{"record":{"id":"6afba75d32260c91","repo":"elastic/elasticsearch","slug":"malformed-pem-file-ec-parameters-footer-is-missin","errorCode":null,"errorMessage":"Malformed PEM file, EC Parameters footer is missing","messagePattern":"Malformed PEM file, EC Parameters footer is missing","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":181,"sourceCode":"        }\n    }\n\n    /**\n     * Removes the EC Headers that OpenSSL adds to EC private keys as the information in them\n     * is redundant\n     *\n     * @throws IOException if the EC Parameter footer is missing\n     */\n    private static BufferedReader removeECHeaders(BufferedReader bReader) throws IOException {\n        String line = bReader.readLine();\n        while (line != null) {\n            if (OPENSSL_EC_PARAMS_FOOTER.equals(line.trim())) {\n                break;\n            }\n            line = bReader.readLine();\n        }\n        if (null == line || OPENSSL_EC_PARAMS_FOOTER.equals(line.trim()) == false) {\n            throw new IOException(\"Malformed PEM file, EC Parameters footer is missing\");\n        }\n        // Verify that the key starts with the correct header before passing it to parseOpenSslEC\n        if (OPENSSL_EC_HEADER.equals(bReader.readLine()) == false) {\n            throw new IOException(\"Malformed PEM file, EC Key header is missing\");\n        }\n        return bReader;\n    }\n\n    /**\n     * Removes the DSA Params Headers that OpenSSL adds to DSA private keys as the information in them\n     * is redundant\n     *\n     * @throws IOException if the EC Parameter footer is missing\n     */\n    private static BufferedReader removeDsaHeaders(BufferedReader bReader) throws IOException {\n        String line = bReader.readLine();\n        while (line != null) {\n            if (OPENSSL_DSA_PARAMS_FOOTER.equals(line.trim())) {","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L163-L199","documentation":"Thrown by removeECHeaders, which is invoked when the file begins with '-----BEGIN EC PARAMETERS-----'. The method scans for the matching '-----END EC PARAMETERS-----' line; if EOF is reached without finding it (line == null) or the matched line is not the EC PARAMETERS footer, the PEM is considered truncated or malformed. This guards the OpenSSL EC PARAMETERS block that precedes the actual EC PRIVATE KEY block.","triggerScenarios":"Loading an OpenSSL-generated EC key file that contains '-----BEGIN EC PARAMETERS-----' but is missing or has a corrupted '-----END EC PARAMETERS-----' line; the file was truncated during copy/sync; the footer was renamed by a text editor or sanitiser that stripped 'END' markers.","commonSituations":"Key file truncated by a deployment pipeline (rsync --partial, scp interruption, kubectl configmap size limits); a templating system (Helm, Ansible) that strips trailing lines; manual editing that removed the footer; CRLF/LF mismatch where the trailing whitespace breaks the strict equals check.","solutions":["Open the file and confirm both '-----BEGIN EC PARAMETERS-----' and '-----END EC PARAMETERS-----' lines are present on their own lines with no surrounding text.","Regenerate the key: 'openssl ecparam -genkey -name prime256v1 -out ec-key.pem' and inspect with 'cat ec-key.pem'.","If the file was transferred, re-copy it in binary mode and verify checksums (md5sum/sha256sum) before and after.","Strip any trailing whitespace or BOM: 'sed -i 's/[[:space:]]*$//' ec-key.pem'."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Confirm a file with an EC PARAMETERS header also has its footer before parsing\nstatic boolean hasMatchingFooter(Path p, String begin, String end) throws IOException {\n    String first = null; boolean sawEnd = false;\n    try (BufferedReader r = Files.newBufferedReader(p, StandardCharsets.UTF_8)) {\n        String line;\n        while ((line = r.readLine()) != null) {\n            if (first == null && line.trim().equals(begin)) first = line.trim();\n            if (first != null && line.trim().equals(end)) { sawEnd = true; break; }\n        }\n    }\n    return first != null && sawEnd;\n}","typeGuard":null,"tryCatchPattern":"try {\n    PemUtils.readPrivateKey(path, passwordSupplier);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"EC Parameters footer is missing\")) {\n        // alert: file is truncated; re-issue the key\n    } else throw e;\n}","preventionTips":["Always re-copy PEM files in binary mode and verify checksums (sha256sum) at source and destination.","Add a CI lint step that runs 'openssl ec -in <file> -noout' (or 'openssl pkey') to confirm the key parses.","Avoid templating PEM content through text processors that may strip END lines."],"tags":["ssl","pem","ec","config","private-key"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}