$ java --enable-preview -cp ... TlsFromPem     (27.0.1.0.2+1)
== read a two-certificate chain file
  CN=localhost
  CN=pem-api demo CA
ok: the stream decoder returns the two certificates one by one
== server side: key + chain -> KeyStore -> KeyManagerFactory -> SSLContext
== client trusting only the CA certificate from ca.pem
HTTP 200 hello over TLS  (TLSv1.3)
server presented: CN=localhost
ok: request over TLS succeeds
== same request with the JVM's default trust store (the CA is not in it)
javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
exit=0