quarkusio/quarkus · error · java.lang.IllegalStateException

Alias '${alias}' not found in key store (private key not fou

Error message

Alias '${alias}' not found in key store (private key not found) '${name}'

What it means

The key store contains an entry under the configured alias, but it does not hold a private key (KeyStore.getKey returned null) — typically the alias only references a certificate/trust entry. The TLS registry requires a key entry for a key store used for server/client authentication.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:155

    }

    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,
            String aliasPassword) {
        if (config.alias().isPresent()) {
            String alias = config.alias().get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in key store (certificate not found) '" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in key store '" + name + "'", e);
            }

            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;
            try {
                if (ks.getKey(alias, ap) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in key store (private key not found) '" + name + "'");
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {
        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in trust store (certificate not found) '" + name + "'");

View on GitHub (pinned to e1c734241f)

Solutions

Pick the alias of the entry containing the private key: keytool -list -keystore <file> shows 'PrivateKeyEntry' vs 'trustedCertEntry'
If the file only has trusted certs, generate/import a proper key pair entry (keytool -genkeypair) and point the config at it
Swap the config: this file may belong under trust-store, not key-store
Correct the alias property to the PrivateKeyEntry name

Example fix

// before: alias points to a trustedCertEntry
quarkus.tls.my-tls.key-store.alias=ca-cert
// after: alias of the PrivateKeyEntry
quarkus.tls.my-tls.key-store.alias=server

Defensive patterns

Strategy: validation

Validate before calling

KeyStore ks = /* load keystore */;
String alias = configAlias;
if (ks.isCertificateEntry(alias)) {
    throw new IllegalArgumentException("Alias '" + alias + "' is a trustedCertEntry, not a PrivateKeyEntry");
}
if (!ks.isKeyEntry(alias)) {
    throw new IllegalArgumentException("Alias '" + alias + "' does not hold a private key");
}

Prevention

Check keytool -list output for 'PrivateKeyEntry' before choosing the alias
Never point key-store config at a trust-store file
Name key entries consistently (e.g. 'server') across regenerated keystores
Separate key stores and trust stores into distinct files to avoid alias confusion

When it happens

Trigger: Configuring an alias that points to a certificate-only entry (e.g. a trusted cert or CA cert imported into the key store) in quarkus.tls.<name>.key-store.alias; verifyKeyStoreAlias calls ks.getKey(alias, ap) and gets null.

Common situations: Pointing the key-store alias at an entry in a file that is actually a trust store; generating a keystore where the cert was imported with keytool -importcert instead of -genkeypair; wrong alias chosen among several entries.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2816615571ab49a9. Report an issue: GitHub.