What causes "Unsupported algorithm identifier" in eclipse-vertx/vert.x?

Regenerate the key as RSA or EC (e.g. openssl genpkey -algorithm RSA or openssl ecparam -genkey).

eclipse-vertx/vert.x · error · VertxException

Unsupported algorithm identifier

Error message

Unsupported algorithm identifier

What it means

Thrown by PrivateKeyParser.getPKCS8EncodedKeyAlgorithm when the AlgorithmIdentifier OID inside a PKCS#8 private key does not match the RSA or EC public key OIDs the parser knows. Vert.x only supports those two algorithms when converting PEM 'BEGIN PRIVATE KEY' blocks to PKCS#8 key specs. Any other algorithm (e.g. Ed25519, DSA) is rejected with this VertxException.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:116

    parser = sequence.getParser();
    BigInteger version = parser.read().getInteger();
    if (version.intValue() != 0) {
        throw new VertxException("Unsupported version, expected 0 but found " + version.intValue());
    }

    sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
        throw new VertxException("Invalid PKCS8 encoding: could not read Algorithm Identifier");
    }

    parser = sequence.getParser();
    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();
    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {
        return "RSA";
    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {
        return "EC";
    } else {
        throw new VertxException("Unsupported algorithm identifier");
    }
  }

  /**
   * Converts a DER encoded ECPrivateKey into a Java ECPrivateKeySpec.
   * <p>
   * <a href="https://datatracker.ietf.org/doc/html/rfc5915#section-3">
   * RFC 5915</a> defines the following ASN.1 syntax for an EC private key:
   * </p>
   * <pre>
   * ECPrivateKey ::= SEQUENCE {
   *   version        INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
   *   privateKey     OCTET STRING,
   *   parameters [0] ECParameters {{ NamedCurve }} OPTIONAL,
   *   publicKey  [1] BIT STRING OPTIONAL
   * }
   * </pre>
   * <p>

View on GitHub (pinned to fb308bd8c3)

Solutions

Regenerate the key as RSA or EC (e.g. openssl genpkey -algorithm RSA or openssl ecparam -genkey).
Convert/confirm the key is PKCS#8 PEM (BEGIN PRIVATE KEY, not BEGIN RSA PRIVATE KEY) using openssl pkcs8 -topk8.
If a non-RSA/EC algorithm is required, load the key outside this parser (e.g. java.security specs) instead of Vert.x pem options.
Verify the PEM was not double-encoded/corrupted so the OID bytes are intact.

Example fix

// before
openssl genpkey -algorithm ed25519 -out key.pem
// after
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out key.pem
openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem

Defensive patterns

Strategy: validation

Validate before calling

// Check the PKCS#8 algorithm OID before parsing
// RSA OID: 06 09 2A 86 48 86 F7 0D 01 01 01 ; EC OID: 06 07 2A 86 48 CE 3D 02 01
byte[] der = Base64.getMimeDecoder().decode(pemBody);
if (!startsWithRsaOid(der) && !startsWithEcOid(der)) {
    throw new IllegalArgumentException("Key algorithm must be RSA or EC");
}

Try / catch

try {
    PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
} catch (VertxException e) {
    if (e.getMessage().contains("Unsupported algorithm identifier")) {
        throw new KeyLoadException("Only RSA and EC keys are supported; got: " + e.getMessage());
    }
    throw e;
}

Prevention

Generate keys only as RSA or EC in OpenSSL config
Document the RSA/EC-only restriction wherever pemKeyCertOptions is configured
Validate key algorithm at startup with openssl pkey -in key.pem -noout -text before deploy

When it happens

Trigger: Loading a PEM key whose PKCS#8 AlgorithmIdentifier OID is neither 1.2.840.113549.1.1.1 (RSA) nor 1.2.840.10045.2.1 (EC); calling getPKCS8EncodedKeyAlgorithm on a DER buffer for an EdDSA, DSA, or X25519 key.

Common situations: Deploying an Ed25519 or DSA certificate key in a Vert.x keyStore/pemKeyCertOptions config; keys generated by tools that default to modern algorithms (e.g. ssh-keygen, OpenSSL with ed25519) while the app expects RSA/EC.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/03178714bf763b2f. Report an issue: GitHub.