{"record":{"id":"c63ee05f9bc5cf53","repo":"elastic/elasticsearch","slug":"expected-asn-1-object-of-type-0x-but-was-0x","errorCode":null,"errorMessage":"Expected ASN.1 object of type 0x{} but was 0x{}","messagePattern":"Expected ASN\\.1 object of type 0x(.+?) but was 0x(.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":74,"sourceCode":"\n    private InputStream derInputStream;\n    private int maxAsnObjectLength;\n\n    public DerParser(byte[] bytes) {\n        this.derInputStream = new ByteArrayInputStream(bytes);\n        this.maxAsnObjectLength = bytes.length;\n    }\n\n    /**\n     * Read an object and verify its type\n     * @param requiredType The expected type code\n     * @throws IOException if data can not be parsed\n     * @throws IllegalStateException if the parsed object is of the wrong type\n     */\n    public Asn1Object readAsn1Object(int requiredType) throws IOException {\n        final Asn1Object obj = readAsn1Object();\n        if (obj.type != requiredType) {\n            throw new IllegalStateException(\n                \"Expected ASN.1 object of type 0x\" + Integer.toHexString(requiredType) + \" but was 0x\" + Integer.toHexString(obj.type)\n            );\n        }\n        return obj;\n    }\n\n    public Asn1Object readAsn1Object() throws IOException {\n        int tag = derInputStream.read();\n        if (tag == -1) {\n            throw new IOException(\"Invalid DER: stream too short, missing tag\");\n        }\n        int length = getLength();\n        // getLength() can return any 32 bit integer, so ensure that a corrupted encoding won't\n        // force us into allocating a very large array\n        if (length > maxAsnObjectLength) {\n            throw new IOException(\n                \"Invalid DER: size of ASN.1 object to be parsed appears to be larger than the size of the key file \" + \"itself.\"\n            );","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L56-L92","documentation":"Thrown as IllegalStateException by DerParser.readAsn1Object(int requiredType) when a parsed ASN.1 DER object's tag byte does not match the expected type code. DerParser is a minimal ASN.1/DER decoder used by PemUtils to parse private keys (RSA PKCS#1, DSA, EC, PKCS#8 encrypted/unencrypted). Each read in the key-parsing sequence expects a specific type (SEQUENCE, INTEGER, OID, OCTET_STRING); if the bytes don't conform, this fires.","triggerScenarios":"PemUtils reads a PEM-encoded private key, converts it to DER, and calls readAsn1Object(requiredType) at each step. If the DER bytes are structurally valid but encode a different type than expected (e.g. the parser expects SEQUENCE but reads an INTEGER), the tag mismatch throws. Triggered during SSL configuration when loading a private key.","commonSituations":"The private key file is in an unexpected format (e.g. an EC key where an RSA key was expected, or a PKCS#8 key where PKCS#1 was expected). The PEM file is truncated or contains extra headers. A certificate file was accidentally supplied where a private key was required. The key uses an algorithm or wrapping not handled by the specific parser branch.","solutions":["Verify the key format: openssl pkey -in key.pem -noout -text (or openssl rsa -in key.pem for RSA).","Convert the key to a supported format: openssl pkcs8 -topk8 -in key.pem -out key_pkcs8.pem -nocrypt.","Ensure you are loading a private key (BEGIN PRIVATE KEY / BEGIN RSA PRIVATE KEY / BEGIN EC PRIVATE KEY), not a certificate or public key.","Check that the PEM file is not truncated or corrupted (compare checksums if transferred)."],"exampleFix":"# before — supplying an EC key where the config expects RSA PKCS#1\n# elasticsearch.yml: ssl.key: ec-key.pem\n\n# after — convert to PKCS#8 unencrypted, universally parsed\nopenssl pkcs8 -topk8 -in ec-key.pem -out key_pkcs8.pem -nocrypt\n# elasticsearch.yml: ssl.key: key_pkcs8.pem","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    KeyPair kp = PemUtils.readPrivateKey(keyPath, password);\n} catch (IllegalStateException | IOException e) {\n    // 'Expected ASN.1 object of type 0x..' means the DER structure doesn't match the expected key format\n    log.error(\"Private key parse failed (type mismatch): {}\", e.getMessage());\n    // convert the key with: openssl pkcs8 -topk8 -in key.pem -out key_pkcs8.pem -nocrypt\n}","preventionTips":["Convert private keys to unencrypted PKCS#8 PEM format for broadest compatibility: openssl pkcs8 -topk8 -nocrypt.","Validate keys with openssl pkey -in key.pem -noout before configuring SSL.","Confirm you are loading a private key, not a certificate or CSR.","Check that the key algorithm (RSA/EC/DSA) matches the parser branch being used."],"tags":["ssl","tls","asn1","der","pem","private-key","security","elasticsearch"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}