HttpClient takes always the first certificate entry form KeyStore

I have two different keyStores service1.jks and sevice2.jks for two different services correspondingly (but they have the same RootSertificate though). Here is my httpClient which works successfully with the two services:

  public HttpClient getHttpClient(String filePath, String password) {
    KeyStore keyStore = KeyStore.getInstance(new File(filePath), password.toCharArray());

    SSLContext sslContext = new SSLContextBuilder()
            .loadKeyMaterial(keyStore, password.toCharArray())
            .build();

    SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext, (hostname, session) -> true);

    return HttpClients.custom()
            .setSSLSocketFactory(socketFactory)
            .build();
  }

I have a need to use only one shared keyStore in my project. So I merged service1.jks and sevice2.jks into one common keyStore common.jks:

cp sevice2.jks common.jks
keytool -importkeystore -srckeystore service1.jks -srcstoretype jks -srcstorepass changeit -destkeystore common.jks -deststoretype jks -deststorepass changeit

So common.jks has two items:

$ keytool -list -storepass changeit -keystore server.keystore.jks
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

service1-alias, 8 сент. 2020 г., PrivateKeyEntry,
Certificate fingerprint (SHA-256): 
....
service2-alias, 8 сент. 2020 г., PrivateKeyEntry,
Certificate fingerprint (SHA-256): 
...

Then it turned out that my HttpClient now works successfully only with the first service1, while requests to service2 became unauthorized. It seems for me that my HttpClient takes now only the first entry form common.jks. How to make HttpClient to use the correct alias for the request?

I believe this is the default behaviour. There's a note in the Javadocs for SSLContextBuilder:

> Please note: the default Oracle JSSE implementation of
> SSLContext.init(KeyManager[], TrustManager[], SecureRandom) accepts
> multiple key and trust managers, however only only first matching type
> is ever used. See for example: SSLContext.html#init

Many Java libraries and frameworks have this problem -- certificates can be stored in a keystore with a alias and, in principle, an application can select which alias to use if it has to present a certificate. However, facilities to do this are often ommited from libraries, on the assumption that an application will never need to use more than a single keystore.