What is the benefit of using the "proper" JKS keystore over something like AES encryption over just plain property file?
One point is that you would need to manage that encrypted file yourself.
And you cannot make use of other keys and certificate authorities that the user might already have defined.
Why do keystores exist, which benefits do they provide over encrypted properties?
Keystores abstract different ways of managing keys and certificates. Certificates are not always stored in local files. Sometimes they are accessed over the network and in many cases the certificate store depends on some hardware device (like id card readers).
These hardware keystores often do not allow the extraction of private keys from them, in order to keep them more secure. Instead, they provide a programmatic way of signing and/or ciphering data.
Several devices exist. So the keystore manager in the computer needs to use different protocols and drivers to access these hardware keystores.
- PKCS-11 defines an API to access cryptographic devices.
- PKCS-12 provides a standard to store keys and certificates in a file.
The JKS abstracts and allows you to access this whole ecosystem of keystores.