{"record":{"id":"37dc99230e0936fe","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-jks-trust-store-cer","errorCode":null,"errorMessage":"Alias '${alias}' not found in JKS trust store (certificate not found)'${name}'","messagePattern":"Alias '(.+?)' not found in JKS trust store \\(certificate not found\\)'(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":148,"sourceCode":"                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static KeyStore loadKeyStore(Vertx vertx, String name, JksOptions options, String type) {\n        try {\n            return options.loadKeyStore(vertx);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Unable to load JKS \" + type + \" store '\" + name + \"', verify the password.\", e);\n        }\n    }\n}\n","sourceCodeStart":130,"sourceCodeEnd":165,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L130-L165","documentation":"Thrown by JKSKeyStores.verifyTrustStoreAlias when a JKS trust store was loaded successfully but the configured alias has no certificate in it (ks.getCertificate(alias) returned null). The alias option names a specific entry to pin; the guard fires after load, wrapped together with KeyStoreException/NoSuchAlgorithmException handling in the 'Unable to verify alias' path, and names both the missing alias and the trust store configuration name.","triggerScenarios":"quarkus.tls.<name>.trust-store.jks.alias names an alias absent from the trust store; verifyTrustStoreAlias (JKSKeyStores.java:147-149) during verifyJKSTrustStoreStore.","commonSituations":"Trusted CA imported under a different alias than configured; trust store rebuilt/replaced losing the alias; alias case/format mismatch; copy-pasted key-store alias into the trust-store config.","solutions":["List aliases: keytool -list -keystore truststore.jks and correct quarkus.tls.<name>.trust-store.jks.alias.","Re-import the CA certificate under the expected alias: keytool -importcert -alias <alias> -file ca.crt -keystore truststore.jks.","Remove the alias property entirely if trusting all entries in the store is intended."],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.jks.alias=internal-ca-v1\n// after\nquarkus.tls.my-cert.trust-store.jks.alias=internal-ca","handlingStrategy":"validation","validationCode":"KeyStore ts = KeyStore.getInstance(\"JKS\");\ntry (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(truststorePath))) {\n    ts.load(in, storePassword.toCharArray());\n}\nboolean ok = ts.getCertificate(alias) != null;","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"not found in JKS trust store\")) {\n        log.errorf(\"Alias %s missing from truststore; run keytool -list -keystore truststore.jks\", alias);\n    }\n    throw e;\n}","preventionTips":["Copy aliases from keytool -list output, never by hand.","Rebuild trust stores via script that also updates config.","Omit the alias property to trust all entries in the store.","Pin trust store contents in version control or a managed secret."],"tags":["tls","jks","truststore","alias"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}