{"record":{"id":"dcdd11773ad2e141","repo":"elastic/elasticsearch","slug":"malformed-pem-file-dek-info-iv-is-invalid","errorCode":null,"errorMessage":"Malformed PEM file, DEK-Info IV is invalid","messagePattern":"Malformed PEM file, DEK-Info IV is invalid","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":514,"sourceCode":"     * @return a cipher of the appropriate algorithm and parameters to be used for decryption\n     * @throws GeneralSecurityException if the algorithm is not available in the used security provider, or if the key is inappropriate\n     * for the cipher\n     * @throws IOException if the DEK-Info PEM header is invalid\n     */\n    private static Cipher getCipherFromParameters(String dekHeaderValue, char[] password) throws GeneralSecurityException, IOException {\n        final String padding = \"PKCS5Padding\";\n        final SecretKey encryptionKey;\n        final String[] valueTokens = dekHeaderValue.split(\",\");\n        if (valueTokens.length != 2) {\n            throw new IOException(\"Malformed PEM file, DEK-Info PEM header is invalid\");\n        }\n        final String algorithm = valueTokens[0];\n        final String ivString = valueTokens[1];\n        final byte[] iv;\n        try {\n            iv = hexStringToByteArray(ivString);\n        } catch (IllegalArgumentException e) {\n            throw new IOException(\"Malformed PEM file, DEK-Info IV is invalid\", e);\n        }\n        if (\"DES-CBC\".equals(algorithm)) {\n            byte[] key = generateOpenSslKey(password, iv, 8);\n            encryptionKey = new SecretKeySpec(key, DEPRECATED_DES_ALGORITHM);\n        } else if (\"DES-EDE3-CBC\".equals(algorithm)) {\n            byte[] key = generateOpenSslKey(password, iv, 24);\n            encryptionKey = new SecretKeySpec(key, DEPRECATED_DES_EDE_ALGORITHM);\n        } else if (\"AES-128-CBC\".equals(algorithm)) {\n            byte[] key = generateOpenSslKey(password, iv, 16);\n            encryptionKey = new SecretKeySpec(key, \"AES\");\n        } else if (\"AES-192-CBC\".equals(algorithm)) {\n            byte[] key = generateOpenSslKey(password, iv, 24);\n            encryptionKey = new SecretKeySpec(key, \"AES\");\n        } else if (\"AES-256-CBC\".equals(algorithm)) {\n            byte[] key = generateOpenSslKey(password, iv, 32);\n            encryptionKey = new SecretKeySpec(key, \"AES\");\n        } else {\n            throw new GeneralSecurityException(\"Private Key encrypted with unsupported algorithm [\" + algorithm + \"]\");","sourceCodeStart":496,"sourceCodeEnd":532,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L496-L532","documentation":"Thrown by getCipherFromParameters when hexStringToByteArray raises IllegalArgumentException while converting the IV portion of the DEK-Info header to bytes. The IV must be a valid hex string; non-hex characters or incorrect casing for the radix trigger the underlying parse failure, which is wrapped in this IOException.","triggerScenarios":"A DEK-Info IV containing non-hex characters (e.g. 'GHIJKL' or a typo), spaces, or a decimal value; an IV that was corrupted by a text-rewriting tool; manual editing that introduced an invalid character.","commonSituations":"Hand-edited PEM files; a templating system that mangled the hex; a copy-paste that replaced characters; an IV generated by non-conformant tooling.","solutions":["Inspect the IV portion after the comma in 'DEK-Info:' and confirm it contains only 0-9 and A-F/a-f characters.","Regenerate the encrypted key with OpenSSL (the IV is generated automatically): 'openssl rsa -aes256 -in plain.key -out enc.key'.","If the IV is unrecoverable, the key cannot be decrypted; regenerate it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate the IV portion of DEK-Info is hexadecimal before invoking the parser\nString ivString = /* IV token from DEK-Info */;\nif (!ivString.matches(\"[0-9A-Fa-f]+\")) {\n    throw new IllegalArgumentException(\"DEK-Info IV is not hexadecimal: \" + ivString);\n}","typeGuard":null,"tryCatchPattern":"try { PemUtils.readPrivateKey(path, passwordSupplier); }\ncatch (IOException e) { if (e.getMessage().contains(\"DEK-Info IV is invalid\")) { /* regenerate key */ } else throw e; }","preventionTips":["Never hand-edit the IV.","Regenerate encrypted keys with OpenSSL so the IV is fresh and valid.","Lint PEM files with OpenSSL before deploying."],"tags":["ssl","pem","dek-info","iv","encrypted","config"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}