{"record":{"id":"a0b46064eca55b9a","repo":"quarkusio/quarkus","slug":"unable-to-recover-the-key-for-alias-alias-in","errorCode":null,"errorMessage":"Unable to recover the key for alias '${alias}' in JKS key store '${name}'","messagePattern":"Unable to recover the key for alias '(.+?)' in JKS key store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":137,"sourceCode":"\n            char[] ap = null;\n            if (aliasPassword != null) {\n                ap = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS trust store '\" + name + \"'\", e);\n            }\n        }\n    }","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L119-L155","documentation":"KeyStore.getKey(alias, aliasPassword) threw UnrecoverableKeyException — the key exists but could not be recovered, almost always because the alias password is wrong. Quarkus throws IllegalArgumentException with this message.","triggerScenarios":"quarkus.tls.<name>.key-store.jks.alias-password does not match the password the key entry was created with; verifyKeyStoreAlias (JKSKeyStores.java:136-138) during verifyJKSKeyStore.","commonSituations":"Key imported with a per-entry password different from the store password; alias-password property omitted while key was created with a non-default entry password; rotated secrets in Kubernetes; special characters in the password not escaped in properties.","solutions":["Set quarkus.tls.<name>.key-store.jks.alias-password to the exact key entry password (check with keytool -keypasswd history or the import source).","If unknown, reset it: keytool -keypasswd -alias <alias> -keystore keystore.jks, or re-import the key with the store password as entry password.","Use a credential provider or env var expansion for the password instead of hardcoding, avoiding escaping issues."],"exampleFix":"// before\nquarkus.tls.my-cert.key-store.jks.password=storepass\n# alias-password missing but key entry password is 'keypass'\n// after\nquarkus.tls.my-cert.key-store.jks.password=storepass\nquarkus.tls.my-cert.key-store.jks.alias-password=keypass","handlingStrategy":"validation","validationCode":"boolean keyRecoverable;\ntry {\n    KeyStore ks = KeyStore.getInstance(\"JKS\");\n    try (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(keystorePath))) {\n        ks.load(in, storePassword.toCharArray());\n    }\n    keyRecoverable = ks.getKey(alias, aliasPassword.toCharArray()) != null;\n} catch (java.security.UnrecoverableKeyException e) {\n    throw new IllegalStateException(\"Wrong alias-password for \" + alias, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Unable to recover the key\")) {\n        log.errorf(\"Wrong quarkus.tls.<name>.key-store.jks.alias-password for alias %s\", alias);\n    }\n    throw e;\n}","preventionTips":["Store key entry password in a secret/env var and inject it, not inline.","After re-importing keys, always re-test with the new entry password.","Keep entry password == store password unless policy requires otherwise.","Rotate secrets in coordination with keystore regeneration."],"tags":["tls","jks","keystore","alias-password","unrecoverable-key"],"backgroundTag":"keystore-password-incorrect","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}