quarkusio/quarkus · error · java.lang.IllegalStateException

Unable to verify alias '${alias}' in P12 trust store '${name

Error message

Unable to verify alias '${alias}' in P12 trust store '${name}'

What it means

Thrown when Quarkus' TLS registry tries to confirm that a specific alias exists inside a P12 (PKCS#12) trust store but the KeyStore API itself fails (KeyStoreException), rather than the alias simply being absent. It wraps the underlying KeyStoreException so the failing named trust store and alias are reported. The store was loaded, but its state cannot be queried.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:148

            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in P12 key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {
        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 trust store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 trust store '" + name + "'", e);
            }
        }
    }

    private static KeyStore loadKeyStore(Vertx vertx, String name, PfxOptions options, String type) {
        KeyStore ks;
        try {
            ks = options.loadKeyStore(vertx);
        } catch (Exception e) {
            throw new IllegalStateException("Unable to load P12 " + type + " store '" + name + "', verify the password.", e);
        }
        return ks;
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

  1. Verify the .p12 file is a valid PKCS#12 keystore: keytool -list -v -keystore truststore.p12 -storetype PKCS12
  2. Check the configured password and file path in quarkus.tls.*.trust-store.p12.* properties so the store loads fully
  3. Confirm the JCE security providers include one supporting PKCS12 (reinstall/upgrade JDK if missing)
  4. Fix the underlying KeyStoreException shown as the cause of this IllegalStateException

Example fix

// before (application.properties)
quarkus.tls.my-tls.trust-store.p12.path=certs/store.jks
quarkus.tls.my-tls.trust-store.p12.password=wrong
// after
quarkus.tls.my-tls.trust-store.p12.path=certs/truststore.p12
quarkus.tls.my-tls.trust-store.p12.password=changeit
Defensive patterns

Strategy: validation

Validate before calling

KeyStore ks = KeyStore.getInstance("PKCS12");
try (InputStream in = new FileInputStream(p12Path)) {
    ks.load(in, password.toCharArray());
}
if (ks.getCertificate(alias) == null) {
    throw new IllegalArgumentException("Alias missing: " + alias);
}

Type guard

boolean aliasExists(KeyStore ks, String alias) {
    try { return ks.getCertificate(alias) != null; }
    catch (KeyStoreException e) { return false; }
}

Try / catch

try {
    TlsConfiguration.from(registry, Optional.of(name));
} catch (IllegalStateException e) {
    if (e.getMessage().startsWith("Unable to verify alias")) {
        // inspect cause KeyStoreException, validate store
    }
}

Prevention

When it happens

Trigger: Calling verifyTrustStoreAlias (via verifyP12TrustStoreStore) on a loaded P12 trust store where ks.getCertificate(alias) throws KeyStoreException — typically because the KeyStore was not loaded/initialized properly or the underlying provider rejects the operation for that store.

Common situations: A corrupted or partially-loaded .p12 file, a KeyStore instance created but never load()-ed before alias lookup, or a security provider misconfiguration where the PKCS12 provider cannot handle the store. Also happens when the wrong store type is forced onto a file that is not really PKCS#12.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f52a148882715aae. Report an issue: GitHub.