Summary
-------

Change the keystore type of `$JDK_HOME/lib/security/cacerts` file from JKS to password-less PKCS12. By password-less, it means the certificates are not encrypted and it contains no MacData for integrity check.

Problem
-------

The current cacerts file is in JKS format, which has several problems:

1. The JKS format is obsolete and we have been advising users to migrate to PKCS12 for years.
2. The keystore is protected by a password "changeit", which is weak and well-known. It also provides no real protection since anyone can modify the file and re-protect it with the same password. Also, the cacerts keystore is part of the JDK binary, which should ideally be installed in a location that cannot be modified by unauthorized users.

Solution
--------

Change the keystore type of `lib/security/cacerts` file from JKS to password-less PKCS12. The build process will be updated to create the new file. One can also migrate the current file with the following command:

    keytool -J-Dkeystore.pkcs12.certProtectionAlgorithm=NONE \
        -J-Dkeystore.pkcs12.macAlgorithm=NONE \
        -importkeystore -srckeystore cacerts -srcstorepass changeit \
        -deststoretype pkcs12 -destkeystore cacerts

Specification
-------------

The format of cacerts is an implementation detail.