quarkusio/quarkus · error · java.lang.IllegalStateException

Alias '${alias}' not found in P12 key store (private key not

Error message

Alias '${alias}' not found in P12 key store (private key not found)'${name}'

What it means

For a P12 key store alias, Quarkus checks the private key via ks.getKey(alias, pwd). If it returns null the alias exists but has no private key entry, so TLS serving with that alias cannot work and this IllegalStateException is thrown.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:123

        String aliasPassword = options.getAliasPassword();
        if (alias != null) {
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            }

            char[] pwd = null;
            if (aliasPassword != null) {
                pwd = aliasPassword.toCharArray();
            }

            try {
                if (ks.getKey(alias, pwd) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (private key not found)'" + name + "'");
                }
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in P12 key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {
        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();

View on GitHub (pinned to e1c734241f)

Solutions

Export a full P12 including the private key (e.g. keytool -importkeystore or openssl pkcs12 -export with the key)
Point quarkus.tls.<name>.key-store.p12.alias at the alias holding the key pair
Confirm with keytool -list -v that the entry type is PrivateKeyEntry

Example fix

// before
openssl pkcs12 -export -in cert.pem -nokeys -out ks.p12   # no private key
// after
openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -name server -out ks.p12

Defensive patterns

Strategy: validation

Validate before calling

KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(Path.of("keystore.p12"))) {
    ks.load(in, storePassword);
}
if (!ks.isKeyEntry(alias)) {
    throw new IllegalArgumentException("Alias has no private key: " + alias);
}

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    if (e.getMessage().contains("private key not found")) {
        log.error("P12 lacks a PrivateKeyEntry for the alias; rebuild with the key");
    }
}

Prevention

Export P12 with both key and cert (openssl pkcs12 -export -inkey -in)
Never use certificate-only P12s as key stores
Confirm entry type is PrivateKeyEntry with keytool -list -v

When it happens

Trigger: verifyP12KeyStore with alias configured and aliasPassword; the loaded PKCS12 keystore contains no PrivateKeyEntry under the alias (e.g. only a TrustedCertificateEntry).

Common situations: Importing a certificate-only P12 as a key store; alias pointing at a CA entry instead of the server key pair; P12 created with only the cert chain and no private key.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/915b6cf478144c8d. Report an issue: GitHub.