{"record":{"id":"8b32e30d333af17b","repo":"elastic/elasticsearch","slug":"malformed-pem-file-dsa-parameters-footer-is-missi","errorCode":null,"errorMessage":"Malformed PEM file, DSA Parameters footer is missing","messagePattern":"Malformed PEM file, DSA Parameters footer is missing","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":205,"sourceCode":"        return bReader;\n    }\n\n    /**\n     * Removes the DSA Params Headers that OpenSSL adds to DSA private keys as the information in them\n     * is redundant\n     *\n     * @throws IOException if the EC Parameter footer is missing\n     */\n    private static BufferedReader removeDsaHeaders(BufferedReader bReader) throws IOException {\n        String line = bReader.readLine();\n        while (line != null) {\n            if (OPENSSL_DSA_PARAMS_FOOTER.equals(line.trim())) {\n                break;\n            }\n            line = bReader.readLine();\n        }\n        if (null == line || OPENSSL_DSA_PARAMS_FOOTER.equals(line.trim()) == false) {\n            throw new IOException(\"Malformed PEM file, DSA Parameters footer is missing\");\n        }\n        // Verify that the key starts with the correct header before passing it to parseOpenSslDsa\n        if (OPENSSL_DSA_HEADER.equals(bReader.readLine()) == false) {\n            throw new IOException(\"Malformed PEM file, DSA Key header is missing\");\n        }\n        return bReader;\n    }\n\n    /**\n     * Creates a {@link PrivateKey} from the contents of {@code bReader} that contains an plaintext private key encoded in\n     * PKCS#8\n     *\n     * @param bReader the {@link BufferedReader} containing the key file contents\n     * @return {@link PrivateKey}\n     * @throws IOException              if the file can't be read\n     * @throws GeneralSecurityException if the private key can't be generated from the {@link PKCS8EncodedKeySpec}\n     */\n    private static PrivateKey parsePKCS8(BufferedReader bReader) throws IOException, GeneralSecurityException {","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L187-L223","documentation":"Thrown by removeDsaHeaders when the file starts with '-----BEGIN DSA PARAMETERS-----' but the matching '-----END DSA PARAMETERS-----' line is never found (EOF reached) or the matched line is incorrect. Mirrors the EC PARAMETERS check but for DSA keys produced by OpenSSL's 'dsa' tooling.","triggerScenarios":"Loading a PEM that begins with '-----BEGIN DSA PARAMETERS-----' but is truncated before the '-----END DSA PARAMETERS-----' line; the footer was edited or removed; the file is a parameters-only file with no DSA PARAMETERS footer at all.","commonSituations":"DSA parameters file truncated during transfer; footer stripped by a template engine; mismatched BEGIN/END from manual editing; legacy DSA keys generated by very old OpenSSL that omit the footer in some configurations.","solutions":["Verify the file contains both '-----BEGIN DSA PARAMETERS-----' and '-----END DSA PARAMETERS-----' as standalone lines.","Regenerate the DSA key: 'openssl dsaparam -out dsaparam.pem 2048 && openssl gendsa -out dsa-key.pem dsaparam.pem'.","Re-transfer the file in binary mode and confirm checksums."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reuse the matching-footer helper from 801 with begin='-----BEGIN DSA PARAMETERS-----' and end='-----END DSA PARAMETERS-----'.","typeGuard":null,"tryCatchPattern":"try { PemUtils.readPrivateKey(path, passwordSupplier); }\ncatch (IOException e) { if (e.getMessage().contains(\"DSA Parameters footer is missing\")) { /* re-issue key */ } else throw e; }","preventionTips":["Copy PEM files in binary mode and verify checksums.","Lint with 'openssl dsa -in <file> -noout' before deploy.","Avoid text templating that strips END lines."],"tags":["ssl","pem","dsa","config","private-key"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}