{"record":{"id":"e98ffec913693719","repo":"elastic/elasticsearch","slug":"error-parsing-ec-named-curve-identifier-named-cur","errorCode":null,"errorMessage":"Error parsing EC named curve identifier. Named curve with OID: {} is not supported","messagePattern":"Error parsing EC named curve identifier\\. Named curve with OID: (.+?) is not supported","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java","lineNumber":746,"sourceCode":"    private static String getEcCurveNameFromOid(String oidString) throws GeneralSecurityException {\n        return switch (oidString) {\n            // see https://tools.ietf.org/html/rfc5480#section-2.1.1.1\n            case \"1.2.840.10045.3.1\" -> \"secp192r1\";\n            case \"1.3.132.0.1\" -> \"sect163k1\";\n            case \"1.3.132.0.15\" -> \"sect163r2\";\n            case \"1.3.132.0.33\" -> \"secp224r1\";\n            case \"1.3.132.0.26\" -> \"sect233k1\";\n            case \"1.3.132.0.27\" -> \"sect233r1\";\n            case \"1.2.840.10045.3.1.7\" -> \"secp256r1\";\n            case \"1.3.132.0.16\" -> \"sect283k1\";\n            case \"1.3.132.0.17\" -> \"sect283r1\";\n            case \"1.3.132.0.34\" -> \"secp384r1\";\n            case \"1.3.132.0.36\" -> \"sect409k1\";\n            case \"1.3.132.0.37\" -> \"sect409r1\";\n            case \"1.3.132.0.35\" -> \"secp521r1\";\n            case \"1.3.132.0.38\" -> \"sect571k1\";\n            case \"1.3.132.0.39\" -> \"sect571r1\";\n            default -> throw new GeneralSecurityException(\n                \"Error parsing EC named curve identifier. Named curve with OID: \" + oidString + \" is not supported\"\n            );\n        };\n    }\n\n}\n","sourceCodeStart":728,"sourceCodeEnd":753,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java#L728-L753","documentation":"Thrown by PemUtils while parsing a PEM-encoded EC private key. The parser reads the named-curve OID from the ECPrivateKey structure and maps it to a JCA curve name via a fixed switch table; any OID not listed falls through to this GeneralSecurityException. The table covers only the standard SEC2/NIST curves (secp224r1 through sect571r1).","triggerScenarios":"Loading an EC private key (PEM) whose curve OID is outside the hardcoded list — e.g. brainpoolP160r1 (1.3.36.3.3.2.8.1.1.1), prime192v1/secp192r1 (1.2.840.10045.3.1.1), or any new/proprietary curve. Triggered when SslConfigurationLoader builds a PemKeyConfig and the key is decoded.","commonSituations":"Org mandates a non-NIST curve (Brainpool, sm2p256v1); a legacy key generated on older OpenSSL with a deprecated curve; copy of a key from a different PKI that uses curve not in the SEC2 set expected by Elasticsearch.","solutions":["Regenerate the key with a supported curve: openssl ecparam -name prime256v1 -genkey -noout -out ec.key (prime256v1=secp256r1; also secp384r1, secp521r1).","If you must keep an unsupported curve, switch the node to RSA keys (RSA is not subject to the OID table).","Re-issue the cert/key from a CA that signs over a supported curve before configuring ssl.certificate / ssl.key."],"exampleFix":"// before: key generated with an unsupported curve\n//   openssl ecparam -name brainpoolP256r1 -genkey ...\n// after: regenerate with a curve present in the switch table\n//   openssl ecparam -name prime256v1 -genkey -noout -out node-ec.key\n//   openssl req -new -x509 -key node-ec.key -out node-ec.crt -days 730","handlingStrategy":"validation","validationCode":"// Before loading the EC key, confirm its curve is supported.\nprivate static final Set<String> SUPPORTED_EC_OIDS = Set.of(\n    \"1.3.132.0.33\",\"1.3.132.0.26\",\"1.3.132.0.27\",\"1.2.840.10045.3.1.7\",\n    \"1.3.132.0.16\",\"1.3.132.0.17\",\"1.3.132.0.34\",\"1.3.132.0.36\",\n    \"1.3.132.0.37\",\"1.3.132.0.35\",\"1.3.132.0.38\",\"1.3.132.0.39\"\n);\nvoid checkCurve(byte[] pkcs8EcKey) throws Exception {\n    var spec = PKCS8EncodedKeySpec(pkcs8EcKey);\n    var k = KeyFactory.getInstance(\"EC\").generatePrivate(spec);\n    var oid = ((java.security.interfaces.ECPrivateKey) k).getParams()\n                  .getCurve().toString(); // or AlgorithmParameters -> ECParameterSpec -> OID\n    if (!SUPPORTED_EC_OIDS.contains(oid))\n        throw new IllegalArgumentException(\"Unsupported EC curve; regenerate with secp256r1/secp384r1/secp521r1\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    var keyConfig = new PemKeyConfig(cert, key, pwd, base);\n} catch (GeneralSecurityException e) {\n    if (e.getMessage().contains(\"Named curve with OID\")) {\n        log.error(\"EC curve not supported by PemUtils; regenerate key with a NIST/SEC2 curve\");\n    }\n    throw e;\n}","preventionTips":["Standardise on prime256v1/secp384r1/secp521r1 when generating keys for Elasticsearch nodes.","Document the supported curve list in your PKI runbook so cert signers use a supported curve.","Validate keys in CI (openssl ecparam -text) before they reach a node's config."],"tags":["ssl","pem","ec","cryptography","config"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}