MuntashirAkon/AppManager · error · KeyStoreException

The provided alias {ksAlias} does not exist.

Error message

The provided alias {ksAlias} does not exist.

What it means

In getKeyPair, after loading the keystore, ks.getKey(ksAlias, aliasPass) did not return a PrivateKey (e.g. null or a SecretKey), so the library throws KeyStoreException "The provided alias <ksAlias> does not exist." This is thrown when the alias is absent, refers to a non-private-key entry (e.g. a certificate-only or secret entry), or the alias password is wrong so the key can't be recovered.

Source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/KeyStoreUtils.java:137

                                     @Nullable String ksAlias, @Nullable char[] ksPass,
                                     @Nullable char[] aliasPass)
            throws GeneralSecurityException, IOException {
        String keyType = TYPES[ksType];
        Log.d(TAG, "Loading keystore %s", keyType);
        final KeyStore ks = KeyStore.getInstance(keyType, getKeyStoreProvider(keyType));
        try (InputStream is = context.getContentResolver().openInputStream(ksUri)) {
            if (is == null) throw new FileNotFoundException(ksUri + " does not exist.");
            ks.load(is, ksPass);
        }
        if (TextUtils.isEmpty(ksAlias)) {
            ksAlias = ks.aliases().nextElement();
        }
        Key key = ks.getKey(ksAlias, aliasPass);
        if (key instanceof PrivateKey) {
            X509Certificate cert = (X509Certificate) ks.getCertificate(ksAlias);
            return new KeyPair((PrivateKey) key, cert);
        }
        throw new KeyStoreException("The provided alias " + ksAlias + " does not exist.");
    }

    @NonNull
    public static KeyPair getKeyPair(@NonNull Context context, @NonNull Uri keyPath, @NonNull Uri certPath)
            throws GeneralSecurityException, IOException {
        ContentResolver cr = context.getContentResolver();
        PKCS8EncodedKeySpec spec;
        PrivateKey privateKey;
        X509Certificate cert;
        try (InputStream pk = cr.openInputStream(keyPath)) {
            byte[] data = IoUtils.readFully(pk, -1, true);
            spec = new PKCS8EncodedKeySpec(data);
        }
        try (InputStream cer = cr.openInputStream(certPath)) {
            cert = (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(cer);
            // TODO: 22/5/21 Check algorithm type: We only support RSA and EC
            privateKey = KeyFactory.getInstance(cert.getPublicKey().getAlgorithm()).generatePrivate(spec);
        }

View on GitHub (pinned to 0152f468fc)

Solutions

1. Call ks.containsAlias(alias) (or listAliases) beforehand and verify the alias exists.
2. Check the alias spelling/case matches exactly what's stored.
3. Ensure the alias holds a PrivateKeyEntry (private key + certificate chain), not a cert-only or secret entry.
4. Verify aliasPass is correct for password-protected key entries.

Example fix

// before
KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);
// after
List<String> aliases = KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass);
if (!aliases.contains(ksAlias)) {
    throw new IllegalArgumentException("Alias not in keystore: " + ksAlias + ", available: " + aliases);
}
KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);

// confirm the alias exists and is a private-key entry before calling getKeyPair
List<String> aliases = KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass);
if (!aliases.contains(ksAlias)) {
    throw new IllegalArgumentException("Alias not found: " + ksAlias + " (available: " + aliases + ")");
}

// try
try {
    KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);
} catch (KeyStoreException e) {
    if (e.getMessage().contains("does not exist")) {
        // wrong alias: enumerate aliases and let the user pick the right one
        showAliasPicker(KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass));
    }
}

When it happens

Trigger: Calling getKeyPair with an alias not present in the keystore; an alias holding only a trusted certificate or secret key; a wrong aliasPass causing getKey to fail and return null for a password-protected entry.

Common situations: Typo in alias name; alias casing mismatch (aliases are case-sensitive); reading a .cer/.crt-only keystore where only certificates are stored; user's keystore doesn't contain the expected key after re-export.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• Alias app_manager does not exist in KeyStore.
• Failed to setup metadata.
• The app has keystore items and KeyStore backup isn't enabled
• Master key existed when the checksum was made but now it doe
• Master key exists but it didn't exist when the backup was ma

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/58489803f4b4bc88. Report an issue: GitHub.