{"record":{"id":"620b85ef80aa794d","repo":"elastic/elasticsearch","slug":"malformed-pem-file-dsa-key-header-is-missing","errorCode":null,"errorMessage":"Malformed PEM file, DSA Key header is missing","messagePattern":"Malformed PEM file, DSA Key header is missing","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":209,"sourceCode":"     * Removes the DSA Params Headers that OpenSSL adds to DSA private keys as the information in them\n     * is redundant\n     *\n     * @throws IOException if the EC Parameter footer is missing\n     */\n    private static BufferedReader removeDsaHeaders(BufferedReader bReader) throws IOException {\n        String line = bReader.readLine();\n        while (line != null) {\n            if (OPENSSL_DSA_PARAMS_FOOTER.equals(line.trim())) {\n                break;\n            }\n            line = bReader.readLine();\n        }\n        if (null == line || OPENSSL_DSA_PARAMS_FOOTER.equals(line.trim()) == false) {\n            throw new IOException(\"Malformed PEM file, DSA Parameters footer is missing\");\n        }\n        // Verify that the key starts with the correct header before passing it to parseOpenSslDsa\n        if (OPENSSL_DSA_HEADER.equals(bReader.readLine()) == false) {\n            throw new IOException(\"Malformed PEM file, DSA Key header is missing\");\n        }\n        return bReader;\n    }\n\n    /**\n     * Creates a {@link PrivateKey} from the contents of {@code bReader} that contains an plaintext private key encoded in\n     * PKCS#8\n     *\n     * @param bReader the {@link BufferedReader} containing the key file contents\n     * @return {@link PrivateKey}\n     * @throws IOException              if the file can't be read\n     * @throws GeneralSecurityException if the private key can't be generated from the {@link PKCS8EncodedKeySpec}\n     */\n    private static PrivateKey parsePKCS8(BufferedReader bReader) throws IOException, GeneralSecurityException {\n        StringBuilder sb = new StringBuilder();\n        String line = bReader.readLine();\n        while (line != null) {\n            if (PKCS8_FOOTER.equals(line.trim())) {","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L191-L227","documentation":"Thrown by removeDsaHeaders after locating the DSA PARAMETERS footer: the next line must be '-----BEGIN DSA PRIVATE KEY-----'. If it is null or any other value, the PEM is malformed and parseOpenSslDsa cannot proceed safely. Protects against feeding a mispositioned reader to the DER parser.","triggerScenarios":"A DSA PARAMETERS block whose footer is immediately followed by something other than a DSA PRIVATE KEY block (EOF, an unrelated PEM block, or a renamed header).","commonSituations":"Incorrect concatenation of PEM blocks; copy-paste errors; a parameters-only file mistakenly used as a key file; manual editing that swapped or deleted headers.","solutions":["Inspect the lines following '-----END DSA PARAMETERS-----' and confirm the next line is '-----BEGIN DSA PRIVATE KEY-----'.","Regenerate the DSA key from a fresh parameters file (see error 803).","If you only have parameters, generate the corresponding private key with 'openssl gendsa'."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// For a file starting with DSA PARAMETERS, confirm the next BEGIN line after the footer is the DSA PRIVATE KEY header (mirror of the 802 EC helper).","typeGuard":null,"tryCatchPattern":"try { PemUtils.readPrivateKey(path, passwordSupplier); }\ncatch (IOException e) { if (e.getMessage().contains(\"DSA Key header is missing\")) { /* regenerate */ } else throw e; }","preventionTips":["Do not merge unrelated PEM blocks.","Lint with 'openssl dsa -in <file> -noout' before deploying.","Generate DSA keys with 'openssl gendsa' so parameters and key are consistent."],"tags":["ssl","pem","dsa","config","private-key"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}