elastic/elasticsearch · error · IOException

Malformed PEM file, EC Parameters footer is missing

Error message

Malformed PEM file, EC Parameters footer is missing

What it means

Thrown by removeECHeaders, which is invoked when the file begins with '-----BEGIN EC PARAMETERS-----'. The method scans for the matching '-----END EC PARAMETERS-----' line; if EOF is reached without finding it (line == null) or the matched line is not the EC PARAMETERS footer, the PEM is considered truncated or malformed. This guards the OpenSSL EC PARAMETERS block that precedes the actual EC PRIVATE KEY block.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java:181

        }
    }

    /**
     * Removes the EC Headers that OpenSSL adds to EC private keys as the information in them
     * is redundant
     *
     * @throws IOException if the EC Parameter footer is missing
     */
    private static BufferedReader removeECHeaders(BufferedReader bReader) throws IOException {
        String line = bReader.readLine();
        while (line != null) {
            if (OPENSSL_EC_PARAMS_FOOTER.equals(line.trim())) {
                break;
            }
            line = bReader.readLine();
        }
        if (null == line || OPENSSL_EC_PARAMS_FOOTER.equals(line.trim()) == false) {
            throw new IOException("Malformed PEM file, EC Parameters footer is missing");
        }
        // Verify that the key starts with the correct header before passing it to parseOpenSslEC
        if (OPENSSL_EC_HEADER.equals(bReader.readLine()) == false) {
            throw new IOException("Malformed PEM file, EC Key header is missing");
        }
        return bReader;
    }

    /**
     * Removes the DSA Params Headers that OpenSSL adds to DSA private keys as the information in them
     * is redundant
     *
     * @throws IOException if the EC Parameter footer is missing
     */
    private static BufferedReader removeDsaHeaders(BufferedReader bReader) throws IOException {
        String line = bReader.readLine();
        while (line != null) {
            if (OPENSSL_DSA_PARAMS_FOOTER.equals(line.trim())) {

View on GitHub (pinned to db6a809a66)

Solutions

1. Open the file and confirm both '-----BEGIN EC PARAMETERS-----' and '-----END EC PARAMETERS-----' lines are present on their own lines with no surrounding text.
2. Regenerate the key: 'openssl ecparam -genkey -name prime256v1 -out ec-key.pem' and inspect with 'cat ec-key.pem'.
3. If the file was transferred, re-copy it in binary mode and verify checksums (md5sum/sha256sum) before and after.
4. Strip any trailing whitespace or BOM: 'sed -i 's/[[:space:]]*$//' ec-key.pem'.

// Confirm a file with an EC PARAMETERS header also has its footer before parsing
static boolean hasMatchingFooter(Path p, String begin, String end) throws IOException {
    String first = null; boolean sawEnd = false;
    try (BufferedReader r = Files.newBufferedReader(p, StandardCharsets.UTF_8)) {
        String line;
        while ((line = r.readLine()) != null) {
            if (first == null && line.trim().equals(begin)) first = line.trim();
            if (first != null && line.trim().equals(end)) { sawEnd = true; break; }
        }
    }
    return first != null && sawEnd;
}

try {
    PemUtils.readPrivateKey(path, passwordSupplier);
} catch (IOException e) {
    if (e.getMessage().contains("EC Parameters footer is missing")) {
        // alert: file is truncated; re-issue the key
    } else throw e;
}

When it happens

Trigger: Loading an OpenSSL-generated EC key file that contains '-----BEGIN EC PARAMETERS-----' but is missing or has a corrupted '-----END EC PARAMETERS-----' line; the file was truncated during copy/sync; the footer was renamed by a text editor or sanitiser that stripped 'END' markers.

Common situations: Key file truncated by a deployment pipeline (rsync --partial, scp interruption, kubectl configmap size limits); a templating system (Helm, Ansible) that strips trailing lines; manual editing that removed the footer; CRLF/LF mismatch where the trailing whitespace breaks the strict equals check.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Malformed PEM file, EC Key header is missing
• could not load ssl private key file [{}]
• Error parsing Private Key [{}], file is empty
• cannot read encrypted key [{}] without a password
• cannot read PEM private key [{}] because the file does not c

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/6afba75d32260c91. Report an issue: GitHub.