quarkusio/quarkus · error · java.lang.IllegalArgumentException

Unable to recover the key for alias '${alias}' in P12 key st

Error message

Unable to recover the key for alias '${alias}' in P12 key store '${name}'

What it means

KeyStore.getKey(alias, pwd) threw UnrecoverableKeyException, meaning the private key for the alias exists but could not be recovered with the supplied alias password. Quarkus throws this IllegalArgumentException.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:133

            char[] pwd = null;
            if (aliasPassword != null) {
                pwd = aliasPassword.toCharArray();
            }

            try {
                if (ks.getKey(alias, pwd) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (private key not found)'" + name + "'");
                }
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in P12 key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {
        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 trust store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 trust store '" + name + "'", e);
            }
        }
    }

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.<name>.key-store.p12.alias-password to the correct key entry password
If key and store passwords are identical, align or remove the alias-password override
Fix the credential provider secret for the alias password
Regenerate the P12 with matching key/store passwords (openssl pkcs12 -export default behavior)

Example fix

// before
quarkus.tls.my-cert.key-store.p12.alias-password=oldpass
// after
quarkus.tls.my-cert.key-store.p12.alias-password=keypass123

Defensive patterns

Strategy: validation

Validate before calling

KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(Path.of("keystore.p12"))) {
    ks.load(in, storePassword);
}
ks.getKey(alias, aliasPassword.toCharArray()); // throws UnrecoverableKeyException early if wrong

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Unable to recover the key")) {
        log.error("alias-password does not match the key entry; fix config or credential provider");
    }
}

Prevention

Keep key and store passwords identical to avoid alias-password drift
Rotate alias-password in the credential provider whenever the P12 is regenerated
Beware special characters in properties; quote or escape passwords correctly

When it happens

Trigger: verifyP12KeyStore with alias and alias-password configured; the alias-password in quarkus.tls.<name>.key-store.p12.alias-password (or from the credential provider) does not match the key's password in the P12.

Common situations: P12 whose key entry was created with a different password than the store password; stale alias-password after regenerating the keystore; credential provider returning the wrong secret; special characters/misquoted password in properties.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0e4226d45184a32b. Report an issue: GitHub.