{"record":{"id":"88f36c70d347fde3","repo":"quarkusio/quarkus","slug":"unable-to-verify-alias-alias-in-jks-key-store","errorCode":null,"errorMessage":"Unable to verify alias '${alias}' in JKS key store '${name}'","messagePattern":"Unable to verify alias '(.+?)' in JKS key store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":117,"sourceCode":"                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        // Credential provider already called.\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = null;\n            if (aliasPassword != null) {\n                ap = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L99-L135","documentation":"While verifying the configured alias in a JKS key store, KeyStore.getCertificate(alias) threw KeyStoreException (keystore not loaded / not initialized). Quarkus wraps it in this IllegalStateException.","triggerScenarios":"verifyKeyStoreAlias (JKSKeyStores.java:116-117) during verifyJKSKeyStore when the KeyStore instance is in an unusable state — rare, typically indicates an internal loading failure or exotic provider returning an uninitialized keystore.","commonSituations":"Custom SecurityProvider or keystore implementation returning a not-initialized KeyStore; classloading/provider issues in native mode; bugs introduced by wrapping the loaded keystore.","solutions":["Check the cause of the IllegalStateException for the underlying KeyStoreException detail.","Remove custom KeyStore wrapping/providers and retest with the default JKS provider.","Verify the store loads correctly with keytool -list using the same JDK/provider."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"try {\n    KeyStore ks = KeyStore.getInstance(\"JKS\");\n    try (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(keystorePath))) {\n        ks.load(in, storePassword.toCharArray());\n    }\n    ks.getCertificate(alias);\n} catch (java.security.KeyStoreException e) {\n    throw new IllegalStateException(\"Keystore unusable before Quarkus verification: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Unable to verify alias\")) {\n        log.errorf(e.getCause(), \"KeyStoreException while verifying alias %s\", alias);\n    }\n    throw e;\n}","preventionTips":["Avoid custom KeyStore wrappers or exotic providers unless tested.","Test native mode if using custom security providers.","Keep JDK updated and validate keystores with the same JDK used at runtime."],"tags":["tls","jks","keystore","alias","keystoreexception"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}