{"record":{"id":"915b6cf478144c8d","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-p12-key-store-priva","errorCode":null,"errorMessage":"Alias '${alias}' not found in P12 key store (private key not found)'${name}'","messagePattern":"Alias '(.+?)' not found in P12 key store \\(private key not found\\)'(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":123,"sourceCode":"        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n\n            char[] pwd = null;\n            if (aliasPassword != null) {\n                pwd = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, pwd) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L105-L141","documentation":"For a P12 key store alias, Quarkus checks the private key via ks.getKey(alias, pwd). If it returns null the alias exists but has no private key entry, so TLS serving with that alias cannot work and this IllegalStateException is thrown.","triggerScenarios":"verifyP12KeyStore with alias configured and aliasPassword; the loaded PKCS12 keystore contains no PrivateKeyEntry under the alias (e.g. only a TrustedCertificateEntry).","commonSituations":"Importing a certificate-only P12 as a key store; alias pointing at a CA entry instead of the server key pair; P12 created with only the cert chain and no private key.","solutions":["Export a full P12 including the private key (e.g. keytool -importkeystore or openssl pkcs12 -export with the key)","Point quarkus.tls.<name>.key-store.p12.alias at the alias holding the key pair","Confirm with keytool -list -v that the entry type is PrivateKeyEntry"],"exampleFix":"// before\nopenssl pkcs12 -export -in cert.pem -nokeys -out ks.p12   # no private key\n// after\nopenssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -name server -out ks.p12","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = Files.newInputStream(Path.of(\"keystore.p12\"))) {\n    ks.load(in, storePassword);\n}\nif (!ks.isKeyEntry(alias)) {\n    throw new IllegalArgumentException(\"Alias has no private key: \" + alias);\n}","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"private key not found\")) {\n        log.error(\"P12 lacks a PrivateKeyEntry for the alias; rebuild with the key\");\n    }\n}","preventionTips":["Export P12 with both key and cert (openssl pkcs12 -export -inkey -in)","Never use certificate-only P12s as key stores","Confirm entry type is PrivateKeyEntry with keytool -list -v"],"tags":["quarkus","tls","p12","keystore","private-key"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}