public void upload(@Nullable String password, List<FormDataBodyPart> parts) throws CACreationException {
        final var providedPassword = password == null ? null : password.toCharArray();
        // TODO: if the upload consists of more than one file, handle accordingly
        // or: decide that it's always only one file containing all certificates
        try {
            KeyStore keyStore = KeyStore.getInstance(PKCS12, "BC");
            keyStore.load(null, null);
            for (BodyPart part : parts) {
                InputStream is = part.getEntityAs(InputStream.class);
                byte[] bytes = is.readAllBytes();
                String pem = new String(bytes, StandardCharsets.UTF_8);
                // Test, if upload is PEM file, must contain at least a certificate
                if (pem.contains("-----BEGIN CERTIFICATE")) {
                    var ca = PemCaReader.readCA(pem, password);
                    keyStore.setKeyEntry(CA_KEY_ALIAS, ca.privateKey(), providedPassword, ca.certificates().toArray(new Certificate[0]));
                } else {
                    ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
                    keyStore.load(bais, providedPassword);
                }
            }
            writeToDatabase(adaptUploadedKeystore(keyStore, providedPassword));
            triggerCaChangedEvent();
        } catch (IOException | KeyStoreStorageException | GeneralSecurityException ex) {
            LOG.error("Could not write CA: " + ex.getMessage(), ex);
            throw new CACreationException("Could not write CA: " + ex.getMessage(), ex);
        }
    }
@Test
    void testUpload() throws Exception {
        final Configuration configuration = Mockito.spy(new Configuration());

        final String password = RandomStringUtils.randomAlphanumeric(20);
        final EncryptedValueService encryptionService = new EncryptedValueService(password);
        final InMemoryClusterConfigService clusterConfigService = new InMemoryClusterConfigService();
        final CaPersistenceService service = new CaPersistenceService(configuration, password, Mockito.mock(ClusterEventBus.class), clusterConfigService, encryptionService);
        final String existingCaPassword = "foobar";

        // TODO: it would be nice to generate the PemCaReaderTest.PEM_CERT_WITH_ENCRYPTED_KEY here instead of using hardcoded
        // values. But so far haven't found any way to PEM-encode private key correctly, so the upload accepts it.
        service.upload(existingCaPassword, List.of(
                getBodyPart(PemCaReaderTest.PEM_CERT_WITH_ENCRYPTED_KEY)
        ));

        Assertions.assertThat(service.get())
                .isPresent()
                .hasValueSatisfying(info -> {
                    Assertions.assertThat(info.id()).isEqualTo("GRAYLOG CA");
                    Assertions.assertThat(info.type()).isEqualTo(CAType.GENERATED);
                });


        Assertions.assertThat(service.loadKeyStore())
                .isPresent()
                .hasValueSatisfying(k -> {
                    Assertions.assertThat(k.password()).isEqualTo(password);
                    try {
                        Assertions.assertThat(k.keyStore().getCertificate("ca")).isNotNull();
                    } catch (KeyStoreException e) {
                        throw new RuntimeException(e);
                    }
                });
    }