{"record":{"id":"0e4226d45184a32b","repo":"quarkusio/quarkus","slug":"unable-to-recover-the-key-for-alias-alias-in-0e4226","errorCode":null,"errorMessage":"Unable to recover the key for alias '${alias}' in P12 key store '${name}'","messagePattern":"Unable to recover the key for alias '(.+?)' in P12 key store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":133,"sourceCode":"\n            char[] pwd = null;\n            if (aliasPassword != null) {\n                pwd = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, pwd) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 trust store '\" + name + \"'\", e);\n            }\n        }\n    }","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L115-L151","documentation":"KeyStore.getKey(alias, pwd) threw UnrecoverableKeyException, meaning the private key for the alias exists but could not be recovered with the supplied alias password. Quarkus throws this IllegalArgumentException.","triggerScenarios":"verifyP12KeyStore with alias and alias-password configured; the alias-password in quarkus.tls.<name>.key-store.p12.alias-password (or from the credential provider) does not match the key's password in the P12.","commonSituations":"P12 whose key entry was created with a different password than the store password; stale alias-password after regenerating the keystore; credential provider returning the wrong secret; special characters/misquoted password in properties.","solutions":["Set quarkus.tls.<name>.key-store.p12.alias-password to the correct key entry password","If key and store passwords are identical, align or remove the alias-password override","Fix the credential provider secret for the alias password","Regenerate the P12 with matching key/store passwords (openssl pkcs12 -export default behavior)"],"exampleFix":"// before\nquarkus.tls.my-cert.key-store.p12.alias-password=oldpass\n// after\nquarkus.tls.my-cert.key-store.p12.alias-password=keypass123","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = Files.newInputStream(Path.of(\"keystore.p12\"))) {\n    ks.load(in, storePassword);\n}\nks.getKey(alias, aliasPassword.toCharArray()); // throws UnrecoverableKeyException early if wrong","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Unable to recover the key\")) {\n        log.error(\"alias-password does not match the key entry; fix config or credential provider\");\n    }\n}","preventionTips":["Keep key and store passwords identical to avoid alias-password drift","Rotate alias-password in the credential provider whenever the P12 is regenerated","Beware special characters in properties; quote or escape passwords correctly"],"tags":["quarkus","tls","p12","keystore","password"],"backgroundTag":"keystore-wrong-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}