elastic/elasticsearch · error · IOException

Invalid DER: length missing

Error message

Invalid DER: length missing

What it means

Thrown by DerParser.getLength() when the very first byte of the length field could not be read (derInputStream.read() returned -1). This means the parser hit end-of-stream immediately after a tag byte, so there is no length octet at all.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:127

     *          In BER/DER encoding, length can be encoded in 2 forms:
     * </p>
     * <ul>
     * <li>Short form. One octet. Bit 8 has value "0" and bits 7-1
     * give the length.
     * </li>
     * <li>Long form. Two to 127 octets (only 4 is supported here).
     * Bit 8 of first octet has value "1" and bits 7-1 give the
     * number of additional length octets. Second and following
     * octets give the length, base 256, most significant digit first.
     * </li>
     * </ul>
     *
     * @return The length as integer
     */
    private int getLength() throws IOException {

        int i = derInputStream.read();
        if (i == -1) throw new IOException("Invalid DER: length missing");

        // A single byte short length
        if ((i & ~0x7F) == 0) return i;

        int num = i & 0x7F;

        // We can't handle length longer than 4 bytes
        if (i >= 0xFF || num > 4) throw new IOException("Invalid DER: length field too big (" + i + ")"); //$NON-NLS-2$

        byte[] bytes = new byte[num];
        int n = derInputStream.read(bytes);
        if (n < num) throw new IOException("Invalid DER: length too short");

        int len = new BigInteger(1, bytes).intValue();
        if (len < 0) {
            throw new IOException("Invalid DER: length larger than max-int");
        }

View on GitHub (pinned to db6a809a66)

Solutions

1. Check that the key file is non-empty: `wc -c keyfile` should report more than a few hundred bytes.
2. Re-export the key from its source of truth.
3. If generating the byte[] yourself, assert it is non-empty before constructing DerParser.
4. Inspect with `openssl pkey -in key.pem -noout` to confirm the file parses externally.

Example fix

// before
byte[] empty = Base64.getDecoder().decode(""); // from a stripped PEM
new DerParser(empty).readAsn1Object();

// after: guard upstream
if (der.length == 0) throw new IllegalArgumentException("empty DER input");
new DerParser(der).readAsn1Object();

private static void requireNonEmpty(byte[] der) {
    if (der == null || der.length == 0) {
        throw new IllegalArgumentException("DER input is empty; cannot read length");
    }
}

When it happens

Trigger: Inside getLength(), called from readAsn1Object(): after a tag byte was consumed, the next read() returns -1. Happens when the DER ends right after a tag (length zero or trailing single byte), or when the input was an empty/whitespace byte array handed to DerParser.

Common situations: Empty key file, file that contains only a PEM header but no body, base64-decode of an empty string yielding a zero-length byte[], or a corrupted DER that is one byte short.

Related errors

• Invalid DER: size of ASN.1 object to be parsed appears to be
• Invalid DER: stream too short, missing value. Could only rea
• Invalid DER: length field too big ({})
• Invalid DER: length too short
• Invalid DER: length larger than max-int

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/3938382d25381592. Report an issue: GitHub.