{"record":{"id":"58489803f4b4bc88","repo":"MuntashirAkon/AppManager","slug":"the-provided-alias-ksalias-does-not-exist","errorCode":null,"errorMessage":"The provided alias {ksAlias} does not exist.","messagePattern":"The provided alias (.+?) does not exist\\.","errorType":"exception","errorClass":"KeyStoreException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/KeyStoreUtils.java","lineNumber":137,"sourceCode":"                                     @Nullable String ksAlias, @Nullable char[] ksPass,\n                                     @Nullable char[] aliasPass)\n            throws GeneralSecurityException, IOException {\n        String keyType = TYPES[ksType];\n        Log.d(TAG, \"Loading keystore %s\", keyType);\n        final KeyStore ks = KeyStore.getInstance(keyType, getKeyStoreProvider(keyType));\n        try (InputStream is = context.getContentResolver().openInputStream(ksUri)) {\n            if (is == null) throw new FileNotFoundException(ksUri + \" does not exist.\");\n            ks.load(is, ksPass);\n        }\n        if (TextUtils.isEmpty(ksAlias)) {\n            ksAlias = ks.aliases().nextElement();\n        }\n        Key key = ks.getKey(ksAlias, aliasPass);\n        if (key instanceof PrivateKey) {\n            X509Certificate cert = (X509Certificate) ks.getCertificate(ksAlias);\n            return new KeyPair((PrivateKey) key, cert);\n        }\n        throw new KeyStoreException(\"The provided alias \" + ksAlias + \" does not exist.\");\n    }\n\n    @NonNull\n    public static KeyPair getKeyPair(@NonNull Context context, @NonNull Uri keyPath, @NonNull Uri certPath)\n            throws GeneralSecurityException, IOException {\n        ContentResolver cr = context.getContentResolver();\n        PKCS8EncodedKeySpec spec;\n        PrivateKey privateKey;\n        X509Certificate cert;\n        try (InputStream pk = cr.openInputStream(keyPath)) {\n            byte[] data = IoUtils.readFully(pk, -1, true);\n            spec = new PKCS8EncodedKeySpec(data);\n        }\n        try (InputStream cer = cr.openInputStream(certPath)) {\n            cert = (X509Certificate) CertificateFactory.getInstance(\"X.509\").generateCertificate(cer);\n            // TODO: 22/5/21 Check algorithm type: We only support RSA and EC\n            privateKey = KeyFactory.getInstance(cert.getPublicKey().getAlgorithm()).generatePrivate(spec);\n        }","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/crypto/ks/KeyStoreUtils.java#L119-L155","documentation":"In getKeyPair, after loading the keystore, ks.getKey(ksAlias, aliasPass) did not return a PrivateKey (e.g. null or a SecretKey), so the library throws KeyStoreException \"The provided alias <ksAlias> does not exist.\" This is thrown when the alias is absent, refers to a non-private-key entry (e.g. a certificate-only or secret entry), or the alias password is wrong so the key can't be recovered.","triggerScenarios":"Calling getKeyPair with an alias not present in the keystore; an alias holding only a trusted certificate or secret key; a wrong aliasPass causing getKey to fail and return null for a password-protected entry.","commonSituations":"Typo in alias name; alias casing mismatch (aliases are case-sensitive); reading a .cer/.crt-only keystore where only certificates are stored; user's keystore doesn't contain the expected key after re-export.","solutions":["Call ks.containsAlias(alias) (or listAliases) beforehand and verify the alias exists.","Check the alias spelling/case matches exactly what's stored.","Ensure the alias holds a PrivateKeyEntry (private key + certificate chain), not a cert-only or secret entry.","Verify aliasPass is correct for password-protected key entries."],"exampleFix":"// before\nKeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);\n// after\nList<String> aliases = KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass);\nif (!aliases.contains(ksAlias)) {\n    throw new IllegalArgumentException(\"Alias not in keystore: \" + ksAlias + \", available: \" + aliases);\n}\nKeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);","handlingStrategy":"validation","validationCode":"// confirm the alias exists and is a private-key entry before calling getKeyPair\nList<String> aliases = KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass);\nif (!aliases.contains(ksAlias)) {\n    throw new IllegalArgumentException(\"Alias not found: \" + ksAlias + \" (available: \" + aliases + \")\");\n}","typeGuard":null,"tryCatchPattern":"// try\ntry {\n    KeyPair kp = KeyStoreUtils.getKeyPair(context, ksUri, ksAlias, ksType, ksPass, aliasPass);\n} catch (KeyStoreException e) {\n    if (e.getMessage().contains(\"does not exist\")) {\n        // wrong alias: enumerate aliases and let the user pick the right one\n        showAliasPicker(KeyStoreUtils.listAliases(context, ksUri, ksType, ksPass));\n    }\n}","preventionTips":["Always enumerate aliases with listAliases and match exactly (case-sensitive) before extraction.","Ensure the source keystore is a PKCS#12/JKS with a PrivateKeyEntry, not a cert-only keystore.","Keep alias names alongside keystore files in app config to avoid typos.","Verify aliasPass is correct — a wrong password makes getKey return null for protected entries."],"tags":["keystore","alias","keypair","android"],"backgroundTag":"entity-not-found","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}