{"record":{"id":"f6ebafc5f19081cb","repo":"spring-projects/spring-security","slug":"invalid-rsa-private-key-asn1-sequence","errorCode":null,"errorMessage":"Invalid RSA Private Key ASN1 sequence.","messagePattern":"Invalid RSA Private Key ASN1 sequence\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java","lineNumber":98,"sourceCode":"\t\t\tcatch (Exception ex) {\n\t\t\t\t// Ignore\n\t\t\t}\n\t\t\tthrow new IllegalArgumentException(\"String is not PEM encoded data, nor a public key encoded for ssh\");\n\t\t}\n\n\t\tString type = m.group(1);\n\t\tfinal byte[] content = base64Decode(m.group(2));\n\n\t\tPublicKey publicKey;\n\t\tPrivateKey privateKey = null;\n\n\t\ttry {\n\t\t\tKeyFactory fact = KeyFactory.getInstance(\"RSA\");\n\t\t\tswitch (type) {\n\t\t\t\tcase \"RSA PRIVATE KEY\" -> {\n\t\t\t\t\tASN1Sequence seq = ASN1Sequence.getInstance(content);\n\t\t\t\t\tif (seq.size() != 9) {\n\t\t\t\t\t\tthrow new IllegalArgumentException(\"Invalid RSA Private Key ASN1 sequence.\");\n\t\t\t\t\t}\n\t\t\t\t\torg.bouncycastle.asn1.pkcs.RSAPrivateKey key = org.bouncycastle.asn1.pkcs.RSAPrivateKey\n\t\t\t\t\t\t.getInstance(seq);\n\t\t\t\t\tRSAPublicKeySpec pubSpec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());\n\t\t\t\t\tRSAPrivateCrtKeySpec privSpec = new RSAPrivateCrtKeySpec(key.getModulus(), key.getPublicExponent(),\n\t\t\t\t\t\t\tkey.getPrivateExponent(), key.getPrime1(), key.getPrime2(), key.getExponent1(),\n\t\t\t\t\t\t\tkey.getExponent2(), key.getCoefficient());\n\t\t\t\t\tpublicKey = fact.generatePublic(pubSpec);\n\t\t\t\t\tprivateKey = fact.generatePrivate(privSpec);\n\t\t\t\t}\n\t\t\t\tcase \"PUBLIC KEY\" -> {\n\t\t\t\t\tKeySpec keySpec = new X509EncodedKeySpec(content);\n\t\t\t\t\tpublicKey = fact.generatePublic(keySpec);\n\t\t\t\t}\n\t\t\t\tcase \"RSA PUBLIC KEY\" -> {\n\t\t\t\t\tASN1Sequence seq = ASN1Sequence.getInstance(content);\n\t\t\t\t\torg.bouncycastle.asn1.pkcs.RSAPublicKey key = org.bouncycastle.asn1.pkcs.RSAPublicKey\n\t\t\t\t\t\t.getInstance(seq);","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaKeyHelper.java#L80-L116","documentation":"After base64-decoding PEM content, parseKeyPair() parses the DER bytes as an ASN1Sequence and requires exactly 9 elements for a PKCS#1 RSAPrivateKey structure. This error means the decoded ASN.1 sequence has the wrong number of fields, so the data is not a valid RSA PRIVATE KEY (PKCS#1) structure.","triggerScenarios":"Passing a 'PRIVATE KEY' (PKCS#8) PEM but labeled or routed into the 'RSA PRIVATE KEY' branch; truncated or corrupted base64 body; passing a public key or certificate body under an RSA PRIVATE KEY header.","commonSituations":"Key generated by OpenSSL in PKCS#8 format (openssl genpkey) instead of traditional PKCS#1 (openssl genrsa); manual header edits; copy-paste truncation of the long base64 block.","solutions":["Convert the key to PKCS#1: openssl rsa -in key.pem -traditional -out rsakey.pem","Verify the base64 body is complete and unmodified between BEGIN/END lines","Match the PEM header to the actual format (BEGIN PRIVATE KEY = PKCS#8, BEGIN RSA PRIVATE KEY = PKCS#1)","Re-extract the key: openssl rsa -in bad.pem -check"],"exampleFix":"// before\nopenssl pkcs8 -topk8 -in rsa.pem   // produces PKCS#8, seq size != 9\n// after\nopenssl rsa -in key.pem -traditional -out rsa_pkcs1.pem","handlingStrategy":"validation","validationCode":"// Confirm PKCS#1 format before parsing\nString body = pem.replaceAll(\"-----(BEGIN|END) RSA PRIVATE KEY-----\", \"\").replaceAll(\"\\\\s\", \"\");\nbyte[] der = Base64.getMimeDecoder().decode(body);\nif (der[4] != 0x30) throw new IllegalArgumentException(\"Not DER sequence\");","typeGuard":null,"tryCatchPattern":"try { return RsaKeyHelper.parseKeyPair(pem); } catch (IllegalArgumentException ex) { if (ex.getMessage().contains(\"ASN1\")) { /* convert key with openssl and retry once */ } throw ex; }","preventionTips":["Generate keys in PKCS#1 (openssl genrsa / openssl rsa -traditional)","Never hand-edit PEM bodies","Match PEM header to actual DER structure","Validate keys with openssl rsa -check before use"],"tags":["asn1","rsa","pem","invalid-input"],"backgroundTag":"invalid-key-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}