docs: public void setCertificateEntry(String alias, Certificate cert) throws KeyStoreException, KeyException {
          if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
              Tr.entry(this, tc, "setCertificateEntry", new Object[] { alias, cert });
          }
          if (Boolean.parseBoolean(getProperty(Constants.SSLPROP_KEY_STORE_READ_ONLY))) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(this, tc, "Unable to update readonly store");
              }
              throw new KeyStoreException("Unable to add to read-only store");
          }
          final KeyStoreManager mgr = KeyStoreManager.getInstance();
  
          try {
              KeyStore jKeyStore = getKeyStore(false, false);
              if (null == jKeyStore) {
                  final String keyStoreLocation = getProperty(Constants.SSLPROP_KEY_STORE);
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                      Tr.debug(tc, "Cannot load the Java keystore at location \"" + keyStoreLocation + "\"");
                  }
                  throw new KeyStoreException("Cannot load the Java keystore at location \"" + keyStoreLocation + "\"");
              }
  
              // store the cert... errors are thrown if conflicts or errors occur
              jKeyStore.setCertificateEntry(alias, cert);
  
              try {
                  store();
              } catch (IOException e) {
                  // Note: debug + ffdc in store() itself
  
                  // on z/OS we have an issue where the certificate may be stored but the
                  // alias
                  // already exists in RACF so the keystore API will through an
                  // IOException
                  // we need to catch this condition on z/OS and if the certs is in the
                  // keystore
                  // prior after adding the certificate then we know the cert was actually
                  // added and its not
                  // a true failure. If the cert was not added then we need to rethrow the
                  // exception.
                  final String ksType = getProperty(Constants.SSLPROP_KEY_STORE_TYPE);
                  if ((ksType.equals(Constants.KEYSTORE_TYPE_JCERACFKS) || ksType.equals(Constants.KEYSTORE_TYPE_JCECCARACFKS)
                       || ksType.equals(Constants.KEYSTORE_TYPE_JCEHYBRIDRACFKS))) {
                      KeyStore ks = getKeyStore(true, false);
  
                      if (mgr.checkIfSignerAlreadyExistsInTrustStore((X509Certificate) cert, ks)) {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                              Tr.debug(tc, "Certificate already exists in RACF: " + e.getMessage());
                          }
                      } else {
                          throw new KeyException(e.getMessage(), e);
                      }
                  } else {
                      throw new KeyException(e.getMessage(), e);
                  }
              }
          } catch (KeyStoreException kse) {
              throw kse;
          } catch (KeyException ke) {
              throw ke;
          } catch (Exception e) {
              throw new KeyException(e.getMessage(), e);
          }
  
          // after adding the certificate, clear the keystore and SSL caches so it
          // reloads it.
          AbstractJSSEProvider.clearSSLContextCache();
          mgr.clearJavaKeyStoresFromKeyStoreMap();
  
          if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled()) {
              Tr.exit(this, tc, "setCertificateEntry");
          }
      }