What causes "Invalid DER: length too short" in elastic/elasticsearch?

Re-fetch or re-export the key; truncation is the dominant cause.

elastic/elasticsearch · error · IOException

Invalid DER: length too short

Error message

Invalid DER: length too short

What it means

Thrown by DerParser.getLength() when the long-form length header declared N continuation octets but InputStream.read(bytes) returned fewer than N. The length-of-length byte was plausible (<=4) but the stream was truncated right after it.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:139

     *
     * @return The length as integer
     */
    private int getLength() throws IOException {

        int i = derInputStream.read();
        if (i == -1) throw new IOException("Invalid DER: length missing");

        // A single byte short length
        if ((i & ~0x7F) == 0) return i;

        int num = i & 0x7F;

        // We can't handle length longer than 4 bytes
        if (i >= 0xFF || num > 4) throw new IOException("Invalid DER: length field too big (" + i + ")"); //$NON-NLS-2$

        byte[] bytes = new byte[num];
        int n = derInputStream.read(bytes);
        if (n < num) throw new IOException("Invalid DER: length too short");

        int len = new BigInteger(1, bytes).intValue();
        if (len < 0) {
            throw new IOException("Invalid DER: length larger than max-int");
        }

        return len;
    }

    /**
     * An ASN.1 TLV. The object is not parsed. It can
     * only handle integers.
     *
     * @author zhang
     */
    public static class Asn1Object {

        protected final int type;

View on GitHub (pinned to db6a809a66)

Solutions

Re-fetch or re-export the key; truncation is the dominant cause.
Validate file size against a known-good reference.
If you build the byte[] in code, double-check the slice bounds.
Cross-check with `openssl asn1parse -inform DER -in key.der` — it will report a similar short-read.

Example fix

// before: trailing bytes lost during transfer
byte[] shortDer = Arrays.copyOfRange(fullDer, 0, fullDer.length - 2);
new DerParser(shortDer).readAsn1Object();

// after: use full file
byte[] fullDer = Files.readAllBytes(Path.of("key.der"));
new DerParser(fullDer).readAsn1Object();

Defensive patterns

Strategy: validation

Validate before calling

private static void requireLengthBytesPresent(byte[] der, int idx, int num) {
    if (idx + num > der.length) {
        throw new IllegalArgumentException("length-of-length declares " + num + " bytes but only " + (der.length - idx) + " remain");
    }
}

Prevention

Validate the byte[] length covers the declared length-of-length before parsing.
Use sha256 checksums to catch truncation after file transfers.
Slice DER buffers using the outer SEQUENCE length, not guessed offsets.

When it happens

Trigger: getLength() enters long form, computes num = i & 0x7F (1..4), allocates bytes[num], then derInputStream.read(bytes) returns n < num. Common when the DER is cut off in the middle of a multi-byte length field.

Common situations: Truncated download, copy/paste that dropped bytes from a binary DER file, base64 corruption that lost trailing characters, or a buffer that was sliced one or two bytes too short.

Related errors

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/47279d108cf12473. Report an issue: GitHub.