elastic/elasticsearch · error · IOException

Invalid DER: object is not integer

Error message

Invalid DER: object is not integer

What it means

Thrown by Asn1Object.getInteger() when the parsed object's type field is not Type.INTEGER (0x02). The parser refuses to interpret arbitrary bytes as a signed two's-complement integer; calling getInteger() on a SEQUENCE, OCTET STRING, OID, or any other type triggers this.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:229

         * For constructed field, return a parser for its content.
         *
         * @return A parser for the construct.
         */
        public DerParser getParser() throws IOException {
            if (isConstructed() == false) {
                throw new IOException("Invalid DER: can't parse primitive entity"); //$NON-NLS-1$
            }

            return new DerParser(value);
        }

        /**
         * Get the value as integer
         *
         * @return BigInteger
         */
        public BigInteger getInteger() throws IOException {
            if (type != Type.INTEGER) throw new IOException("Invalid DER: object is not integer"); //$NON-NLS-1$

            return new BigInteger(value);
        }

        public String getString() throws IOException {

            String encoding;

            switch (type) {
                case Type.OCTET_STRING:
                    // octet string is basically a byte array
                    return toHexString(value);
                case Type.NUMERIC_STRING:
                case Type.PRINTABLE_STRING:
                case Type.VIDEOTEX_STRING:
                case Type.IA5_STRING:
                case Type.GRAPHIC_STRING:
                case Type.ISO646_STRING:

View on GitHub (pinned to db6a809a66)

Solutions

1. Confirm the key format matches the parser being used (RSA PKCS#1, DSA OpenSSL, EC SEC1).
2. Re-export with standard tooling: `openssl pkcs8 -topk8 -in key.pem -out key.pk8.pem` for a unified PKCS#8 wrapper that PemUtils handles via parsePKCS8.
3. Hex-dump and use `openssl asn1parse` to confirm the expected INTEGER sequence.
4. If migrating from another JVM crypto stack, regenerate keys to avoid proprietary encodings.

Example fix

// before: RSA key bytes parsed as EC
byte[] rsaDer = ...;
DerParser p = new DerParser(rsaDer);
DerParser.Asn1Object seq = p.readAsn1Object();
seq.getParser().readAsn1Object().getInteger(); // ok
seq.getParser().readAsn1Object().getInteger(); // may throw if misaligned

// after: route by detected format (let PemUtils.parsePrivateKey dispatch)
PrivateKey pk = PemUtils.parsePrivateKey(keyPath, () -> null);

public static boolean isIntegerElement(DerParser.Asn1Object o) {
    return o != null && o.getType() == DerParser.Type.INTEGER;
}

// Usage:
// if (!isIntegerElement(elem)) throw new IOException("expected INTEGER");
// BigInteger v = elem.getInteger();

When it happens

Trigger: In the RSA/DSA/EC DER parsers (parseRsaDer line 628+, parseDsaDer line 651+, parseEcDer line 603), getInteger() is called sequentially on elements expected to be INTEGER. If the DER is misaligned (a field is the wrong type) or the key uses an unexpected structure, getInteger() hits a non-INTEGER element.

Common situations: Wrong key format fed to a format-specific parser (PKCS#1 RSA bytes fed to parseEcDer, or a malformed key where one element was dropped/added), corruption that shifts alignment, or a key from a non-conformant generator.

Related errors

• Invalid DER: size of ASN.1 object to be parsed appears to be
• Invalid DER: stream too short, missing value. Could only rea
• Invalid DER: length missing
• Invalid DER: length field too big ({})
• Invalid DER: length too short

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/fa81765be1439499. Report an issue: GitHub.