{"record":{"id":"bf6ac3f357be9d2f","repo":"elastic/elasticsearch","slug":"invalid-der-object-is-not-a-string","errorCode":null,"errorMessage":"Invalid DER: object is not a string","messagePattern":"Invalid DER: object is not a string","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":264,"sourceCode":"                case Type.GRAPHIC_STRING:\n                case Type.ISO646_STRING:\n                case Type.GENERAL_STRING:\n                    encoding = \"ISO-8859-1\"; //$NON-NLS-1$\n                    break;\n\n                case Type.BMP_STRING:\n                    encoding = \"UTF-16BE\"; //$NON-NLS-1$\n                    break;\n\n                case Type.UTF8_STRING:\n                    encoding = \"UTF-8\"; //$NON-NLS-1$\n                    break;\n\n                case Type.UNIVERSAL_STRING:\n                    throw new IOException(\"Invalid DER: can't handle UCS-4 string\"); //$NON-NLS-1$\n\n                default:\n                    throw new IOException(\"Invalid DER: object is not a string\"); //$NON-NLS-1$\n            }\n\n            return new String(value, encoding);\n        }\n\n        public String getOid() throws IOException {\n\n            if (type != Type.OBJECT_OID) {\n                throw new IOException(\"Ivalid DER: object is not object OID\");\n            }\n            StringBuilder sb = new StringBuilder(64);\n            switch (value[0] / 40) {\n                case 0 -> sb.append('0');\n                case 1 -> {\n                    sb.append('1');\n                    value[0] -= 40;\n                }\n                default -> {","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L246-L282","documentation":"Thrown by Asn1Object.getString() in its default branch when the element type does not match any supported string type (OCTET_STRING, NUMERIC/PRINTABLE/VIDEOTEX/IA5/GRAPHIC/ISO646/GENERAL, BMP, UTF8) and is not UNIVERSAL_STRING. The parser refuses to interpret an arbitrary tag as text.","triggerScenarios":"getString() switch hits default. Typical when getString() is called on a SEQUENCE, SET, INTEGER, OID, BOOLEAN, or any other non-string element — most commonly because the parser is misaligned (a previous element was skipped or read with the wrong type).","commonSituations":"Corrupted or misaligned DER, wrong key format, or a key whose internal layout does not match the expected structure (e.g. an RSA key with extra fields that shifts subsequent reads).","solutions":["Re-export the key from a trusted source to rule out corruption.","Validate with `openssl asn1parse -inform DER -in key.der` to confirm element types and order.","Convert to PKCS#8 so PemUtils uses a single uniform code path.","If parsing custom DER, re-check the schema and read elements in the correct order/types."],"exampleFix":"// before: parser misaligned, readAsn1Object returns SEQUENCE not OCTET_STRING\nDerParser.Asn1Object elem = parser.readAsn1Object(); // unexpectedly a SEQUENCE\nString s = elem.getString(); // throws\n\n// after: validate type before reading\nif (elem.getType() != DerParser.Type.OCTET_STRING && elem.getType() != DerParser.Type.UTF8_STRING) {\n    throw new IOException(\"unexpected tag 0x\" + Integer.toHexString(elem.getType()));\n}\nString s = elem.getString();","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"private static final Set<Integer> STRING_TYPES = Set.of(\n    DerParser.Type.OCTET_STRING, DerParser.Type.NUMERIC_STRING,\n    DerParser.Type.PRINTABLE_STRING, DerParser.Type.VIDEOTEX_STRING,\n    DerParser.Type.IA5_STRING, DerParser.Type.GRAPHIC_STRING,\n    DerParser.Type.ISO646_STRING, DerParser.Type.GENERAL_STRING,\n    DerParser.Type.BMP_STRING, DerParser.Type.UTF8_STRING);\n\npublic static boolean isStringElement(DerParser.Asn1Object o) {\n    return o != null && STRING_TYPES.contains(o.getType());\n}","tryCatchPattern":null,"preventionTips":["Verify the element type is a supported string type before calling getString().","Ensure parser alignment by reading elements in the correct order.","Validate the overall structure with `openssl asn1parse`."],"tags":["ssl","der","asn1","keystore","elasticsearch","crypto"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}