{"record":{"id":"2816615571ab49a9","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-key-store-private-k","errorCode":null,"errorMessage":"Alias '${alias}' not found in key store (private key not found) '${name}'","messagePattern":"Alias '(.+?)' not found in key store \\(private key not found\\) '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":155,"sourceCode":"    }\n\n    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,\n            String aliasPassword) {\n        if (config.alias().isPresent()) {\n            String alias = config.alias().get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (private key not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in trust store (certificate not found) '\" + name + \"'\");","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L137-L173","documentation":"The key store contains an entry under the configured alias, but it does not hold a private key (KeyStore.getKey returned null) — typically the alias only references a certificate/trust entry. The TLS registry requires a key entry for a key store used for server/client authentication.","triggerScenarios":"Configuring an alias that points to a certificate-only entry (e.g. a trusted cert or CA cert imported into the key store) in quarkus.tls.<name>.key-store.alias; verifyKeyStoreAlias calls ks.getKey(alias, ap) and gets null.","commonSituations":"Pointing the key-store alias at an entry in a file that is actually a trust store; generating a keystore where the cert was imported with keytool -importcert instead of -genkeypair; wrong alias chosen among several entries.","solutions":["Pick the alias of the entry containing the private key: keytool -list -keystore <file> shows 'PrivateKeyEntry' vs 'trustedCertEntry'","If the file only has trusted certs, generate/import a proper key pair entry (keytool -genkeypair) and point the config at it","Swap the config: this file may belong under trust-store, not key-store","Correct the alias property to the PrivateKeyEntry name"],"exampleFix":"// before: alias points to a trustedCertEntry\nquarkus.tls.my-tls.key-store.alias=ca-cert\n// after: alias of the PrivateKeyEntry\nquarkus.tls.my-tls.key-store.alias=server","handlingStrategy":"validation","validationCode":"KeyStore ks = /* load keystore */;\nString alias = configAlias;\nif (ks.isCertificateEntry(alias)) {\n    throw new IllegalArgumentException(\"Alias '\" + alias + \"' is a trustedCertEntry, not a PrivateKeyEntry\");\n}\nif (!ks.isKeyEntry(alias)) {\n    throw new IllegalArgumentException(\"Alias '\" + alias + \"' does not hold a private key\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check keytool -list output for 'PrivateKeyEntry' before choosing the alias","Never point key-store config at a trust-store file","Name key entries consistently (e.g. 'server') across regenerated keystores","Separate key stores and trust stores into distinct files to avoid alias confusion"],"tags":["tls","keystore","alias","private-key","config"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}