There are inconsistencies in the keystore RPCs.

• add-keystore-entry
• add-private-key
• add-trusted-certificate

We use private keys in PEM format with BEGIN and END prefixes such as 

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----  

For consistency, we should also use it for certificates like this:

-----BEGIN CERTIFICATE-----
Base64–encoded certificate
-----END CERTIFICATE-----

(https://docs.aws.amazon.com/acm/latest/userguide/import-certificate-format.html)