Tomcat to use Windows Certificate Store for SSL

Question

I use Tomcat 9.0.10 and wish to use the Windows Certificate Store to hold the SSL private key and certificate. There's another thread here, that seems to have the answer, but I get an exception when starting Tomcat.

My server.xml looks like this:

<Connector port="443"
       protocol="org.apache.coyote.http11.Http11NioProtocol"
       SSLEnabled="true"
       maxthreads="150"
       scheme="https"
       secure="true"
       keyAlias="SERVER-TST-1.domain.local"
       keystoreFile=""
       keystoreType="Windows-ROOT"
       clientAuth="false"
       sslProtocol="TLS"
       connectionTimeout="20000"
       keepAliveTimeout="200000" />

This is the exception:

 org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to initialize component [Connector[HTTP/1.1-443]]
 org.apache.catalina.LifecycleException: Protocol handler initialization failed
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:935)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:530)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:852)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:633)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:656)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:306)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:491)
Caused by: java.lang.IllegalArgumentException: Alias name [SERVER-TST-1.domain.local] does not identify a key entry
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:85)
    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:216)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1043)
    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:540)
    at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:74)
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:932)
    ... 13 more
Caused by: java.io.IOException: Alias name [SERVER-TST-1.domain.local] does not identify a key entry
    at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:229)
    at org.apache.tomcat.util.net.openssl.OpenSSLUtil.getKeyManagers(OpenSSLUtil.java:79)
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:112)
    ... 19 more

The certificate has the private key also in the Windows cert store. I have imported them into the Local Machine and into the Current User store, too. The SSL certificate and the entire chain is in the cert store. Also, the CN in the cert is SERVER-TST-1.domain.local If I configure Tomcat to use the PFX file that I imported the certificate+private key and the chain from, then all is working well. I just want to avoid having a keystore password in clear text, hence I would like to use the Windows cert store.