{"record":{"id":"37b54d4802dba13b","repo":"eclipse-vertx/vert.x","slug":"invalid-pkcs8-encoding-not-a-sequence","errorCode":null,"errorMessage":"Invalid PKCS8 encoding: not a sequence","messagePattern":"Invalid PKCS8 encoding: not a sequence","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":95,"sourceCode":"      throw new VertxException(\"Cannot determine EC parameter spec for curve name/OID\", e);\n    }\n  }\n\n  /**\n   * Gets the algorithm used by a PKCS#8 encoded private key.\n   *\n   * @param encodedKey The encoded private key.\n   * @return The algorithm name, either <em>RSA</em> or <em>EC</em>, depending on\n   *         the algorithm identifier found in the encoded key.\n   * @throws VertxException if the key is not PKCS#8 encoded or uses an unsupported\n   *         algorithm.\n   */\n  public static String getPKCS8EncodedKeyAlgorithm(byte[] encodedKey) {\n\n    DerParser parser = new DerParser(encodedKey);\n    Asn1Object sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n      throw new VertxException(\"Invalid PKCS8 encoding: not a sequence\");\n    }\n\n    parser = sequence.getParser();\n    BigInteger version = parser.read().getInteger();\n    if (version.intValue() != 0) {\n        throw new VertxException(\"Unsupported version, expected 0 but found \" + version.intValue());\n    }\n\n    sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n        throw new VertxException(\"Invalid PKCS8 encoding: could not read Algorithm Identifier\");\n    }\n\n    parser = sequence.getParser();\n    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();\n    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"RSA\";\n    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L77-L113","documentation":"PrivateKeyParser.getPKCS8EncodedKeyAlgorithm expects the encoded key to be a DER SEQUENCE at the top level (PKCS#8 PrivateKeyInfo). If the first ASN.1 object is not a SEQUENCE, it throws VertxException('Invalid PKCS8 encoding: not a sequence'), meaning the bytes are not a PKCS#8 structure.","triggerScenarios":"Passing a PKCS#1 ('BEGIN RSA PRIVATE KEY') key, a raw SEC1 EC key ('BEGIN EC PRIVATE KEY'), a public key, or an encrypted PEM body to getPKCS8EncodedKeyAlgorithm.","commonSituations":"Users hand a legacy 'RSA PRIVATE KEY' file where 'PRIVATE KEY' (PKCS#8) is expected; encrypted keys whose body is not plain DER; truncated/mis-decoded base64.","solutions":["Convert the key to PKCS#8: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem","Ensure the PEM header is '-----BEGIN PRIVATE KEY-----' before calling this parser","Strip encryption/DEK-Info first if the key is encrypted"],"exampleFix":"// before\n// key.pem: -----BEGIN RSA PRIVATE KEY----- (PKCS#1)\nString alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);\n// after\n// $ openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem\n// key8.pem: -----BEGIN PRIVATE KEY----- (PKCS#8)\nString alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);","handlingStrategy":"validation","validationCode":"String pemHeader = Files.readString(pemPath).split(\"\\n\")[0];\nif (!pemHeader.contains(\"BEGIN PRIVATE KEY\")) {\n  throw new IllegalArgumentException(\"expected PKCS#8 PEM ('BEGIN PRIVATE KEY'), got: \" + pemHeader);\n}","typeGuard":null,"tryCatchPattern":"try {\n  alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);\n} catch (VertxException e) {\n  // convert: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem\n}","preventionTips":["Standardize on PKCS#8 ('BEGIN PRIVATE KEY') key files","Convert legacy PKCS#1/SEC1 keys at provisioning time","Decrypt encrypted PEMs before parsing"],"tags":["pkcs8","der","pki"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}