title: Java Keystore PrivateKeyEntry vs trustedCertEntry
body: <p>I'm renewing a certificate used by my Hadoop cluster.
  Current JKS has one entry:</p>
  
  <pre><code>Your keystore contains 1 entry
  
  Alias name: myalias
  Creation date: Jan 10, 2019
  Entry type: PrivateKeyEntry
  Certificate chain length: 1
  </code></pre>
  
  <p>I'm trying to create a new keystore from the new cert:</p>
  
  <pre><code>keytool -importcert -alias myalias  -file newcertfile.crt -keystore newkeystore.jks
  </code></pre>
  
  <p>But I get asked about whether I trust this certificate (If I say no, keytool quits):</p>
  
  <pre><code>Trust this certificate? [no]:  yes
  </code></pre>
  
  <p>And when I look at the result, it's no longer a PrivateKeyEntry but a trustedCertEntry:</p>
  
  <pre><code>keytool -list -v -keystore newkeystore.jks
  ...
  ...
  Your keystore contains 1 entry
  
  Alias name: myalias
  Creation date: Feb 20, 2019
  Entry type: trustedCertEntry
  ...
  ...
  </code></pre>
  
  <p>What am I missing here?
  Should I just use the JKS with the trustedCertEntry or is there a way to make it just like the old JKS (with PrivateKeyEntry)?</p>