{"record":{"id":"c80d6eb2525d39d9","repo":"quarkusio/quarkus","slug":"unable-to-verify-alias-alias-in-key-store","errorCode":null,"errorMessage":"Unable to verify alias '${alias}' in key store '${name}'","messagePattern":"Unable to verify alias '(.+?)' in key store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":149,"sourceCode":"            }\n            return KeyStore.getInstance(type);\n        } catch (KeyStoreException | NoSuchProviderException e) {\n            throw new IllegalStateException(\"Unable to create key store of type '\" + type + \"'\"\n                    + (provider.isPresent() ? \" with provider '\" + provider.get() + \"'\" : \"\"), e);\n        }\n    }\n\n    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,\n            String aliasPassword) {\n        if (config.alias().isPresent()) {\n            String alias = config.alias().get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n\n            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;\n            try {\n                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (private key not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L131-L167","documentation":"When verifying a configured key store alias, the TLS registry calls KeyStore.getKey/getCertificate and the JDK threw KeyStoreException or NoSuchAlgorithmException. This wraps that low-level failure so the configuration name and alias are included in the message. It indicates the key store is in an invalid or unloaded/incompatible state rather than a simple missing alias.","triggerScenarios":"KeyStore.getCertificate(alias) or KeyStore.getKey(alias, ap) throwing KeyStoreException (e.g. store not loaded, corrupted provider state) or NoSuchAlgorithmException (key algorithm unavailable) during verifyKeyStoreAlias for a configured alias.","commonSituations":"Keystore produced by a provider not present at runtime (e.g. PKCS11, BouncyCastle-only algorithms); corrupted key store file; JDK lacking the algorithm (e.g. older JDK and modern key algorithms); wrong keystore type configured.","solutions":["Look at the wrapped cause (KeyStoreException/NoSuchAlgorithmException) to identify the real failure","Regenerate the key store with a standard algorithm (e.g. keytool -genkeypair -keyalg RSA) compatible with your JDK","Ensure the key store type/provider matches your environment; add the required security provider if using a custom one","Re-download or re-export the key store if the file is corrupted"],"exampleFix":"// before: keystore generated with an algorithm unavailable in the runtime JDK\nkeytool -genkeypair -keyalg ED25519 -keystore server.p12\n// after: use a widely supported algorithm\nkeytool -genkeypair -keyalg RSA -keysize 2048 -keystore server.p12","handlingStrategy":"try-catch","validationCode":"try {\n    KeyStore ks = KeyStore.getInstance(type);\n    try (InputStream in = new FileInputStream(path)) { ks.load(in, password); }\n} catch (Exception e) {\n    throw new IllegalStateException(\"Keystore \" + path + \" cannot be loaded with provider/algorithm: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // TLS config init\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Unable to verify alias\") && e.getCause() instanceof KeyStoreException) {\n        log.error(\"Keystore state/algorithm problem: \" + e.getCause().getMessage());\n    }\n    throw e;\n}","preventionTips":["Generate keystores with default JDK tooling and common algorithms (RSA/PKCS12)","Pin the security provider requirements in your deployment image","Validate keystore.type matches the actual file format in CI","Test keystore loading in a smoke test with the same JDK as production"],"tags":["tls","keystore","alias","algorithm","startup"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}