eclipse-vertx/vert.x · error · VertxException

Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'p

Error message

Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'parameters' but found type '%d'

What it means

Thrown by getECKeySpec when the 'parameters' field of the ECPrivateKey is not an OBJECT_IDENTIFIER. RFC 5915 section 3 makes ECParameters mandatory, and Vert.x expects a namedCurve OID there to resolve an ECParameterSpec. Missing or wrongly-typed parameters mean the curve cannot be determined.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:175

    // Parse inside the sequence
    parser = sequence.getParser();

    Asn1Object version = parser.read();
    if (version.getType() != DerParser.INTEGER) {
      throw new VertxException(String.format(
          "Invalid DER: 'version' field must be of type INTEGER (2) but found type `%d`",
          version.getType()));
    } else if (version.getInteger().intValue() != 1) {
      throw new VertxException(String.format(
          "Invalid DER: expected 'version' field to have value '1' but found '%d'",
          version.getInteger().intValue()));
    }
    byte[] privateValue = parser.read().getValue();
    parser = parser.read().getParser();
    Asn1Object params = parser.read();
    // ECParameters are mandatory according to RFC 5915, Section 3
    if (params.getType() != DerParser.OBJECT_IDENTIFIER) {
      throw new VertxException(String.format(
          "Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'parameters' but found type '%d'",
          params.getType()));
    }
    byte[] namedCurveOid = params.getValue();
    ECParameterSpec spec = getECParameterSpec(oidToString(namedCurveOid));
    return new ECPrivateKeySpec(new BigInteger(1, privateValue), spec);
  }

  /**
   * Convert PKCS#1 encoded private key into RSAPrivateCrtKeySpec.
   * <p/>
   * <p/>The ASN.1 syntax for the private key with CRT is
   * <p/>
   * <pre>
   * --
   * -- Representation of RSA private key with information for the CRT algorithm.
   * --
   * RSAPrivateKey ::= SEQUENCE {

View on GitHub (pinned to fb308bd8c3)

Solutions

  1. Re-export the key with the named curve embedded: openssl ec -in key.pem -param_enc named_curve -outform DER.
  2. Regenerate the key using a named curve, e.g. openssl ecparam -name prime256v1 -genkey -param_enc named_curve.
  3. If the key uses explicit parameters, convert it: openssl ec -in key.pem -param_enc named_curve -out key.named.pem.
  4. Validate with openssl asn1parse that a 1.2.840.10045.3.x OID is present.

Example fix

// before
openssl ec -in key.pem -param_enc explicit -outform DER -out key.der
// after
openssl ec -in key.pem -param_enc named_curve -outform DER -out key.der
Defensive patterns

Strategy: validation

Validate before calling

// Require named_curve parameters (OID) in the EC key
// openssl check: openssl ecparam -in key.pem -noout -param_enc  -> should print named_curve
String paramEnc = readParamEnc(keyPem);
if (!"named_curve".equals(paramEnc)) {
    throw new IllegalArgumentException("EC key must use named_curve parameters, got: " + paramEnc);
}

Try / catch

try {
    return PrivateKeyParser.getECKeySpec(der);
} catch (VertxException e) {
    if (e.getMessage().contains("OBJECT_IDENTIFIER")) {
        throw new KeyFormatException("EC key lacks namedCurve parameters: " + e.getMessage());
    }
    throw e;
}

Prevention

When it happens

Trigger: Parsing an EC private key that omits the [1] parameters field or contains explicit curve parameters (a SEQUENCE) instead of a namedCurve OID; keys truncated before the parameters element.

Common situations: Keys exported from some HSMs or older tools with explicit parameters or missing parameters; corrupted key files cut short by line-wrapping mistakes.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/c75d4d58f596eac3. Report an issue: GitHub.