{"record":{"id":"89c9ee10c9a1a96a","repo":"t8y2/dbx","slug":"jks-keystore-contains-no-private-key-entry","errorCode":null,"errorMessage":"JKS keystore contains no private key entry","messagePattern":"JKS keystore contains no private key entry","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/zookeeper_tls.go","lineNumber":169,"sourceCode":"\t\t\t\treturn tls.Certificate{}, getErr\n\t\t\t}\n\t\t\tprivateKey, parseErr := parsePrivateKey(entry.PrivateKey)\n\t\t\tif parseErr != nil {\n\t\t\t\treturn tls.Certificate{}, parseErr\n\t\t\t}\n\t\t\tresult := tls.Certificate{PrivateKey: privateKey}\n\t\t\tfor index, certificate := range entry.CertificateChain {\n\t\t\t\tresult.Certificate = append(result.Certificate, certificate.Content)\n\t\t\t\tif index == 0 {\n\t\t\t\t\tresult.Leaf, _ = x509.ParseCertificate(certificate.Content)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(result.Certificate) == 0 {\n\t\t\t\treturn tls.Certificate{}, errors.New(\"JKS private key entry has no certificate chain\")\n\t\t\t}\n\t\t\treturn result, nil\n\t\t}\n\t\treturn tls.Certificate{}, errors.New(\"JKS keystore contains no private key entry\")\n\tdefault:\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unsupported store type %q\", storeType)\n\t}\n}\n\nfunc normalizedStoreType(storeType, path string) string {\n\tvalue := strings.ToUpper(strings.TrimSpace(storeType))\n\tswitch value {\n\tcase \"P12\", \"PFX\", \"PKCS#12\":\n\t\treturn \"PKCS12\"\n\tcase \"X509\", \"X.509\":\n\t\treturn \"PEM\"\n\tcase \"\":\n\t\tswitch strings.ToLower(filepath.Ext(path)) {\n\t\tcase \".jks\":\n\t\t\treturn \"JKS\"\n\t\tcase \".p12\", \".pfx\", \".pkcs12\":\n\t\t\treturn \"PKCS12\"","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/zookeeper_tls.go#L151-L187","documentation":"loadClientKeyStore looks for a PrivateKeyEntry in a JKS keystore to build the client tls.Certificate. If no private key entry is found at all, it returns this error. The keystore may contain certificates but nothing usable as a client identity for mTLS.","triggerScenarios":"Calling buildTLSConfig/buildZooKeeperTLSConfig with a keystore that contains only TrustedCertEntry certificates (i.e., it is actually a truststore), or an empty/unsupported JKS entry type.","commonSituations":"Swapping truststore and keystore file paths in configuration; exporting a truststore from a server and using it as the client keystore; keystore rebuilt after JVM upgrade losing the key entry; wrong password hiding entries.","solutions":["Swap the config: ensure keystorePath points to the client keystore containing the private key, and truststorePath to the CA store","Recreate the client keystore including the private key: keytool -genkeypair or importkeystore from a PKCS12 bundle containing key+cert","Run keytool -list -v -keystore client.jks and confirm an entry of type PrivateKeyEntry exists","Verify the store password is correct so the key entry is accessible"],"exampleFix":"// before (config)\n// truststorePath: client-keystore.jks  <- wrong file\n// after\n// keystorePath: client-keystore.jks\n// truststorePath: truststore.jks","handlingStrategy":"validation","validationCode":"out, _ := exec.Command(\"keytool\", \"-list\", \"-keystore\", keystorePath,\n    \"-storepass\", password).Output()\nif !strings.Contains(string(out), \"PrivateKeyEntry\") {\n    return fmt.Errorf(\"%s is not a client keystore (no private key)\", keystorePath)\n}","typeGuard":null,"tryCatchPattern":"tlsCert, err := buildTLSConfig(...)\nif err != nil && strings.Contains(err.Error(), \"no private key entry\") {\n    // verify keystore vs truststore config\n}","preventionTips":["Name config fields explicitly: keystorePath vs truststorePath, never a generic storePath","Verify with keytool -list which file holds PrivateKeyEntry before configuring","Keep the private key in a PKCS12/JKS dedicated to the client identity"],"tags":["tls","jks","keystore","private-key","mtls"],"backgroundTag":"keystore-missing-private-key","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}