Distinguish a keystore (holds the entity's private key and certificate, presented to prove identity) from a truststore (holds trusted CA/peer certificates used to validate the other party) and choose the correct one for a server vs client role.