{"record":{"id":"12c16af395d1269f","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-p12-key-store-certi","errorCode":null,"errorMessage":"Alias '${alias}' not found in P12 key store (certificate not found)'${name}'","messagePattern":"Alias '(.+?)' not found in P12 key store \\(certificate not found\\)'(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":109,"sourceCode":"                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(PfxOptions options, String name,\n            KeyStore ks) {\n        String alias = options.getAlias();\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n\n            char[] pwd = null;\n            if (aliasPassword != null) {\n                pwd = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, pwd) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L91-L127","documentation":"When an alias is configured for a P12 key store, Quarkus verifies that the alias resolves to a certificate. If ks.getCertificate(alias) returns null it throws this IllegalStateException, meaning the requested entry is absent (or is not a certificate entry) in the loaded key store.","triggerScenarios":"verifyP12KeyStore -> verifyKeyStoreAlias with options.getAlias() set, and the loaded P12 KeyStore has no certificate under that alias.","commonSituations":"Typo in quarkus.tls.<name>.key-store.p12.alias; alias removed when the P12 was regenerated; keystore exported from a tool that named the alias differently (e.g. '1' or lowercase); certificate replaced by a key-only entry.","solutions":["List actual aliases: keytool -list -keystore keystore.p12 -storetype PKCS12","Correct quarkus.tls.<name>.key-store.p12.alias to an existing alias","Regenerate the P12 ensuring the expected alias is present","Remove the alias property if you want the first/default entry"],"exampleFix":"// before\nquarkus.tls.my-cert.key-store.p12.alias=ServerCert\n// after (after running keytool -list)\nquarkus.tls.my-cert.key-store.p12.alias=servercert","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = Files.newInputStream(Path.of(\"keystore.p12\"))) {\n    ks.load(in, storePassword);\n}\nboolean exists = ks.isCertificateEntry(alias) || ks.getCertificate(alias) != null;\nif (!exists) {\n    throw new IllegalArgumentException(\"Alias not in keystore: \" + alias);\n}","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"not found in P12 key store\")) {\n        log.error(\"Alias mismatch; run keytool -list to find valid aliases\");\n    }\n}","preventionTips":["Run keytool -list and copy aliases verbatim into config","Keep alias names stable when regenerating P12 files (-name flag with openssl)","Avoid case mismatches: PKCS12 aliases are case-insensitive in most tools but copy exactly","Add a CI check that validates configured aliases against the packaged keystores"],"tags":["quarkus","tls","p12","keystore","alias"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}