According to javadoc, KeyStore has different policies on entry overwriting:

  setCertificateEntry: only overwrite TrustedCertificateEntry, otherwise exception is thrown
  setKeyEntry, setEntry: always overwrite

However, the implementation of engineSetEntry() in KeyStoreSpi calls engineSetCertificateEntry() when the entry is a TrustedCertificateEntry, therefore, if the existing entry is a PrivateKeyEntry, an exception is thrown.

Implementation does not conform to spec.