The issue appears to be due to incompatibility between JCE keystore formats of IBM and Oracle JDKs.

The workaround suggested in the duplicate bug JDK-8195661 seemed to help here with an additional step of configuring IBM crypto provider:

1)
Get a distribution of JDK 1.8.0.131-b11.
2)
Configure IBM crypto provider in this JDK.
3)
Import the keystore.
/jdk1.8.0_131-b11/bin/keytool -importkeystore -alias <ALIAS> -srckeystore <OLDKEYSTORE> -destkeystore <NEWKEYSTORE> -srcstoretype JCEKS -deststoretype JCEKS -srcstorepass <PASSWORD> -deststorepass <PASSWORD> -srckeypass <PASSWORD> -destkeypass <PASSWORD>
4)
Now the keystore can be read with the later version of JDK 8u without errors.