{"record":{"id":"e2567c6debbdfb06","repo":"t8y2/dbx","slug":"jks-private-key-entry-has-no-certificate-chain-e2567c","errorCode":null,"errorMessage":"JKS private key entry has no certificate chain","messagePattern":"JKS private key entry has no certificate chain","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_tls.go","lineNumber":165,"sourceCode":"\t\t\t\tcontinue\n\t\t\t}\n\t\t\tentry, getErr := store.GetPrivateKeyEntry(alias, passwordBytes)\n\t\t\tif getErr != nil {\n\t\t\t\treturn tls.Certificate{}, getErr\n\t\t\t}\n\t\t\tprivateKey, parseErr := parsePrivateKey(entry.PrivateKey)\n\t\t\tif parseErr != nil {\n\t\t\t\treturn tls.Certificate{}, parseErr\n\t\t\t}\n\t\t\tresult := tls.Certificate{PrivateKey: privateKey}\n\t\t\tfor index, certificate := range entry.CertificateChain {\n\t\t\t\tresult.Certificate = append(result.Certificate, certificate.Content)\n\t\t\t\tif index == 0 {\n\t\t\t\t\tresult.Leaf, _ = x509.ParseCertificate(certificate.Content)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif len(result.Certificate) == 0 {\n\t\t\t\treturn tls.Certificate{}, errors.New(\"JKS private key entry has no certificate chain\")\n\t\t\t}\n\t\t\treturn result, nil\n\t\t}\n\t\treturn tls.Certificate{}, errors.New(\"JKS keystore contains no private key entry\")\n\tdefault:\n\t\treturn tls.Certificate{}, fmt.Errorf(\"unsupported store type %q\", storeType)\n\t}\n}\n\nfunc normalizedStoreType(storeType, path string) string {\n\tvalue := strings.ToUpper(strings.TrimSpace(storeType))\n\tswitch value {\n\tcase \"P12\", \"PFX\", \"PKCS#12\":\n\t\treturn \"PKCS12\"\n\tcase \"X509\", \"X.509\":\n\t\treturn \"PEM\"\n\tcase \"\":\n\t\tswitch strings.ToLower(filepath.Ext(path)) {","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_tls.go#L147-L183","documentation":"loadClientKeyStore parses a JKS keystore to build a tls.Certificate for ZooKeeper client auth. It found a private key entry whose associated certificate chain is empty, so it cannot return a usable client certificate pair and aborts with this error.","triggerScenarios":"A JKS keystore is loaded where the private key alias has no certificates attached — typically a keystore generated or imported incorrectly (key imported without its certificate chain, or certificates stripped by a conversion tool).","commonSituations":"Converting PEM to JKS with keytool without importing the certificate; using a '-keypair' entry created by tools that omit the chain; corrupted or hand-edited keystore files.","solutions":["Regenerate the JKS keystore by importing the certificate chain together with the private key (e.g. via a PKCS12 bundle: openssl pkcs12 -export then keytool -importkeystore).","Verify the keystore entry with 'keytool -list -v -keystore file.jks' and confirm the PrivateKeyEntry shows a Certificate chain length > 0.","Re-import the certificate into the existing alias with 'keytool -importcert' if the key was created via keytool -genkeypair and the CSR reply was never imported."],"exampleFix":"// before (shell)\nkeytool -genkeypair -alias client -keystore client.jks\n# CSR never imported -> entry has no cert chain\n// after (shell)\nkeytool -genkeypair -alias client -keystore client.jks\nkeytool -certreq ... && keytool -importcert -file signed.crt -alias client -keystore client.jks","handlingStrategy":"validation","validationCode":"func jksHasCertChain(path string) error {\n\tf, err := os.Open(path); if err != nil { return err }\n\tdefer f.Close()\n\tks := jks.New(sha1.New)\n\tif err := ks.Parse(f, nil); err != nil { return err }\n\tfor _, e := range ks.PrivateKeys {\n\t\tif len(e.CertChain) > 0 { return nil }\n\t}\n\treturn errors.New(\"jks has no private key with certificate chain\")\n}","typeGuard":"func hasCertChain(c tls.Certificate) bool { return len(c.Certificate) > 0 && c.Leaf != nil }","tryCatchPattern":"cert, err := loadClientKeyStore(path, pass)\nif err != nil {\n\tif strings.Contains(err.Error(), \"no certificate chain\") {\n\t\treturn fmt.Errorf(\"keystore %s: private key entry lacks cert chain; re-import cert via keytool\", path)\n\t}\n\treturn err\n}","preventionTips":["Always import the signed certificate (chain) back into the alias after a CSR workflow.","Verify keystores with 'keytool -list -v' before deployment.","Build keystores from PKCS12 bundles so key and chain travel together."],"tags":["tls","jks","keystore","certificates","zookeeper"],"backgroundTag":"jks-keystore-missing-certificate-chain","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}