{"record":{"id":"53e5ac5d3c73a22c","repo":"t8y2/dbx","slug":"jks-keystore-contains-no-private-key-entry-53e5ac","errorCode":null,"errorMessage":"JKS keystore contains no private key entry","messagePattern":"JKS keystore contains no private key entry","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":169,"sourceCode":"\t\t\t\treturn tls.Certificate{}, getErr\n\t\t\t}\n\t\t\tprivateKey, parseErr := parsePrivateKey(entry.PrivateKey)\n\t\t\tif parseErr != nil {\n\t\t\t\treturn tls.Certificate{}, parseErr\n\t\t\t}\n\t\t\tresult := tls.Certificate{PrivateKey: privateKey}\n\t\t\tfor index, certificate := range entry.CertificateChain {\n\t\t\t\tresult.Certificate = append(result.Certificate, certificate.Content)\n\t\t\t\tif index == 0 {\n\t\t\t\t\tresult.Leaf, _ = x509.ParseCertificate(certificate.Content)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(result.Certificate) == 0 {\n\t\t\t\treturn tls.Certificate{}, errors.New(\"JKS private key entry has no certificate chain\")\n\t\t\t}\n\t\t\treturn result, nil\n\t\t}\n\t\treturn tls.Certificate{}, errors.New(\"JKS keystore contains no private key entry\")\n\tdefault:\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unsupported store type %q\", storeType)\n\t}\n}\n\nfunc normalizedStoreType(storeType, path string) string {\n\tvalue := strings.ToUpper(strings.TrimSpace(storeType))\n\tswitch value {\n\tcase \"P12\", \"PFX\", \"PKCS#12\":\n\t\treturn \"PKCS12\"\n\tcase \"X509\", \"X.509\":\n\t\treturn \"PEM\"\n\tcase \"\":\n\t\tswitch strings.ToLower(filepath.Ext(path)) {\n\t\tcase \".jks\":\n\t\t\treturn \"JKS\"\n\t\tcase \".p12\", \".pfx\", \".pkcs12\":\n\t\t\treturn \"PKCS12\"","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L151-L187","documentation":"Returned by loadClientKeyStore in hive-go while building TLS config from a JKS keystore: the keystore parsed successfully but contains no entry of type private key. Only keystore files with a private-key entry (plus its certificate chain) can be used as a client identity for TLS, so certificate construction fails.","triggerScenarios":"The JKS file only contains TrustedCertEntry aliases (no PrivateKeyEntry) — e.g. pointing client_key_store at a truststore or a public-certificate-only keystore.","commonSituations":"Configuring the client keystore path to the CA truststore by mistake; exporting only certificates when migrating keystores; wrong password causing the private key entry to be skipped.","solutions":["Point the keystore path at a JKS containing a PrivateKeyEntry (verify with 'keytool -list -v'; look for 'PrivateKeyEntry', not 'TrustedCertEntry').","Rebuild the keystore from PEM key + cert via PKCS12: openssl pkcs12 -export -in cert.pem -inkey key.pem | keytool -importkeystore.","Check the keystore password is correct — entries may be unreadable with a wrong password."],"exampleFix":"# before\nkeyStorePath=/etc/pki/truststore.jks   # contains only CA certs\n# after\nkeyStorePath=/etc/pki/client-key.jks   # contains PrivateKeyEntry","handlingStrategy":"validation","validationCode":"func jksHasPrivateKey(path string) error {\n\tf, err := os.Open(path); if err != nil { return err }\n\tdefer f.Close()\n\tks := jks.New(sha1.New)\n\tif err := ks.Parse(f, nil); err != nil { return err }\n\tif len(ks.PrivateKeys) == 0 { return errors.New(\"jks has no PrivateKeyEntry\") }\n\treturn nil\n}","typeGuard":"func isPrivateKeyEntry(entry jks.Entry) bool { _, ok := entry.(jks.PrivateKey); return ok }","tryCatchPattern":"cert, err := loadClientKeyStore(path, pass)\nif err != nil {\n\tif strings.Contains(err.Error(), \"no private key entry\") {\n\t\treturn fmt.Errorf(\"%s is not a client keystore (no PrivateKeyEntry); check keyStorePath config\", path)\n\t}\n\treturn err\n}","preventionTips":["Keep truststore and keystore files in separate, clearly named paths (truststore.jks vs client-key.jks).","Run 'keytool -list -v -keystore file.jks' in CI to assert PrivateKeyEntry exists.","When exporting, include the private key (e.g. -importkeystore from PKCS12), not just certs."],"tags":["tls","jks","keystore","private-key","zookeeper"],"backgroundTag":"jks-keystore-missing-certificate-chain","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}