{"record":{"id":"b326beb0e112688e","repo":"elastic/elasticsearch","slug":"ivalid-der-object-is-not-object-oid","errorCode":null,"errorMessage":"Ivalid DER: object is not object OID","messagePattern":"Ivalid DER: object is not object OID","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":273,"sourceCode":"\n                case Type.UTF8_STRING:\n                    encoding = \"UTF-8\"; //$NON-NLS-1$\n                    break;\n\n                case Type.UNIVERSAL_STRING:\n                    throw new IOException(\"Invalid DER: can't handle UCS-4 string\"); //$NON-NLS-1$\n\n                default:\n                    throw new IOException(\"Invalid DER: object is not a string\"); //$NON-NLS-1$\n            }\n\n            return new String(value, encoding);\n        }\n\n        public String getOid() throws IOException {\n\n            if (type != Type.OBJECT_OID) {\n                throw new IOException(\"Ivalid DER: object is not object OID\");\n            }\n            StringBuilder sb = new StringBuilder(64);\n            switch (value[0] / 40) {\n                case 0 -> sb.append('0');\n                case 1 -> {\n                    sb.append('1');\n                    value[0] -= 40;\n                }\n                default -> {\n                    sb.append('2');\n                    value[0] -= 80;\n                }\n            }\n            int oidPart = 0;\n            for (int i = 0; i < length; i++) {\n                oidPart = (oidPart << 7) + (value[i] & 0x7F);\n                if ((value[i] & 0x80) == 0) {\n                    sb.append('.');","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L255-L291","documentation":"Thrown by Asn1Object.getOid() when the element's type is not Type.OBJECT_OID (0x06). The OID-decoding logic only runs on actual OID elements; calling getOid() on a different type (INTEGER, SEQUENCE, etc.) is rejected. Note the message has a typo ('Ivalid' rather than 'Invalid') preserved for backward compatibility.","triggerScenarios":"getOid() called on a non-OID element. In getKeyAlgorithmIdentifier (line 674) and getEncryptedPrivateKeyInfo (line 419, 426), getOid() is called on elements that should be OIDs — if the DER is misaligned (e.g. a SEQUENCE was read where an OID was expected), this fires.","commonSituations":"Malformed PKCS#8 whose algorithm-identifier sequence lacks the OID at the expected position, a non-PKCS#8 blob fed to getKeyAlgorithmIdentifier, or corruption that shifts alignment.","solutions":["Re-export the key as standard PKCS#8: `openssl pkcs8 -topk8 -in key.pem -out key.pk8.pem`.","Validate the algorithm OID with `openssl asn1parse -inform DER -in key.der`.","Confirm the file is actually PKCS#8 DER (the outer structure is SEQUENCE { version INTEGER, algorithm SEQUENCE { OID, ... }, ... }).","If the OID is correct but unknown, check whether the algorithm (e.g. Ed25519) is supported by this library version."],"exampleFix":"// before: feeding a non-PKCS#8 DER to getKeyAlgorithmIdentifier\nString algo = getKeyAlgorithmIdentifier(rsaPkcs1Bytes); // misaligned -> throws\n\n// after: use the unified PEM entry point that dispatches by header\nPrivateKey pk = PemUtils.parsePrivateKey(keyPath, passwordSupplier);","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"public static boolean isOidElement(DerParser.Asn1Object o) {\n    return o != null && o.getType() == DerParser.Type.OBJECT_OID;\n}\n\n// Usage:\n// if (!isOidElement(elem)) throw new IOException(\"expected OID\");\n// String oid = elem.getOid();","tryCatchPattern":null,"preventionTips":["Check getType() == Type.OBJECT_OID before calling getOid().","Use PKCS#8 keys so the algorithm OID is at the expected position.","Validate the algorithm OID matches a supported algorithm (RSA, DSA, EC)."],"tags":["ssl","der","asn1","keystore","elasticsearch","crypto"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}