Page History

...

keystore {
    file = "/opt/shrine/shrine.keystore"
    password = "password"
    privateKeyAlias = "$KEYSTORE_ALIAS"
    keyStoreType = "JKS"
    caCertAliases= ["HUB_CA_CERT_ALIAS"]
  }

This is to make sure SHRINE uses  SHRINE will use privateKeyAlias to find the signed certificate to sign queries going out from your site.

The second place, is in the keystore section within /opt/shrine/tomcat/conf/server.xml:

<Connector port="6443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               keystoreFile="/opt/shrine/shrine.keystore"
               keystorePass="password"
               keyAlias="$KEYSTORE_ALIAS" />

This is to configure Tomcat to use the same signed certificate to serve your site's HTTPS traffic. 
Your researchers will get dire security warnings in their browser. To avoid this warning add a publicly-signed cert from an outside authority and use its keyAlias in your server.xml instead. , and caCertAliases to verify queries before running them.