t8y2/dbx · error

JKS private key entry has no certificate chain

Error message

JKS private key entry has no certificate chain

What it means

loadClientKeyStore parses a JKS keystore to build a tls.Certificate for ZooKeeper client auth. It found a private key entry whose associated certificate chain is empty, so it cannot return a usable client certificate pair and aborts with this error.

Source

Thrown at agents/drivers/hive-go/zookeeper_tls.go:165

				continue
			}
			entry, getErr := store.GetPrivateKeyEntry(alias, passwordBytes)
			if getErr != nil {
				return tls.Certificate{}, getErr
			}
			privateKey, parseErr := parsePrivateKey(entry.PrivateKey)
			if parseErr != nil {
				return tls.Certificate{}, parseErr
			}
			result := tls.Certificate{PrivateKey: privateKey}
			for index, certificate := range entry.CertificateChain {
				result.Certificate = append(result.Certificate, certificate.Content)
				if index == 0 {
					result.Leaf, _ = x509.ParseCertificate(certificate.Content)
				}
			}
			if len(result.Certificate) == 0 {
				return tls.Certificate{}, errors.New("JKS private key entry has no certificate chain")
			}
			return result, nil
		}
		return tls.Certificate{}, errors.New("JKS keystore contains no private key entry")
	default:
		return tls.Certificate{}, fmt.Errorf("unsupported store type %q", storeType)
	}
}

func normalizedStoreType(storeType, path string) string {
	value := strings.ToUpper(strings.TrimSpace(storeType))
	switch value {
	case "P12", "PFX", "PKCS#12":
		return "PKCS12"
	case "X509", "X.509":
		return "PEM"
	case "":
		switch strings.ToLower(filepath.Ext(path)) {

View on GitHub (pinned to c0390bff16)

Solutions

  1. Regenerate the JKS keystore by importing the certificate chain together with the private key (e.g. via a PKCS12 bundle: openssl pkcs12 -export then keytool -importkeystore).
  2. Verify the keystore entry with 'keytool -list -v -keystore file.jks' and confirm the PrivateKeyEntry shows a Certificate chain length > 0.
  3. Re-import the certificate into the existing alias with 'keytool -importcert' if the key was created via keytool -genkeypair and the CSR reply was never imported.

Example fix

// before (shell)
keytool -genkeypair -alias client -keystore client.jks
# CSR never imported -> entry has no cert chain
// after (shell)
keytool -genkeypair -alias client -keystore client.jks
keytool -certreq ... && keytool -importcert -file signed.crt -alias client -keystore client.jks
Defensive patterns

Strategy: validation

Validate before calling

func jksHasCertChain(path string) error {
	f, err := os.Open(path); if err != nil { return err }
	defer f.Close()
	ks := jks.New(sha1.New)
	if err := ks.Parse(f, nil); err != nil { return err }
	for _, e := range ks.PrivateKeys {
		if len(e.CertChain) > 0 { return nil }
	}
	return errors.New("jks has no private key with certificate chain")
}

Type guard

func hasCertChain(c tls.Certificate) bool { return len(c.Certificate) > 0 && c.Leaf != nil }

Try / catch

cert, err := loadClientKeyStore(path, pass)
if err != nil {
	if strings.Contains(err.Error(), "no certificate chain") {
		return fmt.Errorf("keystore %s: private key entry lacks cert chain; re-import cert via keytool", path)
	}
	return err
}

Prevention

When it happens

Trigger: A JKS keystore is loaded where the private key alias has no certificates attached — typically a keystore generated or imported incorrectly (key imported without its certificate chain, or certificates stripped by a conversion tool).

Common situations: Converting PEM to JKS with keytool without importing the certificate; using a '-keypair' entry created by tools that omit the chain; corrupted or hand-edited keystore files.

Understand the failure class

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/e2567c6debbdfb06. Report an issue: GitHub.