[Freeipa-users] Question about /etc/pki/java/cacerts and password change

Hello FreeIpa community!

I'm a bit confused about JKS "/etc/pki/java/cacerts". Am I right, that default password for this JKS is "changeit"? Can I change this password? If yes, shoud it be the same on all hosts connected to FreeIpa? Will it be problem later for FreeIpa? Should I somehow tell FreeIpa this password?

Also what is the best practice to tell java to trust FreeIpa CA?

Regards, Andrey