{"record":{"id":"47e17384e12b7ddd","repo":"elastic/elasticsearch","slug":"error-parsing-private-key-file-is-empty","errorCode":null,"errorMessage":"Error parsing Private Key [{}], file is empty","messagePattern":"Error parsing Private Key \\[(.+?)\\], file is empty","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":136,"sourceCode":"        }\n    }\n\n    /**\n     * Creates a {@link PrivateKey} from the contents of a file. Supports PKCS#1, PKCS#8\n     * encoded formats of encrypted and plaintext RSA, DSA and EC(secp256r1) keys\n     *\n     * @param keyPath           the path for the key file\n     * @param passwordSupplier A password supplier for the potentially encrypted (password protected) key\n     * @return a private key from the contents of the file\n     */\n    static PrivateKey parsePrivateKey(Path keyPath, Supplier<char[]> passwordSupplier) throws IOException, GeneralSecurityException {\n        try (BufferedReader bReader = Files.newBufferedReader(keyPath, StandardCharsets.UTF_8)) {\n            String line = bReader.readLine();\n            while (null != line && line.startsWith(HEADER) == false) {\n                line = bReader.readLine();\n            }\n            if (null == line) {\n                throw new SslConfigException(\"Error parsing Private Key [\" + keyPath.toAbsolutePath() + \"], file is empty\");\n            }\n            if (PKCS8_ENCRYPTED_HEADER.equals(line.trim())) {\n                char[] password = passwordSupplier.get();\n                if (password == null) {\n                    throw new SslConfigException(\"cannot read encrypted key [\" + keyPath.toAbsolutePath() + \"] without a password\");\n                }\n                return parsePKCS8Encrypted(bReader, password);\n            } else if (PKCS8_HEADER.equals(line.trim())) {\n                return parsePKCS8(bReader);\n            } else if (PKCS1_HEADER.equals(line.trim())) {\n                return parsePKCS1Rsa(bReader, passwordSupplier);\n            } else if (OPENSSL_DSA_HEADER.equals(line.trim())) {\n                return parseOpenSslDsa(bReader, passwordSupplier);\n            } else if (OPENSSL_DSA_PARAMS_HEADER.equals(line.trim())) {\n                return parseOpenSslDsa(removeDsaHeaders(bReader), passwordSupplier);\n            } else if (OPENSSL_EC_HEADER.equals(line.trim())) {\n                return parseOpenSslEC(bReader, passwordSupplier);\n            } else if (OPENSSL_EC_PARAMS_HEADER.equals(line.trim())) {","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L118-L154","documentation":"Thrown by PemUtils.parsePrivateKey() when the file contains no line starting with `-----BEGIN` after scanning to end of file. This is the 'no PEM content detected' error: either the file is genuinely empty, or it contains text but no PEM header at all.","triggerScenarios":"parsePrivateKey reads the file line by line until it finds one that starts with `-----BEGIN`. If `line` becomes null (EOF) before any such line is found, the exception fires. Typical for a 0-byte file, a file containing only whitespace/comments, or a file that is actually a binary DER mislabelled as PEM.","commonSituations":"Empty file created by mistake (touch without content), file overwritten by an error message (e.g. `404 not found` saved as key.pem), binary DER fed where PEM is expected, or a misconfigured path that points to `/dev/null` or an unrelated file.","solutions":["Check the file is non-empty and starts with a PEM header: `head -1 key.pem`.","If the file is binary DER, convert: `openssl pkey -inform DER -in key.der -outform PEM -out key.pem`.","Re-download or re-export the key if it is empty or contains unexpected content.","Confirm the configured path is correct and the file is readable: `wc -c key.pem && file key.pem`."],"exampleFix":"# before: empty or wrong-content file\n$ cat key.pem\n(empty)\n\n# after: regenerate and verify\nopenssl genrsa -out key.pem 2048\nhead -1 key.pem   # -> -----BEGIN RSA PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"public static void requireNonEmptyPem(Path p) throws IOException {\n    if (Files.size(p) == 0) throw new IllegalArgumentException(\"file is empty: \" + p);\n    boolean hasHeader;\n    try (BufferedReader r = Files.newBufferedReader(p, StandardCharsets.UTF_8)) {\n        hasHeader = r.lines().anyMatch(l -> l.startsWith(\"-----BEGIN\"));\n    }\n    if (!hasHeader) throw new IllegalArgumentException(\"no PEM header found in \" + p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always verify the file is non-empty and contains a PEM header before parsing.","Use `file key.pem` and `head -1 key.pem` in deployment scripts.","If the file is binary DER, convert to PEM with openssl."],"tags":["ssl","pem","private-key","elasticsearch","crypto","config"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}