eclipse-vertx/vert.x · error · IllegalArgumentException

KeyStore does not contains a valid entry

Error message

KeyStore does not contains a valid entry

What it means

Initialization failure in TokenManager.init: the resolved keystore contains no usable entry for token signing (no aliases present, or the first entry is not a valid key entry). The message is a sentinel for an empty/invalid keystore; the input at fault is the keystore configured for QUIC address-validation tokens.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/quic/TokenManager.java:100

      if (aliases.hasMoreElements()) {
        entry = keystore.getEntry(aliases.nextElement(), new KeyStore.PasswordProtection(keyStoreOptions.getPassword().toCharArray()));
      }
    } else if (conf instanceof PemKeyCertOptions) {
      PemKeyCertOptions pemKeyCertOptions = (PemKeyCertOptions) conf;
      KeyStoreHelper helper = pemKeyCertOptions.getHelper(vertx);
      KeyStore keystore = helper.store();
      Enumeration<String> aliases = keystore.aliases();
      if (aliases.hasMoreElements()) {
        entry = keystore.getEntry(aliases.nextElement(), new KeyStore.PasswordProtection(KeyStoreHelper.DUMMY_PASSWORD.toCharArray()));
      }
    } else {
      throw new IllegalArgumentException("Invalid configuration");
    }
    if (entry != null) {
      signingAlgorithm = SigningAlgorithm.create(entry);
      length = signingAlgorithm.signer().sign(new byte[0]).length;
    } else {
      throw new IllegalArgumentException("KeyStore does not contains a valid entry");
    }
  }

  public SigningAlgorithm signingAlgorithm() {
    return signingAlgorithm;
  }

  public byte[] generateToken(byte[] payload) {
    ByteBuf out = Unpooled.buffer();
    writeToken(out, Unpooled.copiedBuffer(payload), new InetSocketAddress(NetUtil.LOCALHOST4, 8080));
    return ByteBufUtil.getBytes(out);
  }

  public boolean verify(byte[] token) throws Exception {
    return validateToken(Unpooled.copiedBuffer(token), new InetSocketAddress(NetUtil.LOCALHOST4, 8080)) >= 0;
  }

  private static byte[] basePayload(InetSocketAddress address, ByteBuf dcid) {

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Populate the keystore with at least one valid key entry
2. Verify the keystore password and type configuration

When it happens

Trigger: Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/quic/TokenManager.java:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/94fd2c090736995c. Report an issue: GitHub.