MuntashirAkon/AppManager · error · KeyStoreException

The provided alias does not exist.

Error message

The provided alias {ksAlias} does not exist.

What it means

In getKeyPair, after loading the keystore, ks.getKey(ksAlias, aliasPass) did not return a PrivateKey (e.g. null or a SecretKey), so the library throws KeyStoreException "The provided alias <ksAlias> does not exist." This is thrown when the alias is absent, refers to a non-private-key entry (e.g. a certificate-only or secret entry), or the alias password is wrong so the key can't be recovered.

Solutions

1. Call ks.containsAlias(alias) (or listAliases) beforehand and verify the alias exists.
2. Check the alias spelling/case matches exactly what's stored.
3. Ensure the alias holds a PrivateKeyEntry (private key + certificate chain), not a cert-only or secret entry.
4. Verify aliasPass is correct for password-protected key entries.

Example fix

// before
KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);
// after
List<String> aliases = KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass);
if (!aliases.contains(ksAlias)) {
    throw new IllegalArgumentException("Alias not in keystore: " + ksAlias + ", available: " + aliases);
}
KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);

// confirm the alias exists and is a private-key entry before calling getKeyPair
List<String> aliases = KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass);
if (!aliases.contains(ksAlias)) {
    throw new IllegalArgumentException("Alias not found: " + ksAlias + " (available: " + aliases + ")");
}

// try
try {
    KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);
} catch (KeyStoreException e) {
    if (e.getMessage().contains("does not exist")) {
        // wrong alias: enumerate aliases and let the user pick the right one
        showAliasPicker(KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass));
    }
}

When it happens

Trigger: Calling getKeyPair with an alias not present in the keystore; an alias holding only a trusted certificate or secret key; a wrong aliasPass causing getKey to fail and return null for a password-protected entry.

Common situations: Typo in alias name; alias casing mismatch (aliases are case-sensitive); reading a .cer/.crt-only keystore where only certificates are stored; user's keystore doesn't contain the expected key after re-export.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• Alias exists.
• Alias app_manager does not exist in KeyStore.
• Checksums for master key did not match.
• Could not decrypt encrypted password.
• Could not load AES local protection key from keystore

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/58489803f4b4bc88. Report an issue: GitHub.

Appendix: source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/KeyStoreUtils.java:137

                                     @Nullable String ksAlias, @Nullable char[] ksPass,
                                     @Nullable char[] aliasPass)
            throws GeneralSecurityException, IOException {
        String keyType = TYPES[ksType];
        Log.d(TAG, "Loading keystore %s", keyType);
        final KeyStore ks = KeyStore.getInstance(keyType, getKeyStoreProvider(keyType));
        try (InputStream is = context.getContentResolver().openInputStream(ksUri)) {
            if (is == null) throw new FileNotFoundException(ksUri + " does not exist.");
            ks.load(is, ksPass);
        }
        if (TextUtils.isEmpty(ksAlias)) {
            ksAlias = ks.aliases().nextElement();
        }
        Key key = ks.getKey(ksAlias, aliasPass);
        if (key instanceof PrivateKey) {
            X509Certificate cert = (X509Certificate) ks.getCertificate(ksAlias);
            return new KeyPair((PrivateKey) key, cert);
        }
        throw new KeyStoreException("The provided alias " + ksAlias + " does not exist.");
    }

    @NonNull
    public static KeyPair getKeyPair(@NonNull Context context, @NonNull Uri keyPath, @NonNull Uri certPath)
            throws GeneralSecurityException, IOException {
        ContentResolver cr = context.getContentResolver();
        PKCS8EncodedKeySpec spec;
        PrivateKey privateKey;
        X509Certificate cert;
        try (InputStream pk = cr.openInputStream(keyPath)) {
            byte[] data = IoUtils.readFully(pk, -1, true);
            spec = new PKCS8EncodedKeySpec(data);
        }
        try (InputStream cer = cr.openInputStream(certPath)) {
            cert = (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(cer);
            // TODO: 22/5/21 Check algorithm type: We only support RSA and EC
            privateKey = KeyFactory.getInstance(cert.getPublicKey().getAlgorithm()).generatePrivate(spec);
        }

View on GitHub (pinned to 0152f468fc)