{"record":{"id":"c75d4d58f596eac3","repo":"eclipse-vertx/vert.x","slug":"invalid-der-expected-to-find-an-object-identifier","errorCode":null,"errorMessage":"Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'parameters' but found type '%d'","messagePattern":"Invalid DER: expected to find an OBJECT_IDENTIFIER \\(6\\) in 'parameters' but found type '(.+?)'","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":175,"sourceCode":"    // Parse inside the sequence\n    parser = sequence.getParser();\n\n    Asn1Object version = parser.read();\n    if (version.getType() != DerParser.INTEGER) {\n      throw new VertxException(String.format(\n          \"Invalid DER: 'version' field must be of type INTEGER (2) but found type `%d`\",\n          version.getType()));\n    } else if (version.getInteger().intValue() != 1) {\n      throw new VertxException(String.format(\n          \"Invalid DER: expected 'version' field to have value '1' but found '%d'\",\n          version.getInteger().intValue()));\n    }\n    byte[] privateValue = parser.read().getValue();\n    parser = parser.read().getParser();\n    Asn1Object params = parser.read();\n    // ECParameters are mandatory according to RFC 5915, Section 3\n    if (params.getType() != DerParser.OBJECT_IDENTIFIER) {\n      throw new VertxException(String.format(\n          \"Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'parameters' but found type '%d'\",\n          params.getType()));\n    }\n    byte[] namedCurveOid = params.getValue();\n    ECParameterSpec spec = getECParameterSpec(oidToString(namedCurveOid));\n    return new ECPrivateKeySpec(new BigInteger(1, privateValue), spec);\n  }\n\n  /**\n   * Convert PKCS#1 encoded private key into RSAPrivateCrtKeySpec.\n   * <p/>\n   * <p/>The ASN.1 syntax for the private key with CRT is\n   * <p/>\n   * <pre>\n   * --\n   * -- Representation of RSA private key with information for the CRT algorithm.\n   * --\n   * RSAPrivateKey ::= SEQUENCE {","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L157-L193","documentation":"Thrown by getECKeySpec when the 'parameters' field of the ECPrivateKey is not an OBJECT_IDENTIFIER. RFC 5915 section 3 makes ECParameters mandatory, and Vert.x expects a namedCurve OID there to resolve an ECParameterSpec. Missing or wrongly-typed parameters mean the curve cannot be determined.","triggerScenarios":"Parsing an EC private key that omits the [1] parameters field or contains explicit curve parameters (a SEQUENCE) instead of a namedCurve OID; keys truncated before the parameters element.","commonSituations":"Keys exported from some HSMs or older tools with explicit parameters or missing parameters; corrupted key files cut short by line-wrapping mistakes.","solutions":["Re-export the key with the named curve embedded: openssl ec -in key.pem -param_enc named_curve -outform DER.","Regenerate the key using a named curve, e.g. openssl ecparam -name prime256v1 -genkey -param_enc named_curve.","If the key uses explicit parameters, convert it: openssl ec -in key.pem -param_enc named_curve -out key.named.pem.","Validate with openssl asn1parse that a 1.2.840.10045.3.x OID is present."],"exampleFix":"// before\nopenssl ec -in key.pem -param_enc explicit -outform DER -out key.der\n// after\nopenssl ec -in key.pem -param_enc named_curve -outform DER -out key.der","handlingStrategy":"validation","validationCode":"// Require named_curve parameters (OID) in the EC key\n// openssl check: openssl ecparam -in key.pem -noout -param_enc  -> should print named_curve\nString paramEnc = readParamEnc(keyPem);\nif (!\"named_curve\".equals(paramEnc)) {\n    throw new IllegalArgumentException(\"EC key must use named_curve parameters, got: \" + paramEnc);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return PrivateKeyParser.getECKeySpec(der);\n} catch (VertxException e) {\n    if (e.getMessage().contains(\"OBJECT_IDENTIFIER\")) {\n        throw new KeyFormatException(\"EC key lacks namedCurve parameters: \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Always generate keys with -param_enc named_curve","Convert explicit-parameters keys: openssl ec -in key.pem -param_enc named_curve","Verify with openssl asn1parse that an 1.2.840.10045.3.x OID is present"],"tags":["der","asn1","ec","named-curve","oid"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}