eclipse-vertx/vert.x · error · VertxException

Invalid DER: stream too short, missing tag

Error message

Invalid DER: stream too short, missing tag

What it means

Thrown by DerParser.readByte when the input buffer is exhausted (pos+1 >= length) but another tag byte is requested. This means the DER stream ended mid-structure — the key bytes are truncated or the length fields promise more data than is present.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:313

     * @param in The DER encoded stream
     */
    DerParser(Buffer in) throws VertxException {
      this.in = in;
    }

    /**
     * Create a new DER decoder from a byte array.
     *
     * @param bytes The encoded bytes
     * @throws VertxException
     */
    DerParser(byte[] bytes) throws VertxException {
      this(Buffer.buffer(bytes));
    }

    private int readByte() throws VertxException {
      if (pos + 1 >= in.length()) {
        throw new VertxException("Invalid DER: stream too short, missing tag");
      }
      return in.getUnsignedByte(pos++);
    }

    private byte[] readBytes(int len) throws VertxException {
      if (pos + len > in.length()) {
        throw new VertxException("Invalid DER: stream too short, missing tag");
      }
      Buffer s = in.slice(pos, pos + len);
      pos += len;
      return s.getBytes();
    }

    /**
     * Read next object. If it's constructed, the value holds
     * encoded content and it should be parsed by a new
     * parser from {@code Asn1Object.getParser}.
     *

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Re-extract the base64 body with the complete PEM block and re-decode; compare byte length against openssl asn1parse output.
2. Regenerate/re-download the key file and verify integrity (checksum or openssl pkey -check / openssl rsa -check).
3. Confirm no code truncates the buffer (e.g. substring, fixed-size slice, or Buffer.slice with wrong end index).
4. Validate the DER end-to-end with openssl asn1parse -inform DER before passing it to the parser.

Example fix

// before
byte[] der = Base64.getMimeDecoder().decode(body.substring(0, body.indexOf('\n', 64)));
// after
byte[] der = Base64.getMimeDecoder().decode(body.trim());

// Verify completeness before parsing
byte[] der = Base64.getMimeDecoder().decode(fullPemBody);
if (der.length < 8) throw new IllegalArgumentException("Key material too short");
// cross-check expected size: openssl asn1parse -inform DER -in key.der must consume the whole input

try {
    return PrivateKeyParser.getECKeySpec(der);
} catch (VertxException e) {
    if (e.getMessage().contains("stream too short")) {
        throw new KeyFormatException("Key material truncated: " + e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Parsing key bytes cut off before the end (wrong slice length, string truncated at a newline); any DER read operation reaching EOF, reached via tag/read paths.

Common situations: Manually splitting PEM base64 into the wrong byte range; files truncated by upload/download; copying key text that lost trailing lines.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Unsupported algorithm identifier
• Invalid DER: not a sequence
• Invalid DER: 'version' field must be of type INTEGER (2) but
• Invalid DER: expected 'version' field to have value '1' but
• Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'p

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/1233990725163b9f. Report an issue: GitHub.