Starting in JDK 8, we started seeing some JCK failures in the following code snippet for DKS.

        char[] PASSWORD1 = "JckTestPassword".toCharArray();
        PasswordProtection pp = new PasswordProtection(PASSWORD1);
        Builder builder = Builder.newInstance("DKS", null, pp);
        KeyStore ks1 = builder.getKeyStore();

java.lang.UnsupportedOperationException: This keystore must be loaded using a DomainLoadStoreParameter is thrown from the builder.getKeyStore(); call.

The tests (and above code fails) since a DomainKeyStore cannot be instantiated using KeyStore.Builder.

When KeyStore.Builder.newInstance(String, Provider, ProtectionParameter) is called then the subsequent call to KeyStore.Builder.getKeyStore() simply wraps the previously supplied ProtectionParameter which is not sufficient for DomainKeyStore. It requires a DomainLoadStoreParameter.

One potential (preferred) solution would be to introduce a special KeyStore.Builder.newInstance() method that takes a DomainLoadStoreParameter..