{"record":{"id":"512d2d2215d9934e","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-p12-trust-store-cer","errorCode":null,"errorMessage":"Alias '${alias}' not found in P12 trust store (certificate not found)'${name}'","messagePattern":"Alias '(.+?)' not found in P12 trust store \\(certificate not found\\)'(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":144,"sourceCode":"                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static KeyStore loadKeyStore(Vertx vertx, String name, PfxOptions options, String type) {\n        KeyStore ks;\n        try {\n            ks = options.loadKeyStore(vertx);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Unable to load P12 \" + type + \" store '\" + name + \"', verify the password.\", e);\n        }\n        return ks;\n    }\n}","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L126-L162","documentation":"When a P12 trust store is configured with an alias, Quarkus verifies the alias resolves to a certificate in the loaded trust store. A null result throws this IllegalStateException, meaning the trusted CA entry named by the alias is absent.","triggerScenarios":"verifyP12TrustStoreStore -> verifyTrustStoreAlias with quarkus.tls.<name>.trust-store.p12.alias set and no certificate under that alias in the P12.","commonSituations":"Alias refers to a CA in an old truststore version; typo in alias; trust store rebuilt with different alias naming; copy-pasted alias from key store config.","solutions":["List aliases: keytool -list -keystore truststore.p12 -storetype PKCS12","Correct quarkus.tls.<name>.trust-store.p12.alias to an existing CA alias","Remove the alias property to trust all entries in the P12","Re-import the CA into the trust store with the expected alias"],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.p12.alias=internal-ca-v1\n// after\nquarkus.tls.my-cert.trust-store.p12.alias=internal-ca","handlingStrategy":"validation","validationCode":"KeyStore ts = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = Files.newInputStream(Path.of(\"truststore.p12\"))) {\n    ts.load(in, storePassword);\n}\nif (ts.getCertificate(alias) == null) {\n    throw new IllegalArgumentException(\"Alias not in trust store: \" + alias);\n}","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"not found in P12 trust store\")) {\n        log.error(\"Fix trust-store.p12.alias or drop it to trust all entries\");\n    }\n}","preventionTips":["Verify trust store aliases with keytool -list after every trust store update","Omit the alias property when you intend to trust all entries in the P12","Use consistent alias naming conventions across environments"],"tags":["quarkus","tls","p12","truststore","alias"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}