The PicketBox Vault implementation assumes that it will always use the default keystore type (KeyStore.getDefaultType()). It would be nice if this were configurable/overridable. For example, via the system property:

javax.net.ssl.keyStoreType