{"record":{"id":"e5ecd1fbdb1eb6d1","repo":"elastic/elasticsearch","slug":"invalid-der-stream-too-short-missing-tag","errorCode":null,"errorMessage":"Invalid DER: stream too short, missing tag","messagePattern":"Invalid DER: stream too short, missing tag","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":84,"sourceCode":"     * Read an object and verify its type\n     * @param requiredType The expected type code\n     * @throws IOException if data can not be parsed\n     * @throws IllegalStateException if the parsed object is of the wrong type\n     */\n    public Asn1Object readAsn1Object(int requiredType) throws IOException {\n        final Asn1Object obj = readAsn1Object();\n        if (obj.type != requiredType) {\n            throw new IllegalStateException(\n                \"Expected ASN.1 object of type 0x\" + Integer.toHexString(requiredType) + \" but was 0x\" + Integer.toHexString(obj.type)\n            );\n        }\n        return obj;\n    }\n\n    public Asn1Object readAsn1Object() throws IOException {\n        int tag = derInputStream.read();\n        if (tag == -1) {\n            throw new IOException(\"Invalid DER: stream too short, missing tag\");\n        }\n        int length = getLength();\n        // getLength() can return any 32 bit integer, so ensure that a corrupted encoding won't\n        // force us into allocating a very large array\n        if (length > maxAsnObjectLength) {\n            throw new IOException(\n                \"Invalid DER: size of ASN.1 object to be parsed appears to be larger than the size of the key file \" + \"itself.\"\n            );\n        }\n        byte[] value = new byte[length];\n        int n = derInputStream.read(value);\n        if (n < length) {\n            throw new IOException(\n                \"Invalid DER: stream too short, missing value. \" + \"Could only read \" + n + \" out of \" + length + \" bytes\"\n            );\n        }\n        return new Asn1Object(tag, length, value);\n","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L66-L102","documentation":"Thrown as IOException by DerParser.readAsn1Object() when the underlying DER input stream has no more bytes at the point where a tag byte is expected (derInputStream.read() returns -1). This indicates the DER-encoded data is truncated or empty. DerParser is used by PemUtils to decode private keys, so this fires during SSL key loading when the byte stream is too short.","triggerScenarios":"Constructing a DerParser from a byte array and calling readAsn1Object() when the array is empty, or after consuming all bytes but attempting to read more objects. In PemUtils this happens when the PEM-to-DER conversion produced zero bytes or the key body is missing.","commonSituations":"An empty or whitespace-only PEM file, a PEM file whose Base64 body was stripped (only headers/footers remain), a copy/paste truncation of the key, or a file encoding issue (e.g. UTF-8 BOM or CRLF line endings disrupting Base64 decoding). Also when a non-key file (e.g. a CSR or an HTML error page from a download) is mistakenly used as a private key.","solutions":["Check the file is non-empty and contains a valid Base64 body between PEM headers: cat key.pem (look for BEGIN/END with content between).","Re-download or re-export the key file and verify its size is non-zero.","Strip BOM/CRLF: sed -i 's/\\r$//' key.pem; and ensure no stray HTML or whitespace.","Validate with openssl: openssl pkey -in key.pem -noout (should exit 0 if the key parses)."],"exampleFix":"# before — empty or header-only PEM file\n-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----\n\n# after — valid key with a complete Base64 body\n-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD...\n[full base64 content]\n-----END PRIVATE KEY-----","handlingStrategy":"validation","validationCode":"byte[] der = pemToDer(keyPemContent);\nif (der == null || der.length == 0) {\n    throw new IllegalArgumentException(\"PEM key body is empty or could not be decoded\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    DerParser parser = new DerParser(derBytes);\n    Asn1Object obj = parser.readAsn1Object();\n} catch (IOException e) {\n    if (e.getMessage().contains(\"stream too short\")) {\n        // input is empty or truncated\n        log.error(\"DER input is empty or truncated; verify the PEM file has a complete Base64 body\");\n    }\n    throw e;\n}","preventionTips":["Verify the PEM file has a non-empty Base64 body between BEGIN/END markers before use.","Check file size is non-zero and matches the expected key length.","Strip BOM and CRLF from PEM files transferred between systems.","Validate with openssl pkey -in key.pem -noout before configuring SSL."],"tags":["ssl","tls","asn1","der","pem","private-key","truncated-input","security","elasticsearch"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}