{"record":{"id":"f733ea97cb0c0c15","repo":"eclipse-vertx/vert.x","slug":"unsupported-version-expected-0-but-found","errorCode":null,"errorMessage":"Unsupported version, expected 0 but found ","messagePattern":"Unsupported version, expected 0 but found ","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java","lineNumber":101,"sourceCode":"   *\n   * @param encodedKey The encoded private key.\n   * @return The algorithm name, either <em>RSA</em> or <em>EC</em>, depending on\n   *         the algorithm identifier found in the encoded key.\n   * @throws VertxException if the key is not PKCS#8 encoded or uses an unsupported\n   *         algorithm.\n   */\n  public static String getPKCS8EncodedKeyAlgorithm(byte[] encodedKey) {\n\n    DerParser parser = new DerParser(encodedKey);\n    Asn1Object sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n      throw new VertxException(\"Invalid PKCS8 encoding: not a sequence\");\n    }\n\n    parser = sequence.getParser();\n    BigInteger version = parser.read().getInteger();\n    if (version.intValue() != 0) {\n        throw new VertxException(\"Unsupported version, expected 0 but found \" + version.intValue());\n    }\n\n    sequence = parser.read();\n    if (sequence.getType() != DerParser.SEQUENCE) {\n        throw new VertxException(\"Invalid PKCS8 encoding: could not read Algorithm Identifier\");\n    }\n\n    parser = sequence.getParser();\n    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();\n    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"RSA\";\n    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {\n        return \"EC\";\n    } else {\n        throw new VertxException(\"Unsupported algorithm identifier\");\n    }\n  }\n","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java#L83-L119","documentation":"In PKCS#8 PrivateKeyInfo, the version field must be 0. getPKCS8EncodedKeyAlgorithm reads the first INTEGER after the SEQUENCE and throws VertxException('Unsupported version, expected 0 but found N') for any other value, meaning the structure is not a v1 PKCS#8 private key.","triggerScenarios":"Passing a DER structure that otherwise looks like PKCS#8 but has a nonzero version — e.g. v2 PKCS#8 (encrypted/altered structures) or a completely different ASN.1 structure whose first field is a nonzero INTEGER.","commonSituations":"Keys from nonstandard tooling, encrypted PKCS#8 variants, or passing an X.509 certificate DER instead of a private key DER.","solutions":["Regenerate/convert the key to standard unencrypted PKCS#8 v1: openssl pkcs8 -topk8 -nocrypt","Check the exception message for the actual version found and verify which format the file really is (openssl asn1parse)","Ensure you are passing a private key, not a certificate or CSR"],"exampleFix":"// before\nbyte[] der = Files.readAllBytes(Path.of(\"cert.der\")); // certificate, not a key\nString alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);\n// after\nbyte[] der = Files.readAllBytes(Path.of(\"key8.der\")); // PKCS#8 v1 private key\nString alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);","handlingStrategy":"validation","validationCode":"// ensure the file is a PKCS#8 v1 private key\n// openssl asn1parse -in key.pem  -> version INTEGER :0\nif (!Files.readString(pemPath).startsWith(\"-----BEGIN PRIVATE KEY-----\")) {\n  throw new IllegalArgumentException(\"not an unencrypted PKCS#8 private key\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);\n} catch (VertxException e) {\n  // message names the found version; reconvert key to PKCS#8 v1\n}","preventionTips":["Don't pass certificates or CSRs to private-key parsers","Check openssl asn1parse output shows version 0","Use -topk8 -nocrypt when converting keys"],"tags":["pkcs8","der","pki"],"backgroundTag":"invalid-argument-format","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}