elastic/elasticsearch · error · IllegalStateException

Expected ASN.1 object of type 0x{} but was 0x{}

Error message

Expected ASN.1 object of type 0x{} but was 0x{}

What it means

Thrown as IllegalStateException by DerParser.readAsn1Object(int requiredType) when a parsed ASN.1 DER object's tag byte does not match the expected type code. DerParser is a minimal ASN.1/DER decoder used by PemUtils to parse private keys (RSA PKCS#1, DSA, EC, PKCS#8 encrypted/unencrypted). Each read in the key-parsing sequence expects a specific type (SEQUENCE, INTEGER, OID, OCTET_STRING); if the bytes don't conform, this fires.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:74

    private InputStream derInputStream;
    private int maxAsnObjectLength;

    public DerParser(byte[] bytes) {
        this.derInputStream = new ByteArrayInputStream(bytes);
        this.maxAsnObjectLength = bytes.length;
    }

    /**
     * Read an object and verify its type
     * @param requiredType The expected type code
     * @throws IOException if data can not be parsed
     * @throws IllegalStateException if the parsed object is of the wrong type
     */
    public Asn1Object readAsn1Object(int requiredType) throws IOException {
        final Asn1Object obj = readAsn1Object();
        if (obj.type != requiredType) {
            throw new IllegalStateException(
                "Expected ASN.1 object of type 0x" + Integer.toHexString(requiredType) + " but was 0x" + Integer.toHexString(obj.type)
            );
        }
        return obj;
    }

    public Asn1Object readAsn1Object() throws IOException {
        int tag = derInputStream.read();
        if (tag == -1) {
            throw new IOException("Invalid DER: stream too short, missing tag");
        }
        int length = getLength();
        // getLength() can return any 32 bit integer, so ensure that a corrupted encoding won't
        // force us into allocating a very large array
        if (length > maxAsnObjectLength) {
            throw new IOException(
                "Invalid DER: size of ASN.1 object to be parsed appears to be larger than the size of the key file " + "itself."
            );

View on GitHub (pinned to db6a809a66)

Solutions

1. Verify the key format: openssl pkey -in key.pem -noout -text (or openssl rsa -in key.pem for RSA).
2. Convert the key to a supported format: openssl pkcs8 -topk8 -in key.pem -out key_pkcs8.pem -nocrypt.
3. Ensure you are loading a private key (BEGIN PRIVATE KEY / BEGIN RSA PRIVATE KEY / BEGIN EC PRIVATE KEY), not a certificate or public key.
4. Check that the PEM file is not truncated or corrupted (compare checksums if transferred).

Example fix

# before — supplying an EC key where the config expects RSA PKCS#1
# elasticsearch.yml: ssl.key: ec-key.pem

# after — convert to PKCS#8 unencrypted, universally parsed
openssl pkcs8 -topk8 -in ec-key.pem -out key_pkcs8.pem -nocrypt
# elasticsearch.yml: ssl.key: key_pkcs8.pem

try {
    KeyPair kp = PemUtils.readPrivateKey(keyPath, password);
} catch (IllegalStateException | IOException e) {
    // 'Expected ASN.1 object of type 0x..' means the DER structure doesn't match the expected key format
    log.error("Private key parse failed (type mismatch): {}", e.getMessage());
    // convert the key with: openssl pkcs8 -topk8 -in key.pem -out key_pkcs8.pem -nocrypt
}

When it happens

Trigger: PemUtils reads a PEM-encoded private key, converts it to DER, and calls readAsn1Object(requiredType) at each step. If the DER bytes are structurally valid but encode a different type than expected (e.g. the parser expects SEQUENCE but reads an INTEGER), the tag mismatch throws. Triggered during SSL configuration when loading a private key.

Common situations: The private key file is in an unexpected format (e.g. an EC key where an RSA key was expected, or a PKCS#8 key where PKCS#1 was expected). The PEM file is truncated or contains extra headers. A certificate file was accidentally supplied where a private key was required. The key uses an algorithm or wrapping not handled by the specific parser branch.

Related errors

• Invalid DER: stream too short, missing tag
• Cannot combine trust configurations [{}]
• failed to initialize a TrustManager for the system keystore
• failed to load the system PKCS#11 truststore
• Invalid DER: size of ASN.1 object to be parsed appears to be

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/c63ee05f9bc5cf53. Report an issue: GitHub.