The PKCS#12 key stores now report a certificate whose public key cannot be resolved, and a zero-length certificate chain, as the KeyStoreException engineSetKeyEntry and engineSetCertificateEntry declare, and check both ahead of the assignments so a refused entry is not left behind in the store, relates to github #2419.