elastic/elasticsearch · error · GeneralSecurityException

Error parsing EC named curve identifier. Named curve with OI

Error message

Error parsing EC named curve identifier. Named curve with OID: {} is not supported

What it means

Thrown by PemUtils while parsing a PEM-encoded EC private key. The parser reads the named-curve OID from the ECPrivateKey structure and maps it to a JCA curve name via a fixed switch table; any OID not listed falls through to this GeneralSecurityException. The table covers only the standard SEC2/NIST curves (secp224r1 through sect571r1).

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java:746

    private static String getEcCurveNameFromOid(String oidString) throws GeneralSecurityException {
        return switch (oidString) {
            // see https://tools.ietf.org/html/rfc5480#section-2.1.1.1
            case "1.2.840.10045.3.1" -> "secp192r1";
            case "1.3.132.0.1" -> "sect163k1";
            case "1.3.132.0.15" -> "sect163r2";
            case "1.3.132.0.33" -> "secp224r1";
            case "1.3.132.0.26" -> "sect233k1";
            case "1.3.132.0.27" -> "sect233r1";
            case "1.2.840.10045.3.1.7" -> "secp256r1";
            case "1.3.132.0.16" -> "sect283k1";
            case "1.3.132.0.17" -> "sect283r1";
            case "1.3.132.0.34" -> "secp384r1";
            case "1.3.132.0.36" -> "sect409k1";
            case "1.3.132.0.37" -> "sect409r1";
            case "1.3.132.0.35" -> "secp521r1";
            case "1.3.132.0.38" -> "sect571k1";
            case "1.3.132.0.39" -> "sect571r1";
            default -> throw new GeneralSecurityException(
                "Error parsing EC named curve identifier. Named curve with OID: " + oidString + " is not supported"
            );
        };
    }

}

View on GitHub (pinned to db6a809a66)

Solutions

Regenerate the key with a supported curve: openssl ecparam -name prime256v1 -genkey -noout -out ec.key (prime256v1=secp256r1; also secp384r1, secp521r1).
If you must keep an unsupported curve, switch the node to RSA keys (RSA is not subject to the OID table).
Re-issue the cert/key from a CA that signs over a supported curve before configuring ssl.certificate / ssl.key.

Example fix

// before: key generated with an unsupported curve
//   openssl ecparam -name brainpoolP256r1 -genkey ...
// after: regenerate with a curve present in the switch table
//   openssl ecparam -name prime256v1 -genkey -noout -out node-ec.key
//   openssl req -new -x509 -key node-ec.key -out node-ec.crt -days 730

Defensive patterns

Strategy: validation

Validate before calling

// Before loading the EC key, confirm its curve is supported.
private static final Set<String> SUPPORTED_EC_OIDS = Set.of(
    "1.3.132.0.33","1.3.132.0.26","1.3.132.0.27","1.2.840.10045.3.1.7",
    "1.3.132.0.16","1.3.132.0.17","1.3.132.0.34","1.3.132.0.36",
    "1.3.132.0.37","1.3.132.0.35","1.3.132.0.38","1.3.132.0.39"
);
void checkCurve(byte[] pkcs8EcKey) throws Exception {
    var spec = PKCS8EncodedKeySpec(pkcs8EcKey);
    var k = KeyFactory.getInstance("EC").generatePrivate(spec);
    var oid = ((java.security.interfaces.ECPrivateKey) k).getParams()
                  .getCurve().toString(); // or AlgorithmParameters -> ECParameterSpec -> OID
    if (!SUPPORTED_EC_OIDS.contains(oid))
        throw new IllegalArgumentException("Unsupported EC curve; regenerate with secp256r1/secp384r1/secp521r1");
}

Try / catch

try {
    var keyConfig = new PemKeyConfig(cert, key, pwd, base);
} catch (GeneralSecurityException e) {
    if (e.getMessage().contains("Named curve with OID")) {
        log.error("EC curve not supported by PemUtils; regenerate key with a NIST/SEC2 curve");
    }
    throw e;
}

Prevention

Standardise on prime256v1/secp384r1/secp521r1 when generating keys for Elasticsearch nodes.
Document the supported curve list in your PKI runbook so cert signers use a supported curve.
Validate keys in CI (openssl ecparam -text) before they reach a node's config.

When it happens

Trigger: Loading an EC private key (PEM) whose curve OID is outside the hardcoded list — e.g. brainpoolP160r1 (1.3.36.3.3.2.8.1.1.1), prime192v1/secp192r1 (1.2.840.10045.3.1.1), or any new/proprietary curve. Triggered when SslConfigurationLoader builds a PemKeyConfig and the key is decoded.

Common situations: Org mandates a non-NIST curve (Brainpool, sm2p256v1); a legacy key generated on older OpenSSL with a deprecated curve; copy of a key from a different PKI that uses curve not in the SEC2 set expected by Elasticsearch.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/e98ffec913693719. Report an issue: GitHub.