{"record":{"id":"001147f70f200ecd","repo":"elastic/elasticsearch","slug":"error-parsing-key-algorithm-identifier-algorithm","errorCode":null,"errorMessage":"Error parsing key algorithm identifier. Algorithm with OID [{}] is not supported","messagePattern":"Error parsing key algorithm identifier\\. Algorithm with OID \\[(.+?)\\] is not supported","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":679,"sourceCode":"     *\n     * @param keyBytes the private key raw bytes\n     * @return A string identifier for the key algorithm (RSA, DSA, or EC)\n     * @throws GeneralSecurityException if the algorithm oid that is parsed from ASN.1 is unknown\n     * @throws IOException if the DER encoded key can't be parsed\n     */\n    private static String getKeyAlgorithmIdentifier(byte[] keyBytes) throws IOException, GeneralSecurityException {\n        DerParser parser = new DerParser(keyBytes);\n        DerParser.Asn1Object sequence = parser.readAsn1Object();\n        parser = sequence.getParser();\n        parser.readAsn1Object().getInteger(); // version\n        DerParser.Asn1Object algSequence = parser.readAsn1Object();\n        parser = algSequence.getParser();\n        String oidString = parser.readAsn1Object().getOid();\n        return switch (oidString) {\n            case \"1.2.840.10040.4.1\" -> \"DSA\";\n            case \"1.2.840.113549.1.1.1\" -> \"RSA\";\n            case \"1.2.840.10045.2.1\" -> \"EC\";\n            default -> throw new GeneralSecurityException(\n                \"Error parsing key algorithm identifier. Algorithm with OID [\" + oidString + \"] is not supported\"\n            );\n        };\n    }\n\n    public static List<Certificate> readCertificates(Collection<Path> certPaths) throws CertificateException, IOException {\n        CertificateFactory certFactory = CertificateFactory.getInstance(\"X.509\");\n        List<Certificate> certificates = new ArrayList<>(certPaths.size());\n        for (Path path : certPaths) {\n            try (InputStream input = Files.newInputStream(path)) {\n                final Collection<? extends Certificate> parsed = certFactory.generateCertificates(input);\n                if (parsed.isEmpty()) {\n                    throw new SslConfigException(\"failed to parse any certificates from [\" + path.toAbsolutePath() + \"]\");\n                }\n                certificates.addAll(parsed);\n            }\n        }\n        return certificates;","sourceCodeStart":661,"sourceCodeEnd":697,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L661-L697","documentation":"Thrown by getKeyAlgorithmIdentifier when the OID embedded in the DER-encoded PKCS#8 private key info is not one of the three recognised algorithm OIDs: DSA (1.2.840.10040.4.1), RSA (1.2.840.113549.1.1.1), or EC (1.2.840.10045.2.1). It is a GeneralSecurityException and surfaces from parsePKCS8PemString and the encrypted PKCS#8 path.","triggerScenarios":"Loading a PKCS#8 key whose algorithm OID is for an unsupported algorithm (e.g. Ed25519 1.3.101.112, Ed448, X25519, DH, or a proprietary algorithm); a corrupted DER body where the algorithm OID bytes were altered; a key produced by a tool that emits an OID this parser does not whitelist.","commonSituations":"Operators switching to modern elliptic-curve keys (Ed25519/Ed448) which are not supported by this PEM parser; keys produced by recent OpenSSL ('openssl genpkey -algorithm Ed25519'); keys from cloud KMS exports; DER corruption from a bad transfer.","solutions":["Regenerate the key using a supported algorithm: RSA ('openssl genrsa'), ECDSA P-256 ('openssl ecparam -genkey -name prime256v1'), or DSA.","If you need Ed25519/Ed448, configure the JVM/security provider accordingly and confirm Elasticsearch supports that key type in your version, or use RSA/EC instead.","Verify the DER body is intact (checksums) before re-parsing."],"exampleFix":"// before: generate an Ed25519 key (unsupported OID)\n//   openssl genpkey -algorithm Ed25519 -out ed.key\n// after: generate an EC P-256 key (supported OID)\nopenssl ecparam -genkey -name prime256v1 -out ec.key","handlingStrategy":"validation","validationCode":"// Use OpenSSL to inspect the key algorithm before loading; supported OIDs are 1.2.840.10040.4.1 (DSA), 1.2.840.113549.1.1.1 (RSA), 1.2.840.10045.2.1 (EC).\n// Shell check: openssl pkey -in <file> -noout -text and inspect the algorithm line; reject Ed25519/Ed448/X25519/DH.","typeGuard":null,"tryCatchPattern":"try { PemUtils.readPrivateKey(path, passwordSupplier); }\ncatch (GeneralSecurityException e) { if (e.getMessage().contains(\"Algorithm with OID\")) { /* switch to RSA/EC/DSA */ } else throw e; }","preventionTips":["Standardise on RSA-2048 or ECDSA P-256 for SSL keys.","Avoid Ed25519/Ed448 keys unless you have confirmed the runtime supports them.","Lint keys with 'openssl pkey -in <file> -noout -text' before deploying."],"tags":["ssl","pem","pkcs8","algorithm","oid","crypto"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}