{"record":{"id":"a6e91dba6fc12cf9","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-jks-key-store-certi","errorCode":null,"errorMessage":"Alias '${alias}' not found in JKS key store (certificate not found)'${name}'","messagePattern":"Alias '(.+?)' not found in JKS key store \\(certificate not found\\)'(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":113,"sourceCode":"                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        // Credential provider already called.\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = null;\n            if (aliasPassword != null) {\n                ap = aliasPassword.toCharArray();\n            }\n\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (private key not found)'\" + name + \"'\");\n                }\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L95-L131","documentation":"After loading the JKS key store, Quarkus verifies the configured alias. If KeyStore.getCertificate(alias) returns null, the alias does not exist (or holds no certificate entry), and this IllegalStateException is thrown at startup.","triggerScenarios":"quarkus.tls.<name>.key-store.jks.alias is set to a name that is absent from the JKS file; verification runs in verifyKeyStoreAlias (JKSKeyStores.java:112-114) during verifyJKSKeyStore.","commonSituations":"Alias typo or wrong case (JKS aliases are case-insensitive lowercased, PKCS12 differs); certificate regenerated under a different alias; keystore rotated without updating config; alias exists but only holds a key entry without certificate chain at first check.","solutions":["List the aliases in the JKS: keytool -list -keystore keystore.jks -storepass <password> and use an exact existing alias.","Fix the alias value in quarkus.tls.<name>.key-store.jks.alias.","If the keystore was regenerated, re-export/import the certificate so the expected alias exists."],"exampleFix":"// before\nquarkus.tls.my-cert.key-store.jks.alias=serveer\n// after\nquarkus.tls.my-cert.key-store.jks.alias=server","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (var in = java.nio.file.Files.newInputStream(java.nio.file.Path.of(keystorePath))) {\n    ks.load(in, storePassword.toCharArray());\n}\nboolean ok = ks.getCertificate(alias) != null;","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"not found in JKS key store\")) {\n        log.errorf(\"Alias %s missing; run: keytool -list -keystore keystore.jks\", configuredAlias);\n    }\n    throw e;\n}","preventionTips":["Run keytool -list and copy aliases exactly from its output.","Script keystore regeneration and config updates together.","Add an integration test that starts the app with the real keystore.","Treat aliases as config-managed values, not hand-typed strings."],"tags":["tls","jks","keystore","alias"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}