{"record":{"id":"60ca45dc85c95817","repo":"quarkusio/quarkus","slug":"unable-to-load-jks-type-store-name-verify","errorCode":null,"errorMessage":"Unable to load JKS ${type} store '${name}', verify the password.","messagePattern":"Unable to load JKS (.+?) store '(.+?)', verify the password\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":161,"sourceCode":"    private static void verifyTrustStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static KeyStore loadKeyStore(Vertx vertx, String name, JksOptions options, String type) {\n        try {\n            return options.loadKeyStore(vertx);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Unable to load JKS \" + type + \" store '\" + name + \"', verify the password.\", e);\n        }\n    }\n}\n","sourceCodeStart":143,"sourceCodeEnd":165,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L143-L165","documentation":"Thrown by JKSKeyStores.loadKeyStore when loading a JKS/JCEKS-style store fails with a password error: the KeyStore.load call cannot unlock the store file, almost always because the configured password is wrong (or the store is corrupted and fails integrity checks the same way). The catch for the password-related failure rethrows with this message prompting a password check, naming the store type and configuration name.","triggerScenarios":"options.loadKeyStore(vertx) throws for a key store configured via quarkus.tls.key-store.jks/p12 (wrong password, wrong path, corrupt file, wrong type).","commonSituations":"Password set with special chars not resolved correctly; keystore re-generated with a different password; file truncated or not actually a JKS file; case-sensitive path typo.","solutions":["Verify the key store password matches the one used to create the store (keytool -list -keystore path)","Check that the configured path resolves and points to a real JKS/PKCS12 file","Recreate the store if corrupt: keytool -genkeypair -keystore ks.jks","If credentials come from a credential provider, verify the provider returns the right password"],"exampleFix":"// before\nquarkus.tls.key-store.jks.path=certs/ks.jks\nquarkus.tls.key-store.jks.password=secret1\n// after\nquarkus.tls.key-store.jks.path=certs/ks.jks\nquarkus.tls.key-store.jks.password=correct-password\n","handlingStrategy":"validation","validationCode":"// before startup\nboolean ok = new JksOptions().setPath(path).setPassword(pwd) != null;\ntry (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(path))) {\n    var ks = java.security.KeyStore.getInstance(\"JKS\");\n    ks.load(in, pwd.toCharArray()); // fails fast with a clear cause\n}\n","typeGuard":null,"tryCatchPattern":"try { startApp(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Unable to load JKS\")) { log.error(\"Check keystore path/password\", e.getCause()); }\n    throw e;\n}","preventionTips":["Verify stores with keytool -list before deploying","Inject passwords via env/secret, never hardcode","Use PKCS12 (default, better supported)"],"tags":["tls","keystore","jks","password"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}