What causes "Unable to verify alias '${alias}' in P12 key store '${name}'" in quarkusio/quarkus?

Inspect the cause (KeyStoreException message) for the underlying keystore problem

quarkusio/quarkus · error · java.lang.IllegalStateException

Unable to verify alias '${alias}' in P12 key store '${name}'

Error message

Unable to verify alias '${alias}' in P12 key store '${name}'

What it means

While verifying a configured alias in a P12 key store, KeyStore.getCertificate(alias) threw a KeyStoreException (keystore not loaded/operational). Quarkus wraps it in this IllegalStateException — it is an infrastructure failure, not a missing alias.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:113

                    + "' - cannot read the trust store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static void verifyKeyStoreAlias(PfxOptions options, String name,
            KeyStore ks) {
        String alias = options.getAlias();
        String aliasPassword = options.getAliasPassword();
        if (alias != null) {
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            }

            char[] pwd = null;
            if (aliasPassword != null) {
                pwd = aliasPassword.toCharArray();
            }

            try {
                if (ks.getKey(alias, pwd) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (private key not found)'" + name + "'");
                }
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);

View on GitHub (pinned to e1c734241f)

Solutions

Inspect the cause (KeyStoreException message) for the underlying keystore problem
Re-test loading with: keytool -list -keystore file.p12 -storetype PKCS12 to confirm integrity
Verify keystore file is not truncated/corrupted and re-export it
Report/pin JDK or security provider issues if cause points at the PKCS12 provider

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure the keystore loads cleanly with the JDK before app startup
KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = Files.newInputStream(Path.of("keystore.p12"))) {
    ks.load(in, storePassword); // a hard failure here predicts the error
}

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    if (e.getMessage().startsWith("Unable to verify alias")) {
        log.error("Keystore verification failed; cause:", e.getCause());
    }
}

Prevention

Test the P12 with keytool using the same JDK that runs the app
Avoid truncated/corrupted keystores (verify checksums in CI)
Ensure security providers used at build time are also registered at runtime (native image)

When it happens

Trigger: verifyKeyStoreAlias calls ks.getCertificate(alias) and the JDK throws KeyStoreException, typically because the KeyStore instance is in a bad/unloaded state after loading via Vert.x PfxOptions.loadKeyStore.

Common situations: Rare runtime/JDK-level failures loading the PKCS12 keystore, provider problems, or corrupted keystore state after a partial load.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/4b8f627c3bc08ee9. Report an issue: GitHub.