{"record":{"id":"f52a148882715aae","repo":"quarkusio/quarkus","slug":"unable-to-verify-alias-alias-in-p12-trust-sto","errorCode":null,"errorMessage":"Unable to verify alias '${alias}' in P12 trust store '${name}'","messagePattern":"Unable to verify alias '(.+?)' in P12 trust store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":148,"sourceCode":"            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static KeyStore loadKeyStore(Vertx vertx, String name, PfxOptions options, String type) {\n        KeyStore ks;\n        try {\n            ks = options.loadKeyStore(vertx);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Unable to load P12 \" + type + \" store '\" + name + \"', verify the password.\", e);\n        }\n        return ks;\n    }\n}\n","sourceCodeStart":130,"sourceCodeEnd":163,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L130-L163","documentation":"Thrown when Quarkus' TLS registry tries to confirm that a specific alias exists inside a P12 (PKCS#12) trust store but the KeyStore API itself fails (KeyStoreException), rather than the alias simply being absent. It wraps the underlying KeyStoreException so the failing named trust store and alias are reported. The store was loaded, but its state cannot be queried.","triggerScenarios":"Calling verifyTrustStoreAlias (via verifyP12TrustStoreStore) on a loaded P12 trust store where ks.getCertificate(alias) throws KeyStoreException — typically because the KeyStore was not loaded/initialized properly or the underlying provider rejects the operation for that store.","commonSituations":"A corrupted or partially-loaded .p12 file, a KeyStore instance created but never load()-ed before alias lookup, or a security provider misconfiguration where the PKCS12 provider cannot handle the store. Also happens when the wrong store type is forced onto a file that is not really PKCS#12.","solutions":["Verify the .p12 file is a valid PKCS#12 keystore: keytool -list -v -keystore truststore.p12 -storetype PKCS12","Check the configured password and file path in quarkus.tls.*.trust-store.p12.* properties so the store loads fully","Confirm the JCE security providers include one supporting PKCS12 (reinstall/upgrade JDK if missing)","Fix the underlying KeyStoreException shown as the cause of this IllegalStateException"],"exampleFix":"// before (application.properties)\nquarkus.tls.my-tls.trust-store.p12.path=certs/store.jks\nquarkus.tls.my-tls.trust-store.p12.password=wrong\n// after\nquarkus.tls.my-tls.trust-store.p12.path=certs/truststore.p12\nquarkus.tls.my-tls.trust-store.p12.password=changeit","handlingStrategy":"validation","validationCode":"KeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (InputStream in = new FileInputStream(p12Path)) {\n    ks.load(in, password.toCharArray());\n}\nif (ks.getCertificate(alias) == null) {\n    throw new IllegalArgumentException(\"Alias missing: \" + alias);\n}","typeGuard":"boolean aliasExists(KeyStore ks, String alias) {\n    try { return ks.getCertificate(alias) != null; }\n    catch (KeyStoreException e) { return false; }\n}","tryCatchPattern":"try {\n    TlsConfiguration.from(registry, Optional.of(name));\n} catch (IllegalStateException e) {\n    if (e.getMessage().startsWith(\"Unable to verify alias\")) {\n        // inspect cause KeyStoreException, validate store\n    }\n}","preventionTips":["Pre-validate the .p12 with keytool -list before configuring it","Use PKCS12 store type explicitly and a modern JDK","Keep the cause KeyStoreException in logs to distinguish load vs query failures"],"tags":["tls","keystore","p12","trust-store"],"backgroundTag":"keystore-alias-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}