{"record":{"id":"1c461f10c3a12fe3","repo":"elastic/elasticsearch","slug":"invalid-der-size-of-asn-1-object-to-be-parsed-app","errorCode":null,"errorMessage":"Invalid DER: size of ASN.1 object to be parsed appears to be larger than the size of the key file itself.","messagePattern":"Invalid DER: size of ASN\\.1 object to be parsed appears to be larger than the size of the key file itself\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":90,"sourceCode":"        final Asn1Object obj = readAsn1Object();\n        if (obj.type != requiredType) {\n            throw new IllegalStateException(\n                \"Expected ASN.1 object of type 0x\" + Integer.toHexString(requiredType) + \" but was 0x\" + Integer.toHexString(obj.type)\n            );\n        }\n        return obj;\n    }\n\n    public Asn1Object readAsn1Object() throws IOException {\n        int tag = derInputStream.read();\n        if (tag == -1) {\n            throw new IOException(\"Invalid DER: stream too short, missing tag\");\n        }\n        int length = getLength();\n        // getLength() can return any 32 bit integer, so ensure that a corrupted encoding won't\n        // force us into allocating a very large array\n        if (length > maxAsnObjectLength) {\n            throw new IOException(\n                \"Invalid DER: size of ASN.1 object to be parsed appears to be larger than the size of the key file \" + \"itself.\"\n            );\n        }\n        byte[] value = new byte[length];\n        int n = derInputStream.read(value);\n        if (n < length) {\n            throw new IOException(\n                \"Invalid DER: stream too short, missing value. \" + \"Could only read \" + n + \" out of \" + length + \" bytes\"\n            );\n        }\n        return new Asn1Object(tag, length, value);\n\n    }\n\n    /**\n     * Decode the length of the field. Can only support length\n     * encoding up to 4 octets.\n     * <p>","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L72-L108","documentation":"Thrown by DerParser.readAsn1Object() when an ASN.1 TLV's declared length exceeds maxAsnObjectLength (the byte-array size the parser was constructed with). This guards against corrupted or maliciously crafted DER that would otherwise force a huge allocation. It indicates the encoded length is inconsistent with the physical size of the source bytes.","triggerScenarios":"A DerParser is constructed over a byte array (e.g. from PEM-decoded PKCS#1/PKCS#8 DER, or the algorithm-identifier sequence inside an EncryptedPrivateKeyInfo) and readAsn1Object() reads a length octet whose decoded value is greater than the original byte[] length. Common during parseEcDer/parseRsaDer/parseDsaDer/getKeyAlgorithmIdentifier/getEncryptedPrivateKeyInfo when the input is truncated or non-DER.","commonSituations":"Truncated key file (incomplete download or copy/paste), base64 corruption that produces valid but wrong bytes, a DER blob that is actually PEM text or an HTML error page, mismatched key format (feeding PKCS#8 DER where PKCS#1 expected), or a key generated by a tool that emits non-standard DER.","solutions":["Re-export the private key from its source (openssl genrsa/openssl pkcs8) to get a clean, complete file.","Verify the file is binary DER after base64 decoding: compare its size against the expected key length and inspect the first bytes for the expected SEQUENCE tag (0x30).","If the file is PEM, ensure the base64 body is intact (run `openssl pkey -in <file> -check -noout` or `openssl rsa -check`).","Confirm you are not feeding a PEM blob to a code path that already base64-decoded it, or vice versa."],"exampleFix":"// before: feeding a truncated or wrong-format byte[] to DerParser\nbyte[] der = Files.readAllBytes(keyPath); // oops, this is still PEM text\nnew DerParser(der).readAsn1Object();\n\n// after: decode PEM first, then parse DER\nString pem = Files.readString(keyPath);\nString body = pem.replaceAll(\"-----BEGIN.*?-----\", \"\").replaceAll(\"-----END.*?-----\", \"\").replaceAll(\"\\\\s\", \"\");\nbyte[] der = Base64.getDecoder().decode(body);\nnew DerParser(der).readAsn1Object();","handlingStrategy":"validation","validationCode":"// Validate that the byte[] is plausible DER before parsing.\nprivate static void requirePlausibleDer(byte[] der) {\n    if (der == null || der.length < 2) {\n        throw new IllegalArgumentException(\"DER input is null or too short\");\n    }\n    // First byte of a key/alg-identifier DER is almost always a SEQUENCE (0x30)\n    if (der[0] != 0x30) {\n        throw new IllegalArgumentException(\"Expected DER SEQUENCE (0x30) but found 0x\" + Integer.toHexString(der[0] & 0xFF));\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always base64-decode PEM bodies before constructing DerParser; never feed raw PEM text.","Validate file size and first byte before parsing.","Cross-check keys with `openssl pkey -check` before deployment."],"tags":["ssl","der","asn1","keystore","elasticsearch","crypto"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}