{"record":{"id":"6168b4f91bcbf965","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-key-store-certifica","errorCode":null,"errorMessage":"Alias '${alias}' not found in key store (certificate not found) '${name}'","messagePattern":"Alias '(.+?)' not found in key store \\(certificate not found\\) '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":145,"sourceCode":"    private static KeyStore getInstance(String type, Optional<String> provider) {\n        try {\n            if (provider.isPresent()) {\n                return KeyStore.getInstance(type, provider.get());\n            }\n            return KeyStore.getInstance(type);\n        } catch (KeyStoreException | NoSuchProviderException e) {\n            throw new IllegalStateException(\"Unable to create key store of type '\" + type + \"'\"\n                    + (provider.isPresent() ? \" with provider '\" + provider.get() + \"'\" : \"\"), e);\n        }\n    }\n\n    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,\n            String aliasPassword) {\n        if (config.alias().isPresent()) {\n            String alias = config.alias().get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (private key not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L127-L163","documentation":"The TLS registry verifies that a configured alias actually exists in the loaded key store during startup. This error means the key store loaded successfully, but no certificate is registered under the alias given via quarkus.tls.key-store.alias (or the per-certificate alias). It fails fast so misconfigured TLS does not surface only at first handshake.","triggerScenarios":"Configuring quarkus.tls.<name>.key-store.alias (or certificate key-store alias) with a name that does not exist in the P12/JKS/PEM key store file; verifyKeyStoreAlias calls KeyStore.getCertificate(alias) which returns null.","commonSituations":"Typo in alias name; renaming an alias when regenerating the keystore with keytool; copying config between environments whose keystores differ; case-sensitivity mistakes (aliases are case-insensitive in JKS but the configured value must still match what the store contains).","solutions":["List the actual aliases with keytool -list -keystore <file> and set quarkus.tls.<name>.key-store.alias to an existing one","If you did not intend to restrict to one alias, remove the alias property so the whole key store is used","Regenerate or fix the key store so it contains a certificate under the configured alias","Check you are pointing at the intended key store file (path property) — the alias may exist in a different file"],"exampleFix":"// before\nquarkus.tls.my-tls.key-store.p12.path=certs/server.p12\nquarkus.tls.my-tls.key-store.alias=server-key\n// after (alias verified via: keytool -list -keystore certs/server.p12)\nquarkus.tls.my-tls.key-store.p12.path=certs/server.p12\nquarkus.tls.my-tls.key-store.alias=server","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = new FileInputStream(path)) { ks.load(in, storePassword); }\nString alias = configAlias; // value you put in quarkus.tls...alias\nif (alias != null && ks.getCertificate(alias) == null) {\n    throw new IllegalArgumentException(\"Alias '\" + alias + \"' missing in \" + path);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // start application / build TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"not found in key store (certificate not found)\")) {\n        log.errorf(\"Fix quarkus.tls.*.key-store.alias; available aliases: %s\", Collections.list(ks.aliases()));\n    }\n    throw e;\n}","preventionTips":["Run keytool -list -keystore <file> and paste exact alias names into config","Keep one canonical script that generates keystores so aliases stay stable across environments","Add a startup smoke test that loads the keystore and asserts the alias exists","Avoid hand-editing alias names in config; generate config from a template checked into CI"],"tags":["tls","keystore","alias","config","startup"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}