{"record":{"id":"851047dcc3df3a60","repo":"quarkusio/quarkus","slug":"unable-to-recover-the-key-for-alias-alias-in-851047","errorCode":null,"errorMessage":"Unable to recover the key for alias '${alias}' in key store '${name}'","messagePattern":"Unable to recover the key for alias '(.+?)' in key store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":161,"sourceCode":"            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (private key not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in trust store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\n                        \"Unable to verify alias '\" + alias + \"' in trust store '\" + name + \"'\", e);\n            }\n        }","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L143-L179","documentation":"The private key under the configured alias exists but cannot be recovered with the provided alias password: KeyStore.getKey threw UnrecoverableKeyException. The registry surfaces this as IllegalArgumentException including the keystore name and alias.","triggerScenarios":"Configured alias-password (or the credential-provider-supplied alias password) does not match the password used to protect that key entry; verifyKeyStoreAlias catches UnrecoverableKeyException.","commonSituations":"Key entry password differs from the key store password and alias-password was not set; stale/rotated credentials; special characters in the password mangled by env-var/property expansion; wrong credential provider chain picking an unrelated secret.","solutions":["Set quarkus.tls.<name>.key-store.alias-password (or the credential provider reference) to the password protecting that specific key entry","If the key entry uses the same password as the store, ensure alias-password is correct or omitted and the store password is right","Re-export/rebuild the key store so the key is protected with a known password: keytool -keypasswd -alias <alias>","Verify the credential provider actually resolves the expected secret (check provider config and secret name)"],"exampleFix":"// before: key entry protected with a different password than the store\nquarkus.tls.my-tls.key-store.p12.password=storepass\n// after\nquarkus.tls.my-tls.key-store.p12.password=storepass\nquarkus.tls.my-tls.key-store.alias-password=keypass","handlingStrategy":"validation","validationCode":"String aliasPassword = resolveAliasPassword(); // from config or provider\ntry {\n    Key k = ks.getKey(alias, aliasPassword == null ? null : aliasPassword.toCharArray());\n} catch (UnrecoverableKeyException e) {\n    throw new IllegalArgumentException(\"Wrong alias-password for alias '\" + alias + \"'\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // init TLS\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Unable to recover the key for alias\")) {\n        log.error(\"Set quarkus.tls.<name>.key-store.alias-password to the key entry password\");\n    }\n    throw e;\n}","preventionTips":["Always set alias-password when key entries are protected with a different password than the store","Use keytool -keypasswd to align key and store passwords and document one password policy","Fetch secrets via credential providers instead of raw env vars to avoid quoting/expansion issues","Rotate passwords in keystore and config together in the same deployment"],"tags":["tls","keystore","password","alias","credentials"],"backgroundTag":"keystore-password-incorrect","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}