quarkusio/quarkus · error · java.lang.IllegalStateException

Alias '${alias}' not found in P12 trust store (certificate n

Error message

Alias '${alias}' not found in P12 trust store (certificate not found)'${name}'

What it means

When a P12 trust store is configured with an alias, Quarkus verifies the alias resolves to a certificate in the loaded trust store. A null result throws this IllegalStateException, meaning the trusted CA entry named by the alias is absent.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:144

                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in P12 key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {
        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 trust store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 trust store '" + name + "'", e);
            }
        }
    }

    private static KeyStore loadKeyStore(Vertx vertx, String name, PfxOptions options, String type) {
        KeyStore ks;
        try {
            ks = options.loadKeyStore(vertx);
        } catch (Exception e) {
            throw new IllegalStateException("Unable to load P12 " + type + " store '" + name + "', verify the password.", e);
        }
        return ks;
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

List aliases: keytool -list -keystore truststore.p12 -storetype PKCS12
Correct quarkus.tls.<name>.trust-store.p12.alias to an existing CA alias
Remove the alias property to trust all entries in the P12
Re-import the CA into the trust store with the expected alias

Example fix

// before
quarkus.tls.my-cert.trust-store.p12.alias=internal-ca-v1
// after
quarkus.tls.my-cert.trust-store.p12.alias=internal-ca

Defensive patterns

Strategy: validation

Validate before calling

KeyStore ts = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(Path.of("truststore.p12"))) {
    ts.load(in, storePassword);
}
if (ts.getCertificate(alias) == null) {
    throw new IllegalArgumentException("Alias not in trust store: " + alias);
}

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    if (e.getMessage().contains("not found in P12 trust store")) {
        log.error("Fix trust-store.p12.alias or drop it to trust all entries");
    }
}

Prevention

Verify trust store aliases with keytool -list after every trust store update
Omit the alias property when you intend to trust all entries in the P12
Use consistent alias naming conventions across environments

When it happens

Trigger: verifyP12TrustStoreStore -> verifyTrustStoreAlias with quarkus.tls.<name>.trust-store.p12.alias set and no certificate under that alias in the P12.

Common situations: Alias refers to a CA in an old truststore version; typo in alias; trust store rebuilt with different alias naming; copy-pasted alias from key store config.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/512d2d2215d9934e. Report an issue: GitHub.