elastic/elasticsearch · error · GeneralSecurityException

Error parsing key algorithm identifier. Algorithm with OID [

Error message

Error parsing key algorithm identifier. Algorithm with OID [{}] is not supported

What it means

Thrown by getKeyAlgorithmIdentifier when the OID embedded in the DER-encoded PKCS#8 private key info is not one of the three recognised algorithm OIDs: DSA (1.2.840.10040.4.1), RSA (1.2.840.113549.1.1.1), or EC (1.2.840.10045.2.1). It is a GeneralSecurityException and surfaces from parsePKCS8PemString and the encrypted PKCS#8 path.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java:679

     *
     * @param keyBytes the private key raw bytes
     * @return A string identifier for the key algorithm (RSA, DSA, or EC)
     * @throws GeneralSecurityException if the algorithm oid that is parsed from ASN.1 is unknown
     * @throws IOException if the DER encoded key can't be parsed
     */
    private static String getKeyAlgorithmIdentifier(byte[] keyBytes) throws IOException, GeneralSecurityException {
        DerParser parser = new DerParser(keyBytes);
        DerParser.Asn1Object sequence = parser.readAsn1Object();
        parser = sequence.getParser();
        parser.readAsn1Object().getInteger(); // version
        DerParser.Asn1Object algSequence = parser.readAsn1Object();
        parser = algSequence.getParser();
        String oidString = parser.readAsn1Object().getOid();
        return switch (oidString) {
            case "1.2.840.10040.4.1" -> "DSA";
            case "1.2.840.113549.1.1.1" -> "RSA";
            case "1.2.840.10045.2.1" -> "EC";
            default -> throw new GeneralSecurityException(
                "Error parsing key algorithm identifier. Algorithm with OID [" + oidString + "] is not supported"
            );
        };
    }

    public static List<Certificate> readCertificates(Collection<Path> certPaths) throws CertificateException, IOException {
        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
        List<Certificate> certificates = new ArrayList<>(certPaths.size());
        for (Path path : certPaths) {
            try (InputStream input = Files.newInputStream(path)) {
                final Collection<? extends Certificate> parsed = certFactory.generateCertificates(input);
                if (parsed.isEmpty()) {
                    throw new SslConfigException("failed to parse any certificates from [" + path.toAbsolutePath() + "]");
                }
                certificates.addAll(parsed);
            }
        }
        return certificates;

View on GitHub (pinned to db6a809a66)

Solutions

1. Regenerate the key using a supported algorithm: RSA ('openssl genrsa'), ECDSA P-256 ('openssl ecparam -genkey -name prime256v1'), or DSA.
2. If you need Ed25519/Ed448, configure the JVM/security provider accordingly and confirm Elasticsearch supports that key type in your version, or use RSA/EC instead.
3. Verify the DER body is intact (checksums) before re-parsing.

Example fix

// before: generate an Ed25519 key (unsupported OID)
//   openssl genpkey -algorithm Ed25519 -out ed.key
// after: generate an EC P-256 key (supported OID)
openssl ecparam -genkey -name prime256v1 -out ec.key

// Use OpenSSL to inspect the key algorithm before loading; supported OIDs are 1.2.840.10040.4.1 (DSA), 1.2.840.113549.1.1.1 (RSA), 1.2.840.10045.2.1 (EC).
// Shell check: openssl pkey -in <file> -noout -text and inspect the algorithm line; reject Ed25519/Ed448/X25519/DH.

try { PemUtils.readPrivateKey(path, passwordSupplier); }
catch (GeneralSecurityException e) { if (e.getMessage().contains("Algorithm with OID")) { /* switch to RSA/EC/DSA */ } else throw e; }

When it happens

Trigger: Loading a PKCS#8 key whose algorithm OID is for an unsupported algorithm (e.g. Ed25519 1.3.101.112, Ed448, X25519, DH, or a proprietary algorithm); a corrupted DER body where the algorithm OID bytes were altered; a key produced by a tool that emits an OID this parser does not whitelist.

Common situations: Operators switching to modern elliptic-curve keys (Ed25519/Ed448) which are not supported by this PEM parser; keys produced by recent OpenSSL ('openssl genpkey -algorithm Ed25519'); keys from cloud KMS exports; DER corruption from a bad transfer.

Related errors

• PKCS#8 Private Key is encrypted with unsupported PBES2 algor
• failed to load a KeyManager for certificate/key pair [{}], [
• could not load ssl private key file [{}]
• cannot create trust using PEM certificates [{}]
• could not load ssl private key file [{}]

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/001147f70f200ecd. Report an issue: GitHub.