eclipse-vertx/vert.x · error · VertxException

Unsupported version, expected 0 but found

Error message

Unsupported version, expected 0 but found

What it means

In PKCS#8 PrivateKeyInfo, the version field must be 0. getPKCS8EncodedKeyAlgorithm reads the first INTEGER after the SEQUENCE and throws VertxException('Unsupported version, expected 0 but found N') for any other value, meaning the structure is not a v1 PKCS#8 private key.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:101

   *
   * @param encodedKey The encoded private key.
   * @return The algorithm name, either <em>RSA</em> or <em>EC</em>, depending on
   *         the algorithm identifier found in the encoded key.
   * @throws VertxException if the key is not PKCS#8 encoded or uses an unsupported
   *         algorithm.
   */
  public static String getPKCS8EncodedKeyAlgorithm(byte[] encodedKey) {

    DerParser parser = new DerParser(encodedKey);
    Asn1Object sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
      throw new VertxException("Invalid PKCS8 encoding: not a sequence");
    }

    parser = sequence.getParser();
    BigInteger version = parser.read().getInteger();
    if (version.intValue() != 0) {
        throw new VertxException("Unsupported version, expected 0 but found " + version.intValue());
    }

    sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
        throw new VertxException("Invalid PKCS8 encoding: could not read Algorithm Identifier");
    }

    parser = sequence.getParser();
    byte[] algorithmIdentifier = parser.read().getObjectIdentifier();
    if (Arrays.equals(OID_RSA_PUBLIC_KEY, algorithmIdentifier)) {
        return "RSA";
    } else if (Arrays.equals(OID_EC_PUBLIC_KEY, algorithmIdentifier)) {
        return "EC";
    } else {
        throw new VertxException("Unsupported algorithm identifier");
    }
  }

View on GitHub (pinned to fb308bd8c3)

Solutions

  1. Regenerate/convert the key to standard unencrypted PKCS#8 v1: openssl pkcs8 -topk8 -nocrypt
  2. Check the exception message for the actual version found and verify which format the file really is (openssl asn1parse)
  3. Ensure you are passing a private key, not a certificate or CSR

Example fix

// before
byte[] der = Files.readAllBytes(Path.of("cert.der")); // certificate, not a key
String alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
// after
byte[] der = Files.readAllBytes(Path.of("key8.der")); // PKCS#8 v1 private key
String alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
Defensive patterns

Strategy: validation

Validate before calling

// ensure the file is a PKCS#8 v1 private key
// openssl asn1parse -in key.pem  -> version INTEGER :0
if (!Files.readString(pemPath).startsWith("-----BEGIN PRIVATE KEY-----")) {
  throw new IllegalArgumentException("not an unencrypted PKCS#8 private key");
}

Try / catch

try {
  alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
} catch (VertxException e) {
  // message names the found version; reconvert key to PKCS#8 v1
}

Prevention

When it happens

Trigger: Passing a DER structure that otherwise looks like PKCS#8 but has a nonzero version — e.g. v2 PKCS#8 (encrypted/altered structures) or a completely different ASN.1 structure whose first field is a nonzero INTEGER.

Common situations: Keys from nonstandard tooling, encrypted PKCS#8 variants, or passing an X.509 certificate DER instead of a private key DER.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/f733ea97cb0c0c15. Report an issue: GitHub.