elastic/elasticsearch · error · IOException

Invalid DER: stream too short, missing tag

Error message

Invalid DER: stream too short, missing tag

What it means

Thrown as IOException by DerParser.readAsn1Object() when the underlying DER input stream has no more bytes at the point where a tag byte is expected (derInputStream.read() returns -1). This indicates the DER-encoded data is truncated or empty. DerParser is used by PemUtils to decode private keys, so this fires during SSL key loading when the byte stream is too short.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:84

     * Read an object and verify its type
     * @param requiredType The expected type code
     * @throws IOException if data can not be parsed
     * @throws IllegalStateException if the parsed object is of the wrong type
     */
    public Asn1Object readAsn1Object(int requiredType) throws IOException {
        final Asn1Object obj = readAsn1Object();
        if (obj.type != requiredType) {
            throw new IllegalStateException(
                "Expected ASN.1 object of type 0x" + Integer.toHexString(requiredType) + " but was 0x" + Integer.toHexString(obj.type)
            );
        }
        return obj;
    }

    public Asn1Object readAsn1Object() throws IOException {
        int tag = derInputStream.read();
        if (tag == -1) {
            throw new IOException("Invalid DER: stream too short, missing tag");
        }
        int length = getLength();
        // getLength() can return any 32 bit integer, so ensure that a corrupted encoding won't
        // force us into allocating a very large array
        if (length > maxAsnObjectLength) {
            throw new IOException(
                "Invalid DER: size of ASN.1 object to be parsed appears to be larger than the size of the key file " + "itself."
            );
        }
        byte[] value = new byte[length];
        int n = derInputStream.read(value);
        if (n < length) {
            throw new IOException(
                "Invalid DER: stream too short, missing value. " + "Could only read " + n + " out of " + length + " bytes"
            );
        }
        return new Asn1Object(tag, length, value);

View on GitHub (pinned to db6a809a66)

Solutions

1. Check the file is non-empty and contains a valid Base64 body between PEM headers: cat key.pem (look for BEGIN/END with content between).
2. Re-download or re-export the key file and verify its size is non-zero.
3. Strip BOM/CRLF: sed -i 's/\r$//' key.pem; and ensure no stray HTML or whitespace.
4. Validate with openssl: openssl pkey -in key.pem -noout (should exit 0 if the key parses).

Example fix

# before — empty or header-only PEM file
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----

# after — valid key with a complete Base64 body
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD...
[full base64 content]
-----END PRIVATE KEY-----

byte[] der = pemToDer(keyPemContent);
if (der == null || der.length == 0) {
    throw new IllegalArgumentException("PEM key body is empty or could not be decoded");
}

try {
    DerParser parser = new DerParser(derBytes);
    Asn1Object obj = parser.readAsn1Object();
} catch (IOException e) {
    if (e.getMessage().contains("stream too short")) {
        // input is empty or truncated
        log.error("DER input is empty or truncated; verify the PEM file has a complete Base64 body");
    }
    throw e;
}

When it happens

Trigger: Constructing a DerParser from a byte array and calling readAsn1Object() when the array is empty, or after consuming all bytes but attempting to read more objects. In PemUtils this happens when the PEM-to-DER conversion produced zero bytes or the key body is missing.

Common situations: An empty or whitespace-only PEM file, a PEM file whose Base64 body was stripped (only headers/footers remain), a copy/paste truncation of the key, or a file encoding issue (e.g. UTF-8 BOM or CRLF line endings disrupting Base64 decoding). Also when a non-key file (e.g. a CSR or an HTML error page from a download) is mistakenly used as a private key.

Related errors

• Expected ASN.1 object of type 0x{} but was 0x{}
• Cannot combine trust configurations [{}]
• failed to initialize a TrustManager for the system keystore
• failed to load the system PKCS#11 truststore
• Invalid DER: size of ASN.1 object to be parsed appears to be

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/e5ecd1fbdb1eb6d1. Report an issue: GitHub.