{"record":{"id":"03178714bf763b2f","repo":"eclipse-vertx/vert.x","slug":"unsupported-algorithm-identifier","errorCode":null,"errorMessage":"Unsupported algorithm identifier","messagePattern":"Unsupported algorithm identifier","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":116,"sourceCode":"    parser = sequence.getParser();\n    BigInteger version = parser.read().getInteger();\n    if (version.intValue() != 0) {\n        throw new VertxException(\"Unsupported version, expected 0 but found \" + version.intValue());\n    }\n\n    sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n        throw new VertxException(\"Invalid PKCS8 encoding: could not read Algorithm Identifier\");\n    }\n\n    parser = sequence.getParser();\n    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();\n    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"RSA\";\n    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"EC\";\n    } else {\n        throw new VertxException(\"Unsupported algorithm identifier\");\n    }\n  }\n\n  /**\n   * Converts a DER encoded ECPrivateKey into a Java ECPrivateKeySpec.\n   * <p>\n   * <a href=\"https://datatracker.ietf.org/doc/html/rfc5915#section-3\">\n   * RFC 5915</a> defines the following ASN.1 syntax for an EC private key:\n   * </p>\n   * <pre>\n   * ECPrivateKey ::= SEQUENCE {\n   *   version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),\n   *   privateKey     OCTET STRING,\n   *   parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,\n   *   publicKey  [1] BIT STRING OPTIONAL\n   * }\n   * </pre>\n   * <p>","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L98-L134","documentation":"Thrown by PrivateKeyParser.getPKCS8EncodedKeyAlgorithm when the AlgorithmIdentifier OID inside a PKCS#8 private key does not match the RSA or EC public key OIDs the parser knows. Vert.x only supports those two algorithms when converting PEM 'BEGIN PRIVATE KEY' blocks to PKCS#8 key specs. Any other algorithm (e.g. Ed25519, DSA) is rejected with this VertxException.","triggerScenarios":"Loading a PEM key whose PKCS#8 AlgorithmIdentifier OID is neither 1.2.840.113549.1.1.1 (RSA) nor 1.2.840.10045.2.1 (EC); calling getPKCS8EncodedKeyAlgorithm on a DER buffer for an EdDSA, DSA, or X25519 key.","commonSituations":"Deploying an Ed25519 or DSA certificate key in a Vert.x keyStore/pemKeyCertOptions config; keys generated by tools that default to modern algorithms (e.g. ssh-keygen, OpenSSL with ed25519) while the app expects RSA/EC.","solutions":["Regenerate the key as RSA or EC (e.g. openssl genpkey -algorithm RSA or openssl ecparam -genkey).","Convert/confirm the key is PKCS#8 PEM (BEGIN PRIVATE KEY, not BEGIN RSA PRIVATE KEY) using openssl pkcs8 -topk8.","If a non-RSA/EC algorithm is required, load the key outside this parser (e.g. java.security specs) instead of Vert.x pem options.","Verify the PEM was not double-encoded/corrupted so the OID bytes are intact."],"exampleFix":"// before\nopenssl genpkey -algorithm ed25519 -out key.pem\n// after\nopenssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem\nopenssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem","handlingStrategy":"validation","validationCode":"// Check the PKCS#8 algorithm OID before parsing\n// RSA OID: 06 09 2A 86 48 86 F7 0D 01 01 01 ; EC OID: 06 07 2A 86 48 CE 3D 02 01\nbyte[] der = Base64.getMimeDecoder().decode(pemBody);\nif (!startsWithRsaOid(der) && !startsWithEcOid(der)) {\n    throw new IllegalArgumentException(\"Key algorithm must be RSA or EC\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);\n} catch (VertxException e) {\n    if (e.getMessage().contains(\"Unsupported algorithm identifier\")) {\n        throw new KeyLoadException(\"Only RSA and EC keys are supported; got: \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Generate keys only as RSA or EC in OpenSSL config","Document the RSA/EC-only restriction wherever pemKeyCertOptions is configured","Validate key algorithm at startup with openssl pkey -in key.pem -noout -text before deploy"],"tags":["pem","private-key","der","unsupported-algorithm","tls"],"backgroundTag":"unsupported-operation","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}