{"record":{"id":"e8c354555593368b","repo":"quarkusio/quarkus","slug":"alias-alias-not-found-in-trust-store-certifi","errorCode":null,"errorMessage":"Alias '${alias}' not found in trust store (certificate not found) '${name}'","messagePattern":"Alias '(.+?)' not found in trust store \\(certificate not found\\) '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":172,"sourceCode":"                if (ks.getKey(alias, ap) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in key store (private key not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in trust store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\n                        \"Unable to verify alias '\" + alias + \"' in trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n}\n","sourceCodeStart":154,"sourceCodeEnd":182,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L154-L182","documentation":"The TLS registry verifies that the alias configured for a trust store exists and contains a certificate. This error means the trust store loaded, but KeyStore.getCertificate(alias) returned null — no certificate under that alias. Fails fast at startup instead of failing during TLS trust evaluation.","triggerScenarios":"Setting quarkus.tls.<name>.trust-store.alias (or per-trust-store alias) to a name not present in the trust store file; verifyTrustStoreAlias finds no certificate for it.","commonSituations":"Typo in alias; trust store regenerated with different alias names; copying trust-store config from a project using a different CA bundle; case or whitespace differences in the alias string.","solutions":["List aliases with keytool -list -keystore <truststore> and use an existing alias","Remove the alias property to trust all certificates in the trust store","Re-import the CA certificate under the expected alias: keytool -importcert -alias <alias>","Confirm the trust-store path points at the intended file"],"exampleFix":"// before\nquarkus.tls.my-tls.trust-store.p12.alias=my-ca\n// after (alias from keytool -list)\nquarkus.tls.my-tls.trust-store.p12.alias=internal-root-ca","handlingStrategy":"validation","validationCode":"KeyStore ts = /* load trust store */;\nString alias = configAlias;\nif (alias != null && ts.getCertificate(alias) == null) {\n    throw new IllegalArgumentException(\"Trust store missing cert alias '\" + alias + \"'\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["List trust store aliases with keytool -list before configuring alias","Prefer omitting the alias to trust the entire store unless you need restriction","Keep CA import scripts declarative so aliases are reproducible","Validate trust store config in integration tests"],"tags":["tls","truststore","alias","ca","config"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}