{"record":{"id":"fc20725be7d861be","repo":"quarkusio/quarkus","slug":"unable-to-verify-alias-alias-in-trust-store","errorCode":null,"errorMessage":"Unable to verify alias '${alias}' in trust store '${name}'","messagePattern":"Unable to verify alias '(.+?)' in trust store '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":176,"sourceCode":"            } catch (KeyStoreException | NoSuchAlgorithmException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            } catch (UnrecoverableKeyException e) {\n                throw new IllegalArgumentException(\n                        \"Unable to recover the key for alias '\" + alias + \"' in key store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {\n        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in trust store (certificate not found) '\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\n                        \"Unable to verify alias '\" + alias + \"' in trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n}\n","sourceCodeStart":158,"sourceCodeEnd":182,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L158-L182","documentation":"During trust store alias verification, KeyStore.getCertificate(alias) threw KeyStoreException. The registry wraps it with the trust store name and alias. This signals the trust store itself is in a broken/unsupported state, not that the alias is missing.","triggerScenarios":"ks.getCertificate(alias) throwing KeyStoreException while running verifyTrustStoreAlias — e.g. store not properly loaded, corrupted file, or provider/type mismatch.","commonSituations":"Trust store built with a provider unavailable at runtime; corrupted or truncated trust store file; mismatched keystore.type setting; JVM security provider changes (e.g. FIPS mode).","solutions":["Check the wrapped KeyStoreException cause for the root problem","Regenerate or re-export the trust store in a supported format (PKCS12)","Ensure the required security provider is installed/configured","Verify keystore.type matches the actual file format"],"exampleFix":"// before: PEM file referenced as PKCS12\nquarkus.tls.my-tls.trust-store.type=PKCS12\nquarkus.tls.my-tls.trust-store.p12.path=ca.pem\n// after: use the pem trust store config\nquarkus.tls.my-tls.trust-store.pem.a.path=ca.pem","handlingStrategy":"try-catch","validationCode":"try {\n    KeyStore ts = KeyStore.getInstance(type);\n    try (InputStream in = new FileInputStream(path)) { ts.load(in, password); }\n} catch (Exception e) {\n    throw new IllegalStateException(\"Trust store \" + path + \" unreadable/incompatible: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // init TLS\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"in trust store\") && e.getCause() instanceof KeyStoreException) {\n        log.error(\"Trust store broken: \" + e.getCause().getMessage());\n    }\n    throw e;\n}","preventionTips":["Export trust stores in PKCS12 with standard tooling","Match keystore.type to the real file format","Verify trust store files survive packaging/containers intact (checksum them)","Load the trust store once in a startup test"],"tags":["tls","truststore","alias","keystore","startup"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}