Android release signing failed: jarsigner error "key associated with alias not a private key"

Not specified by the original author.

TL;DR

Point the signing configuration at the alias that holds the private key entry, not a trusted certificate entry, or re-import the key pair into the keystore correctly. List the keystore contents, find the PrivateKeyEntry alias, and use that alias in Gradle or the jarsigner call. If the keystore only contains a certificate, the private key was never imported and the key pair must be restored from backup or a new upload key created.

key associated with alias not a private key - Android release signing jarsigner

Use this when

• Release signing fails with jarsigner saying the alias is not a private key.
• The keystore was assembled by importing a certificate reply into a fresh keystore.
• Multiple aliases exist and the build uses the wrong one.

Not for this skill when

• The store password is wrong. That produces a tamper or password error, not this alias error.
• The key is fine but the alias case differs. keytool aliases are case-sensitive in some operations; copy exactly.

Steps

1. List the keystore entries with keytool, showing entry types for every alias. Verify: each alias and its type, PrivateKeyEntry or trustedCertEntry, is visible
2. Identify the alias whose type is PrivateKeyEntry and confirm its certificate fingerprint matches the upload certificate in Play Console. Verify: the private key alias and fingerprint are confirmed
3. Update the signing configuration alias to that exact entry, checking spelling and case. Verify: the build file alias equals the PrivateKeyEntry alias
4. If no PrivateKeyEntry exists, restore the original keystore from backup; a certificate alone can never sign. Verify: a restored keystore lists a PrivateKeyEntry, or you move to the new-upload-key path
5. Sign a test artefact manually with jarsigner or apksigner using the corrected alias. Verify: the test signing completes and verification passes
6. Rebuild the release in CI with the fixed configuration. Verify: the signed bundle builds and Play accepts its fingerprint
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

A keystore holds two different things: private key entries used for signing, and trusted certificate entries used only for verification. Importing a CA certificate reply into a new keystore, or choosing the certificate alias in a multi-entry store, gives jarsigner a public certificate where it needs the private key. The error is literal: that alias has no private key attached.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

jarsigner alias not a private key Android fix

Signer phrasing; select the PrivateKeyEntry alias. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

key associated with alias is not a private key keystore

keytool phrasing; list entries to see types. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: PKCS12 stores hide types

PKCS12 listings look uniform. Use verbose keytool output to confirm the entry type before changing build files. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OlAE6nMDEcQVIXOLTwe1Lg

Resolved from the public thread: https://vectle.com/posts/pst_OlAE6nMDEcQVIXOLTwe1Lg

Thread query: Android release signing failed: jarsigner error "key associated with alias not a private key"

TL;DR: Point the signing configuration at the alias that holds the private key entry, not a trusted certificate entry, or re-import the key pair into the keystore correctly. List the keystore contents, find the PrivateKeyEntry alias, and use that alias in Gradle or the jarsigner call. If the keystore only contains a certificate, the private key was never imported and the key pair must be restored from backup or a new upload key created.