eclipse-vertx/vert.x · error · VertxException

Invalid DER: can't parse primitive entity

Error message

Invalid DER: can't parse primitive entity

What it means

Thrown by Asn1Object.getParser when the object is a primitive (not constructed) node but the caller asks for a sub-parser over its contents. Constructed types contain nested elements parseable by a sub-parser; primitive types hold only raw bytes. Asking to recurse into a primitive means the DER layout differs from what the key parser expects (e.g. ECPrivateKey's [1] parameters wrapped node absent or the structure is not a key).

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:450

    }

    public byte[] getValue() {
      return value;
    }

    public boolean isConstructed() {
      return (tag & DerParser.CONSTRUCTED) == DerParser.CONSTRUCTED;
    }

    /**
     * For constructed field, return a parser for its content.
     *
     * @return A parser for the construct.
     * @throws VertxException
     */
    public DerParser getParser() throws VertxException {
      if (!isConstructed()) {
        throw new VertxException("Invalid DER: can't parse primitive entity");
      }

      return new DerParser(value);
    }

    /**
     * Get the value as integer
     *
     * @return BigInteger
     * @throws VertxException
     */
    public BigInteger getInteger() throws VertxException {
      if (type != DerParser.INTEGER) {
        throw new VertxException("Invalid DER: object is not integer");
      }

      return new BigInteger(value);
    }

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Confirm the key encoding matches the parser (SEC1 for getECKeySpec, PKCS#1 for getRSAKeySpec, PKCS#8 for getPKCS8EncodedKeyAlgorithm).
2. Re-export the key with OpenSSL in the standard format (openssl ec / openssl rsa / openssl pkcs8 -topk8 -nocrypt).
3. Inspect the structure with openssl asn1parse -i to find where a primitive appears where a constructed SEQUENCE is expected.
4. Regenerate the key with a standards-compliant tool if the encoder is custom.

Example fix

// before
byte[] der = Base64.getMimeDecoder().decode(customEncoderOutput);
// after
openssl ec -in key.pem -outform DER -out key.der
byte[] der = Files.readAllBytes(Path.of("key.der"));

// Inspect structure type first: the key parser expects constructed (0x20-flagged) nodes where it recurses
// openssl asn1parse -i -inform DER -in key.der shows SEQUENCE vs primitive fields

try {
    return PrivateKeyParser.getRSAKeySpec(der);
} catch (VertxException e) {
    if (e.getMessage().contains("can't parse primitive entity")) {
        throw new KeyFormatException("Unexpected DER layout — check key encoding (PKCS#1 vs PKCS#8 vs SEC1): " + e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Calling getParser() on a primitive ASN.1 object — hit from getPKCS8EncodedKeyAlgorithm, getECKeySpec, or getRSAKeySpec when an intermediate element that should be a constructed SEQUENCE (e.g. PrivateKeyInfo algorithm parameters, or the ECPrivateKey parameters container) is actually primitive.

Common situations: Keys whose parameters are stored as raw OCTET STRING instead of constructed structures; wrong key format (PKCS#8 vs SEC1 vs PKCS#1 mixups); hand-rolled or non-conformant key encoders.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid DER: not a sequence
• Invalid DER: 'version' field must be of type INTEGER (2) but
• Invalid DER: expected 'version' field to have value '1' but
• Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'p
• Invalid DER: stream too short, missing tag

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/15c2a3673dece77b. Report an issue: GitHub.