{"record":{"id":"437d5607b4349e25","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-jks-key-store-priva","errorCode":null,"errorMessage":"Alias '${alias}' not found in JKS key store (private key not found)'${name}'","messagePattern":"Alias '(.+?)' not found in JKS key store \\(private key not found\\)'(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":127,"sourceCode":"        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = null;\n            if (aliasPassword != null) {\n                ap = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        if (alias != null) {","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L109-L145","documentation":"When a private-key alias is configured, Quarkus checks KeyStore.getKey(alias, aliasPassword). If it returns null the alias does not hold a private key, so startup fails with this IllegalStateException.","triggerScenarios":"quarkus.tls.<name>.key-store.jks.alias points to an alias that exists but contains no private key entry (e.g. a trusted-cert-only entry), or alias-password is wrong such that getKey resolves to nothing; verifyKeyStoreAlias (JKSKeyStores.java:126-128) during verifyJKSKeyStore.","commonSituations":"Pointing the key-store alias at a trust/cert entry instead of the server key entry; copying an alias into the wrong keystore; alias password omitted or wrong so the key cannot be retrieved (some stores return null instead of throwing).","solutions":["Run keytool -list -v -keystore keystore.jks and confirm the alias is a PrivateKeyEntry, not TrustedCertEntry.","Set quarkus.tls.<name>.key-store.jks.alias-password correctly (it often differs from the store password).","If the entry is cert-only, import the full key+cert chain with keytool -importkeystore from the P12/PKCS12 original."],"exampleFix":"// before\nquarkus.tls.my-cert.key-store.jks.alias=ca-root\n// after\nquarkus.tls.my-cert.key-store.jks.alias=server\nquarkus.tls.my-cert.key-store.jks.alias-password=keypass","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(keystorePath))) {\n    ks.load(in, storePassword.toCharArray());\n}\nboolean hasKey = ks.isKeyEntry(alias);","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"private key not found\")) {\n        log.errorf(\"Alias %s is not a PrivateKeyEntry; check keytool -list -v\", alias);\n    }\n    throw e;\n}","preventionTips":["Confirm with keytool -list -v that the alias is a PrivateKeyEntry.","Set alias-password whenever the key entry password differs from the store password.","Import full PKCS12 bundles rather than bare keys."],"tags":["tls","jks","keystore","alias","private-key"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}