{"record":{"id":"15c2a3673dece77b","repo":"eclipse-vertx/vert.x","slug":"invalid-der-can-t-parse-primitive-entity","errorCode":null,"errorMessage":"Invalid DER: can't parse primitive entity","messagePattern":"Invalid DER: can't parse primitive entity","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":450,"sourceCode":"    }\n\n    public byte[] getValue() {\n      return value;\n    }\n\n    public boolean isConstructed() {\n      return (tag & DerParser.CONSTRUCTED) == DerParser.CONSTRUCTED;\n    }\n\n    /**\n     * For constructed field, return a parser for its content.\n     *\n     * @return A parser for the construct.\n     * @throws VertxException\n     */\n    public DerParser getParser() throws VertxException {\n      if (!isConstructed()) {\n        throw new VertxException(\"Invalid DER: can't parse primitive entity\");\n      }\n\n      return new DerParser(value);\n    }\n\n    /**\n     * Get the value as integer\n     *\n     * @return BigInteger\n     * @throws VertxException\n     */\n    public BigInteger getInteger() throws VertxException {\n      if (type != DerParser.INTEGER) {\n        throw new VertxException(\"Invalid DER: object is not integer\");\n      }\n\n      return new BigInteger(value);\n    }","sourceCodeStart":432,"sourceCodeEnd":468,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L432-L468","documentation":"Thrown by Asn1Object.getParser when the object is a primitive (not constructed) node but the caller asks for a sub-parser over its contents. Constructed types contain nested elements parseable by a sub-parser; primitive types hold only raw bytes. Asking to recurse into a primitive means the DER layout differs from what the key parser expects (e.g. ECPrivateKey's [1] parameters wrapped node absent or the structure is not a key).","triggerScenarios":"Calling getParser() on a primitive ASN.1 object — hit from getPKCS8EncodedKeyAlgorithm, getECKeySpec, or getRSAKeySpec when an intermediate element that should be a constructed SEQUENCE (e.g. PrivateKeyInfo algorithm parameters, or the ECPrivateKey parameters container) is actually primitive.","commonSituations":"Keys whose parameters are stored as raw OCTET STRING instead of constructed structures; wrong key format (PKCS#8 vs SEC1 vs PKCS#1 mixups); hand-rolled or non-conformant key encoders.","solutions":["Confirm the key encoding matches the parser (SEC1 for getECKeySpec, PKCS#1 for getRSAKeySpec, PKCS#8 for getPKCS8EncodedKeyAlgorithm).","Re-export the key with OpenSSL in the standard format (openssl ec / openssl rsa / openssl pkcs8 -topk8 -nocrypt).","Inspect the structure with openssl asn1parse -i to find where a primitive appears where a constructed SEQUENCE is expected.","Regenerate the key with a standards-compliant tool if the encoder is custom."],"exampleFix":"// before\nbyte[] der = Base64.getMimeDecoder().decode(customEncoderOutput);\n// after\nopenssl ec -in key.pem -outform DER -out key.der\nbyte[] der = Files.readAllBytes(Path.of(\"key.der\"));","handlingStrategy":"try-catch","validationCode":"// Inspect structure type first: the key parser expects constructed (0x20-flagged) nodes where it recurses\n// openssl asn1parse -i -inform DER -in key.der shows SEQUENCE vs primitive fields","typeGuard":null,"tryCatchPattern":"try {\n    return PrivateKeyParser.getRSAKeySpec(der);\n} catch (VertxException e) {\n    if (e.getMessage().contains(\"can't parse primitive entity\")) {\n        throw new KeyFormatException(\"Unexpected DER layout — check key encoding (PKCS#1 vs PKCS#8 vs SEC1): \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Pair each PEM header with the correct parser method","Regenerate non-conformant keys with OpenSSL rather than custom encoders","Inspect with openssl asn1parse -i before loading unfamiliar keys"],"tags":["der","asn1","primitive","constructed","key-format"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}