The PemSslStoreBundle constructor accepts an alias and more recently a keyPassword (see #35983). These values currently apply to both the keystore and truststore. I think it would be better if they were configured on a per-store basis.