quarkusio/quarkus · error · java.lang.IllegalStateException

Alias '${alias}' not found in P12 key store (certificate not

Error message

Alias '${alias}' not found in P12 key store (certificate not found)'${name}'

What it means

When an alias is configured for a P12 key store, Quarkus verifies that the alias resolves to a certificate. If ks.getCertificate(alias) returns null it throws this IllegalStateException, meaning the requested entry is absent (or is not a certificate entry) in the loaded key store.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:109

                options.setAlias(config.alias().get());
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static void verifyKeyStoreAlias(PfxOptions options, String name,
            KeyStore ks) {
        String alias = options.getAlias();
        String aliasPassword = options.getAliasPassword();
        if (alias != null) {
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            }

            char[] pwd = null;
            if (aliasPassword != null) {
                pwd = aliasPassword.toCharArray();
            }

            try {
                if (ks.getKey(alias, pwd) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (private key not found)'" + name + "'");
                }
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(

View on GitHub (pinned to e1c734241f)

Solutions

List actual aliases: keytool -list -keystore keystore.p12 -storetype PKCS12
Correct quarkus.tls.<name>.key-store.p12.alias to an existing alias
Regenerate the P12 ensuring the expected alias is present
Remove the alias property if you want the first/default entry

Example fix

// before
quarkus.tls.my-cert.key-store.p12.alias=ServerCert
// after (after running keytool -list)
quarkus.tls.my-cert.key-store.p12.alias=servercert

Defensive patterns

Strategy: validation

Validate before calling

KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(Path.of("keystore.p12"))) {
    ks.load(in, storePassword);
}
boolean exists = ks.isCertificateEntry(alias) || ks.getCertificate(alias) != null;
if (!exists) {
    throw new IllegalArgumentException("Alias not in keystore: " + alias);
}

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    if (e.getMessage().contains("not found in P12 key store")) {
        log.error("Alias mismatch; run keytool -list to find valid aliases");
    }
}

Prevention

Run keytool -list and copy aliases verbatim into config
Keep alias names stable when regenerating P12 files (-name flag with openssl)
Avoid case mismatches: PKCS12 aliases are case-insensitive in most tools but copy exactly
Add a CI check that validates configured aliases against the packaged keystores

When it happens

Trigger: verifyP12KeyStore -> verifyKeyStoreAlias with options.getAlias() set, and the loaded P12 KeyStore has no certificate under that alias.

Common situations: Typo in quarkus.tls.<name>.key-store.p12.alias; alias removed when the P12 was regenerated; keystore exported from a tool that named the alias differently (e.g. '1' or lowercase); certificate replaced by a key-only entry.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/12c16af395d1269f. Report an issue: GitHub.