In case of PKCS11 provider password is actually interpreted as pin to PKCS11 token. (pin is empty string in default configuration) Seems like password was previously ignored for PKCS11 keystore, but that has changed in:
https://github.com/rh-openjdk/jdk/pull/17/commits
In case of PKCS11 provider password is actually interpreted as pin to PKCS11 token. (pin is empty string in default configuration) Seems like password was previously ignored for PKCS11 keystore, but that has changed in: https://github.com/rh-openjdk/jdk/pull/17/commits