eclipse-vertx/vert.x · error · IllegalArgumentException

Invalid OID

Error message

Invalid OID

What it means

PrivateKeyParser.oidToString decodes DER-encoded Object Identifiers; when an OID sub-identifier's multi-byte encoding is truncated (the last byte has the continuation bit set but no following byte exists), it throws IllegalArgumentException('Invalid OID'). The OID bytes in the parsed private key are malformed.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:58

   */
  private static final byte[] OID_RSA_PUBLIC_KEY = { 0x2A, (byte) 0x86, 0x48, (byte) 0x86, (byte) 0xF7, 0x0D, 0x01,
          0x01, 0x01 };
  /**
   * ASN.1 OID for EC public key.
   */
  private static final byte[] OID_EC_PUBLIC_KEY = { 0x2A, (byte) 0x86, 0x48, (byte) 0xCE, 0x3D, 0x02, 0x01 };

  private static String oidToString(byte[] oid) {
    StringBuilder result = new StringBuilder();
    int value = oid[0] & 0xff;
    result.append(value / 40).append(".").append(value % 40);
    for (int index = 1; index < oid.length; ++index) {
      byte bValue = oid[index];
      if (bValue < 0) {
        value = (bValue & 0b01111111);
        ++index;
        if (index == oid.length) {
          throw new IllegalArgumentException("Invalid OID");
        }
        value <<= 7;
        value |= (oid[index] & 0b01111111);
        result.append(".").append(value);
      } else {
        result.append(".").append(bValue);
      }
    }
    return result.toString();
  }

  private static ECParameterSpec getECParameterSpec(String curveName) throws VertxException {
    try {
      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
      keyPairGenerator.initialize(new ECGenParameterSpec(curveName));
      ECPublicKey publicKey = (ECPublicKey) keyPairGenerator.generateKeyPair().getPublic();
      return publicKey.getParams();
    } catch (GeneralSecurityException e) {

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Regenerate or re-export the key file from the original source
2. Verify the base64 body decodes cleanly and has correct DER length fields (openssl asn1parse -in key.pem)
3. Ensure the PEM file is complete (BEGIN/END lines, no truncated base64)

Example fix

// before
byte[] der = Base64.getDecoder().decode(manuallyTrimmedPemBody);
String alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
// after
// validate first: openssl asn1parse -in key.pem
byte[] der = readIntactPemDer(keyFile);
String alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);

// validate DER before parsing
try {
  new DerParser(der).read();
} catch (Exception e) {
  throw new IllegalStateException("corrupt key file");
}
// or: openssl asn1parse -in key.pem

try {
  String alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
} catch (IllegalArgumentException | VertxException e) {
  // key file corrupt: re-export/regenerate
}

When it happens

Trigger: Parsing a PKCS#1/PKCS#8 private key whose AlgorithmIdentifier OID is truncated or corrupt — typically a corrupted key file, a wrongly base64-decoded key, or a key whose PEM body was concatenated/altered.

Common situations: PEM files damaged by copy/paste (truncated lines), keys re-encoded incorrectly by other tools, reading a DER key with the wrong offset.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'p
• Invalid PKCS8 encoding: not a sequence
• Unsupported version, expected 0 but found
• Invalid PKCS8 encoding: could not read Algorithm Identifier
• Invalid DER: not a sequence

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/aef5c650d8341235. Report an issue: GitHub.