{"record":{"id":"4b8f627c3bc08ee9","repo":"quarkusio/quarkus","slug":"unable-to-verify-alias-alias-in-p12-key-store","errorCode":null,"errorMessage":"Unable to verify alias '${alias}' in P12 key store '${name}'","messagePattern":"Unable to verify alias '(.+?)' in P12 key store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":113,"sourceCode":"                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(PfxOptions options, String name,\n            KeyStore ks) {\n        String alias = options.getAlias();\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n\n            char[] pwd = null;\n            if (aliasPassword != null) {\n                pwd = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, pwd) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L95-L131","documentation":"While verifying a configured alias in a P12 key store, KeyStore.getCertificate(alias) threw a KeyStoreException (keystore not loaded/operational). Quarkus wraps it in this IllegalStateException — it is an infrastructure failure, not a missing alias.","triggerScenarios":"verifyKeyStoreAlias calls ks.getCertificate(alias) and the JDK throws KeyStoreException, typically because the KeyStore instance is in a bad/unloaded state after loading via Vert.x PfxOptions.loadKeyStore.","commonSituations":"Rare runtime/JDK-level failures loading the PKCS12 keystore, provider problems, or corrupted keystore state after a partial load.","solutions":["Inspect the cause (KeyStoreException message) for the underlying keystore problem","Re-test loading with: keytool -list -keystore file.p12 -storetype PKCS12 to confirm integrity","Verify keystore file is not truncated/corrupted and re-export it","Report/pin JDK or security provider issues if cause points at the PKCS12 provider"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Ensure the keystore loads cleanly with the JDK before app startup\nKeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = Files.newInputStream(Path.of(\"keystore.p12\"))) {\n    ks.load(in, storePassword); // a hard failure here predicts the error\n}","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().startsWith(\"Unable to verify alias\")) {\n        log.error(\"Keystore verification failed; cause:\", e.getCause());\n    }\n}","preventionTips":["Test the P12 with keytool using the same JDK that runs the app","Avoid truncated/corrupted keystores (verify checksums in CI)","Ensure security providers used at build time are also registered at runtime (native image)"],"tags":["quarkus","tls","p12","keystore","keystoreexception"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}