Surprisingly, when using ikeycmd recently to manipulate IHS keystores (kdb), I had to specifically configure the CMS storetype as follows:
../jre/bin/ikeycmd -DADD_CMS_SERVICE_PROVIDER_ENABLED=true -cert -details -label foo -db plugin-key.kdb -stashed
