Clarify keystore_keypassword and keystore_password in TLS docs (#11984) (#12014)

(cherry picked from commit 79579b4)

Signed-off-by: Fanit Kolchina <kolchfa@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: opensearch-trigger-bot[bot]

_security/configuration/tls.md

@@ -55,7 +55,8 @@ Name | Description
 `plugins.security.ssl.transport.keystore_type` | The type of the keystore file, `JKS` or `PKCS12/PFX`. Optional. Default is `JKS`.
 `plugins.security.ssl.transport.keystore_filepath` | Path to the keystore file, which must be under the `config` directory, specified using a relative path. Required.
 `plugins.security.ssl.transport.keystore_alias` | The alias name of the keystore. Optional. Default is the first alias.
-`plugins.security.ssl.transport.keystore_password` | Keystore password. Default is `changeit`.
+`plugins.security.ssl.transport.keystore_password` | The password for the keystore file. Optional. Default is `changeit`.
+`plugins.security.ssl.transport.keystore_keypassword` | The password for the private key in the keystore. If not set, `keystore_password` is used. Optional.
 `plugins.security.ssl.transport.truststore_type` | The type of the truststore file, `JKS` or `PKCS12/PFX`. Default is `JKS`.
 `plugins.security.ssl.transport.truststore_filepath` | Path to the truststore file, which must be under the `config` directory, specified using a relative path. Required.
 `plugins.security.ssl.transport.truststore_alias` | The alias name of the truststore. Optional. Default is all certificates.
@@ -69,7 +70,8 @@ Name | Description
 `plugins.security.ssl.http.keystore_type` | The type of the keystore file, JKS or PKCS12/PFX. Optional. Default is JKS.
 `plugins.security.ssl.http.keystore_filepath` | Path to the keystore file, which must be under the `config` directory, specified using a relative path. Required.
 `plugins.security.ssl.http.keystore_alias` | The alias name of the keystore. Optional. Default is the first alias.
-`plugins.security.ssl.http.keystore_password` | The password for the keystore. Default is `changeit`.
+`plugins.security.ssl.http.keystore_password` | The password for the keystore file. Optional. Default is `changeit`.
+`plugins.security.ssl.http.keystore_keypassword` | The password for the private key in the keystore. If not set, `keystore_password` is used. Optional.
 `plugins.security.ssl.http.truststore_type` | The type of the truststore file, JKS or PKCS12/PFX. Default is JKS.
 `plugins.security.ssl.http.truststore_filepath` | Path to the truststore file, which must be under the `config` directory, specified using a relative path. Required.
 `plugins.security.ssl.http.truststore_alias` | The alias name of the truststore. Optional. Default is all certificates.
@@ -100,10 +102,11 @@ Name | Description
 :--- | :---
 `plugins.security.ssl.transport.keystore_type` | The type of the keystore file, either `JKS` or `PKCS12/PFX`. Optional. Default is `JKS`.
 `plugins.security.ssl.transport.keystore_filepath` | The path to the keystore file. Must be specified using a relative path under the `config` directory. Required.
+`plugins.security.ssl.transport.keystore_password` | The password for the keystore file. Optional. Default is `changeit`.
 `plugins.security.ssl.transport.server.keystore_alias` | The alias name of the server key. Optional. Default is the first alias.
 `plugins.security.ssl.transport.client.keystore_alias` | The alias name of the client key. Optional. Default is the first alias.
-`plugins.security.ssl.transport.server.keystore_keypassword` | The keystore password for the server. Default is `changeit`.
-`plugins.security.ssl.transport.client.keystore_keypassword` | The keystore password for the client. Default is `changeit`.
+`plugins.security.ssl.transport.server.keystore_keypassword` | The password for the server's private key in the keystore. If not set, `keystore_password` is used. Optional. Default is `changeit`.
+`plugins.security.ssl.transport.client.keystore_keypassword` | The password for the client's private key in the keystore. If not set, `keystore_password` is used. Optional. Default is `changeit`.
 `plugins.security.ssl.transport.server.truststore_alias` | The alias name of the server. Optional. Default is all certificates.
 `plugins.security.ssl.transport.client.truststore_alias` | The alias name of the client. Optional. Default is all certificates.
 `plugins.security.ssl.transport.truststore_filepath` | The path to the `truststore` file. Must be specified using a relative path under the `config` directory. Required.