elastic/elasticsearch · error · IOException

Ivalid DER: object is not object OID

Error message

Ivalid DER: object is not object OID

What it means

Thrown by Asn1Object.getOid() when the element's type is not Type.OBJECT_OID (0x06). The OID-decoding logic only runs on actual OID elements; calling getOid() on a different type (INTEGER, SEQUENCE, etc.) is rejected. Note the message has a typo ('Ivalid' rather than 'Invalid') preserved for backward compatibility.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java:273

                case Type.UTF8_STRING:
                    encoding = "UTF-8"; //$NON-NLS-1$
                    break;

                case Type.UNIVERSAL_STRING:
                    throw new IOException("Invalid DER: can't handle UCS-4 string"); //$NON-NLS-1$

                default:
                    throw new IOException("Invalid DER: object is not a string"); //$NON-NLS-1$
            }

            return new String(value, encoding);
        }

        public String getOid() throws IOException {

            if (type != Type.OBJECT_OID) {
                throw new IOException("Ivalid DER: object is not object OID");
            }
            StringBuilder sb = new StringBuilder(64);
            switch (value[0] / 40) {
                case 0 -> sb.append('0');
                case 1 -> {
                    sb.append('1');
                    value[0] -= 40;
                }
                default -> {
                    sb.append('2');
                    value[0] -= 80;
                }
            }
            int oidPart = 0;
            for (int i = 0; i < length; i++) {
                oidPart = (oidPart << 7) + (value[i] & 0x7F);
                if ((value[i] & 0x80) == 0) {
                    sb.append('.');

View on GitHub (pinned to db6a809a66)

Solutions

1. Re-export the key as standard PKCS#8: `openssl pkcs8 -topk8 -in key.pem -out key.pk8.pem`.
2. Validate the algorithm OID with `openssl asn1parse -inform DER -in key.der`.
3. Confirm the file is actually PKCS#8 DER (the outer structure is SEQUENCE { version INTEGER, algorithm SEQUENCE { OID, ... }, ... }).
4. If the OID is correct but unknown, check whether the algorithm (e.g. Ed25519) is supported by this library version.

Example fix

// before: feeding a non-PKCS#8 DER to getKeyAlgorithmIdentifier
String algo = getKeyAlgorithmIdentifier(rsaPkcs1Bytes); // misaligned -> throws

// after: use the unified PEM entry point that dispatches by header
PrivateKey pk = PemUtils.parsePrivateKey(keyPath, passwordSupplier);

public static boolean isOidElement(DerParser.Asn1Object o) {
    return o != null && o.getType() == DerParser.Type.OBJECT_OID;
}

// Usage:
// if (!isOidElement(elem)) throw new IOException("expected OID");
// String oid = elem.getOid();

When it happens

Trigger: getOid() called on a non-OID element. In getKeyAlgorithmIdentifier (line 674) and getEncryptedPrivateKeyInfo (line 419, 426), getOid() is called on elements that should be OIDs — if the DER is misaligned (e.g. a SEQUENCE was read where an OID was expected), this fires.

Common situations: Malformed PKCS#8 whose algorithm-identifier sequence lacks the OID at the expected position, a non-PKCS#8 blob fed to getKeyAlgorithmIdentifier, or corruption that shifts alignment.

Related errors

• Invalid DER: size of ASN.1 object to be parsed appears to be
• Invalid DER: stream too short, missing value. Could only rea
• Invalid DER: length missing
• Invalid DER: length field too big ({})
• Invalid DER: length too short

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/b326beb0e112688e. Report an issue: GitHub.