quarkusio/quarkus · error · KeyStoreException

No certificate found with alias: <alias>

Error message

No certificate found with alias: <alias>

What it means

GenerateCACommand (quarkus tls generate-ca CLI) reads the local quarkus.keystore.p12 PKCS#12 file with password "quarkus" and fetches the certificate under the well-known alias CaGenerator.KEYSTORE_CERT_ENTRY. If getCertificate returns null the alias is absent and a KeyStoreException is thrown.

Source

Thrown at extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/GenerateCACommand.java:101

    private boolean hasExpired() throws Exception {
        var cert = getCertificateFromPKCS12();
        try {
            cert.checkValidity();
        } catch (Exception e) {
            LOGGER.info("🔥 Certificate has expired. Renewing...");
            return true;
        }
        return false;
    }

    private static X509Certificate getCertificateFromPKCS12()
            throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException {
        try (FileInputStream fis = new FileInputStream(KEYSTORE_FILE)) {
            KeyStore keystore = KeyStore.getInstance("PKCS12");
            keystore.load(fis, "quarkus".toCharArray());
            Certificate cert = keystore.getCertificate(CaGenerator.KEYSTORE_CERT_ENTRY);
            if (cert == null) {
                throw new KeyStoreException("No certificate found with alias: " + CaGenerator.KEYSTORE_CERT_ENTRY);
            }
            return (X509Certificate) cert;
        }
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Delete the existing quarkus.keystore.p12 and rerun the generation command so it is recreated with the correct alias.
2. List aliases (keytool -list -keystore quarkus.keystore.p12 -storepass quarkus) to confirm which entries actually exist.
3. Ensure nothing (editor, antivirus, concurrent build) corrupts the keystore; regenerate after a partial failure.
4. Check you are using the matching Quarkus CLI version whose expected alias matches the keystore contents.

Example fix

// before: stale keystore missing alias
$ quarkus tls generate-ca  // throws: No certificate found with alias: quarkus

// after: regenerate from scratch
$ rm quarkus.keystore.p12
$ quarkus tls generate-ca

// check alias before running dependent commands
KeyStore ks = KeyStore.getInstance("PKCS12");
try (FileInputStream fis = new FileInputStream("quarkus.keystore.p12")) {
  ks.load(fis, "quarkus".toCharArray());
}
if (ks.getCertificate("quarkus") == null) {
  // delete keystore and regenerate
}

try {
  X509Certificate cert = GenerateCACommand.getCertificateFromPKCS12();
} catch (KeyStoreException e) {
  // regenerate: delete quarkus.keystore.p12 and rerun quarkus tls generate-ca
}

When it happens

Trigger: Running the CA generation/cert command when the keystore file exists but lacks the expected alias — e.g. a corrupted, truncated, or manually replaced keystore; a failed prior generate step that created an empty keystore.

Common situations: Interrupted first-run dev services key generation; deleting/regenerating certs by hand; stale keystore from an older Quarkus version with a different alias.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid keystore '" + name + "' - The keystore cannot be con
• Alias '${alias}' not found in P12 key store (certificate not
• Unable to verify alias '${alias}' in P12 key store '${name}'
• Alias '${alias}' not found in P12 key store (private key not
• Unable to recover the key for alias '${alias}' in P12 key st

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/4a4dc9e995b28afa. Report an issue: GitHub.