quarkusio/quarkus · error · java.lang.IllegalStateException

Unable to verify alias '${alias}' in key store '${name}'

Error message

Unable to verify alias '${alias}' in key store '${name}'

What it means

When verifying a configured key store alias, the TLS registry calls KeyStore.getKey/getCertificate and the JDK threw KeyStoreException or NoSuchAlgorithmException. This wraps that low-level failure so the configuration name and alias are included in the message. It indicates the key store is in an invalid or unloaded/incompatible state rather than a simple missing alias.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:149

            }
            return KeyStore.getInstance(type);
        } catch (KeyStoreException | NoSuchProviderException e) {
            throw new IllegalStateException("Unable to create key store of type '" + type + "'"
                    + (provider.isPresent() ? " with provider '" + provider.get() + "'" : ""), e);
        }
    }

    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,
            String aliasPassword) {
        if (config.alias().isPresent()) {
            String alias = config.alias().get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in key store (certificate not found) '" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in key store '" + name + "'", e);
            }

            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;
            try {
                if (ks.getKey(alias, ap) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in key store (private key not found) '" + name + "'");
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {

View on GitHub (pinned to e1c734241f)

Solutions

  1. Look at the wrapped cause (KeyStoreException/NoSuchAlgorithmException) to identify the real failure
  2. Regenerate the key store with a standard algorithm (e.g. keytool -genkeypair -keyalg RSA) compatible with your JDK
  3. Ensure the key store type/provider matches your environment; add the required security provider if using a custom one
  4. Re-download or re-export the key store if the file is corrupted

Example fix

// before: keystore generated with an algorithm unavailable in the runtime JDK
keytool -genkeypair -keyalg ED25519 -keystore server.p12
// after: use a widely supported algorithm
keytool -genkeypair -keyalg RSA -keysize 2048 -keystore server.p12
Defensive patterns

Strategy: try-catch

Validate before calling

try {
    KeyStore ks = KeyStore.getInstance(type);
    try (InputStream in = new FileInputStream(path)) { ks.load(in, password); }
} catch (Exception e) {
    throw new IllegalStateException("Keystore " + path + " cannot be loaded with provider/algorithm: " + e.getMessage(), e);
}

Try / catch

try {
    // TLS config init
} catch (IllegalStateException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Unable to verify alias") && e.getCause() instanceof KeyStoreException) {
        log.error("Keystore state/algorithm problem: " + e.getCause().getMessage());
    }
    throw e;
}

Prevention

When it happens

Trigger: KeyStore.getCertificate(alias) or KeyStore.getKey(alias, ap) throwing KeyStoreException (e.g. store not loaded, corrupted provider state) or NoSuchAlgorithmException (key algorithm unavailable) during verifyKeyStoreAlias for a configured alias.

Common situations: Keystore produced by a provider not present at runtime (e.g. PKCS11, BouncyCastle-only algorithms); corrupted key store file; JDK lacking the algorithm (e.g. older JDK and modern key algorithms); wrong keystore type configured.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c80d6eb2525d39d9. Report an issue: GitHub.