{"record":{"id":"63531fe43c9ad792","repo":"eclipse-vertx/vert.x","slug":"invalid-der-not-a-sequence","errorCode":null,"errorMessage":"Invalid DER: not a sequence","messagePattern":"Invalid DER: not a sequence","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":154,"sourceCode":"   * contain the Base64 encoded DER-encoding of an ECPrivateKey sandwiched between\n   * <pre>\n   * -----BEGIN EC PRIVATE KEY-----\n   * -----END EC PRIVATE KEY-----\n   * </pre>\n   * as described in <a href=\"https://datatracker.ietf.org/doc/html/rfc5915#section-4\">\n   * RFC 5915, Section 4</a>\n   *\n   * @see \"https://datatracker.ietf.org/doc/html/rfc5915\"\n   * @param keyBytes The encoded key.\n   * @return The spec that can be used to instantiate the private key.\n   * @throws VertxException if the byte array does not represent an ASN.1 ECPrivateKey structure.\n   */\n  public static ECPrivateKeySpec getECKeySpec(byte[] keyBytes) throws VertxException {\n    DerParser parser = new DerParser(keyBytes);\n\n    Asn1Object sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n      throw new VertxException(\"Invalid DER: not a sequence\");\n    }\n\n    // Parse inside the sequence\n    parser = sequence.getParser();\n\n    Asn1Object version = parser.read();\n    if (version.getType() != DerParser.INTEGER) {\n      throw new VertxException(String.format(\n          \"Invalid DER: 'version' field must be of type INTEGER (2) but found type `%d`\",\n          version.getType()));\n    } else if (version.getInteger().intValue() != 1) {\n      throw new VertxException(String.format(\n          \"Invalid DER: expected 'version' field to have value '1' but found '%d'\",\n          version.getInteger().intValue()));\n    }\n    byte[] privateValue = parser.read().getValue();\n    parser = parser.read().getParser();\n    Asn1Object params = parser.read();","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L136-L172","documentation":"Thrown by getECKeySpec when the first DER object of the supplied key bytes is not an ASN.1 SEQUENCE. An RFC 5915 ECPrivateKey is a SEQUENCE at top level, so anything else means the bytes are not a DER EC private key. Usually the input is a malformed, truncated, or wrongly-formatted key blob.","triggerScenarios":"Calling PrivateKeyParser.getECKeySpec with bytes that begin with a non-SEQUENCE ASN.1 tag, e.g. passing a raw SEC1/PKCS#1 body instead of the ECPrivateKey structure, or a corrupted/truncated DER buffer.","commonSituations":"Hand-deriving key bytes from a PEM file and slicing off the header incorrectly; feeding a PKCS#8-wrapped key into the SEC1 parser; copy/paste corruption of base64 key material.","solutions":["Ensure the input is a DER-encoded ECPrivateKey (SEC1/RFC 5915), not PKCS#8; unwrap PKCS#8 first if needed.","Regenerate or re-export the key: openssl ec -in key.pem -outform DER -out key.der.","Validate the DER with openssl asn1parse -inform DER -in key.der before loading.","Check the code path does not pass a certificate or public key where the private key is expected."],"exampleFix":"// before\nbyte[] bytes = pkcs8PemBody.getBytes(); // PKCS#8 wrapper, wrong format\nECPrivateKeySpec spec = PrivateKeyParser.getECKeySpec(bytes);\n// after\nPKCS8EncodedKeySpec pkcs8 = new PKCS8EncodedKeySpec(pkcs8PemBody.getBytes());\nPrivateKey key = KeyFactory.getInstance(\"EC\").generatePrivate(pkcs8);","handlingStrategy":"validation","validationCode":"byte[] der = Base64.getMimeDecoder().decode(pemBody);\n// first byte must be 0x30 (SEQUENCE)\nif (der.length < 2 || der[0] != 0x30) {\n    throw new IllegalArgumentException(\"Not a DER SEQUENCE: expected 0x30 tag, got \" + (der.length > 0 ? der[0] : \"EOF\"));\n}","typeGuard":null,"tryCatchPattern":"try {\n    return PrivateKeyParser.getECKeySpec(der);\n} catch (VertxException e) {\n    throw new IllegalArgumentException(\"Invalid EC private key DER: \" + e.getMessage(), e);\n}","preventionTips":["Convert PEM to DER with openssl ec -outform DER rather than manual slicing","Use Base64.getMimeDecoder() to tolerate line breaks in PEM bodies","Validate with openssl asn1parse before loading"],"tags":["der","asn1","ec","private-key","format"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}