{"record":{"id":"fa81765be1439499","repo":"elastic/elasticsearch","slug":"invalid-der-object-is-not-integer","errorCode":null,"errorMessage":"Invalid DER: object is not integer","messagePattern":"Invalid DER: object is not integer","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java","lineNumber":229,"sourceCode":"         * For constructed field, return a parser for its content.\n         *\n         * @return A parser for the construct.\n         */\n        public DerParser getParser() throws IOException {\n            if (isConstructed() == false) {\n                throw new IOException(\"Invalid DER: can't parse primitive entity\"); //$NON-NLS-1$\n            }\n\n            return new DerParser(value);\n        }\n\n        /**\n         * Get the value as integer\n         *\n         * @return BigInteger\n         */\n        public BigInteger getInteger() throws IOException {\n            if (type != Type.INTEGER) throw new IOException(\"Invalid DER: object is not integer\"); //$NON-NLS-1$\n\n            return new BigInteger(value);\n        }\n\n        public String getString() throws IOException {\n\n            String encoding;\n\n            switch (type) {\n                case Type.OCTET_STRING:\n                    // octet string is basically a byte array\n                    return toHexString(value);\n                case Type.NUMERIC_STRING:\n                case Type.PRINTABLE_STRING:\n                case Type.VIDEOTEX_STRING:\n                case Type.IA5_STRING:\n                case Type.GRAPHIC_STRING:\n                case Type.ISO646_STRING:","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java#L211-L247","documentation":"Thrown by Asn1Object.getInteger() when the parsed object's type field is not Type.INTEGER (0x02). The parser refuses to interpret arbitrary bytes as a signed two's-complement integer; calling getInteger() on a SEQUENCE, OCTET STRING, OID, or any other type triggers this.","triggerScenarios":"In the RSA/DSA/EC DER parsers (parseRsaDer line 628+, parseDsaDer line 651+, parseEcDer line 603), getInteger() is called sequentially on elements expected to be INTEGER. If the DER is misaligned (a field is the wrong type) or the key uses an unexpected structure, getInteger() hits a non-INTEGER element.","commonSituations":"Wrong key format fed to a format-specific parser (PKCS#1 RSA bytes fed to parseEcDer, or a malformed key where one element was dropped/added), corruption that shifts alignment, or a key from a non-conformant generator.","solutions":["Confirm the key format matches the parser being used (RSA PKCS#1, DSA OpenSSL, EC SEC1).","Re-export with standard tooling: `openssl pkcs8 -topk8 -in key.pem -out key.pk8.pem` for a unified PKCS#8 wrapper that PemUtils handles via parsePKCS8.","Hex-dump and use `openssl asn1parse` to confirm the expected INTEGER sequence.","If migrating from another JVM crypto stack, regenerate keys to avoid proprietary encodings."],"exampleFix":"// before: RSA key bytes parsed as EC\nbyte[] rsaDer = ...;\nDerParser p = new DerParser(rsaDer);\nDerParser.Asn1Object seq = p.readAsn1Object();\nseq.getParser().readAsn1Object().getInteger(); // ok\nseq.getParser().readAsn1Object().getInteger(); // may throw if misaligned\n\n// after: route by detected format (let PemUtils.parsePrivateKey dispatch)\nPrivateKey pk = PemUtils.parsePrivateKey(keyPath, () -> null);","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"public static boolean isIntegerElement(DerParser.Asn1Object o) {\n    return o != null && o.getType() == DerParser.Type.INTEGER;\n}\n\n// Usage:\n// if (!isIntegerElement(elem)) throw new IOException(\"expected INTEGER\");\n// BigInteger v = elem.getInteger();","tryCatchPattern":null,"preventionTips":["Check getType() == Type.INTEGER before calling getInteger().","Confirm the key format matches the parser (RSA vs EC vs DSA).","Use PKCS#8 to let the JCE handle structure rather than relying on manual DER walks."],"tags":["ssl","der","asn1","keystore","elasticsearch","crypto"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}