl.keyStorePassword", "password" );
  </code></pre>
  
  <p>The problem only comes in when I have both PFX files imported, and the errors I'm receiving are from the remote servers indicating that the client certificate that's being passed is bad.</p>