t8y2/dbx · error

JKS keystore contains no private key entry

Error message

JKS keystore contains no private key entry

What it means

Returned by loadClientKeyStore in hive-go while building TLS config from a JKS keystore: the keystore parsed successfully but contains no entry of type private key. Only keystore files with a private-key entry (plus its certificate chain) can be used as a client identity for TLS, so certificate construction fails.

Source

Thrown at agents/drivers/hive-go/zookeeper_tls.go:169

				return tls.Certificate{}, getErr
			}
			privateKey, parseErr := parsePrivateKey(entry.PrivateKey)
			if parseErr != nil {
				return tls.Certificate{}, parseErr
			}
			result := tls.Certificate{PrivateKey: privateKey}
			for index, certificate := range entry.CertificateChain {
				result.Certificate = append(result.Certificate, certificate.Content)
				if index == 0 {
					result.Leaf, _ = x509.ParseCertificate(certificate.Content)
				}
			}
			if len(result.Certificate) == 0 {
				return tls.Certificate{}, errors.New("JKS private key entry has no certificate chain")
			}
			return result, nil
		}
		return tls.Certificate{}, errors.New("JKS keystore contains no private key entry")
	default:
		return tls.Certificate{}, fmt.Errorf("unsupported store type %q", storeType)
	}
}

func normalizedStoreType(storeType, path string) string {
	value := strings.ToUpper(strings.TrimSpace(storeType))
	switch value {
	case "P12", "PFX", "PKCS#12":
		return "PKCS12"
	case "X509", "X.509":
		return "PEM"
	case "":
		switch strings.ToLower(filepath.Ext(path)) {
		case ".jks":
			return "JKS"
		case ".p12", ".pfx", ".pkcs12":
			return "PKCS12"

View on GitHub (pinned to c0390bff16)

Solutions

  1. Point the keystore path at a JKS containing a PrivateKeyEntry (verify with 'keytool -list -v'; look for 'PrivateKeyEntry', not 'TrustedCertEntry').
  2. Rebuild the keystore from PEM key + cert via PKCS12: openssl pkcs12 -export -in cert.pem -inkey key.pem | keytool -importkeystore.
  3. Check the keystore password is correct — entries may be unreadable with a wrong password.

Example fix

# before
keyStorePath=/etc/pki/truststore.jks   # contains only CA certs
# after
keyStorePath=/etc/pki/client-key.jks   # contains PrivateKeyEntry
Defensive patterns

Strategy: validation

Validate before calling

func jksHasPrivateKey(path string) error {
	f, err := os.Open(path); if err != nil { return err }
	defer f.Close()
	ks := jks.New(sha1.New)
	if err := ks.Parse(f, nil); err != nil { return err }
	if len(ks.PrivateKeys) == 0 { return errors.New("jks has no PrivateKeyEntry") }
	return nil
}

Type guard

func isPrivateKeyEntry(entry jks.Entry) bool { _, ok := entry.(jks.PrivateKey); return ok }

Try / catch

cert, err := loadClientKeyStore(path, pass)
if err != nil {
	if strings.Contains(err.Error(), "no private key entry") {
		return fmt.Errorf("%s is not a client keystore (no PrivateKeyEntry); check keyStorePath config", path)
	}
	return err
}

Prevention

When it happens

Trigger: The JKS file only contains TrustedCertEntry aliases (no PrivateKeyEntry) — e.g. pointing client_key_store at a truststore or a public-certificate-only keystore.

Common situations: Configuring the client keystore path to the CA truststore by mistake; exporting only certificates when migrating keystores; wrong password causing the private key entry to be skipped.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/53e5ac5d3c73a22c. Report an issue: GitHub.