Algid parse error, not a sequence

Question

When trying to read a RSA private key from a file using the method

public PrivateKey getPrivateKey()
        throws NoSuchAlgorithmException,
        InvalidKeySpecException, IOException {

    final InputStream inputStream = getClass().getClassLoader()
                    .getResourceAsStream("privatekey");
    byte[] privKeyBytes = null;
    try {
        privKeyBytes = IOUtils.toByteArray(inputStream);
    } catch (final IOException exception) {
        LOGGER.error("", exception);
        IOUtils.closeQuietly(inputStream);
    }

    LOGGER.debug("privKeyBytes: {}", privKeyBytes);

    String BEGIN = "-----BEGIN RSA PRIVATE KEY-----";
    String END = "-----END RSA PRIVATE KEY-----";
    String str = new String(privKeyBytes);
    if (str.contains(BEGIN) && str.contains(END)) {
        str = str.substring(BEGIN.length(), str.lastIndexOf(END));
    }

    KeyFactory fac = KeyFactory.getInstance("RSA");
    EncodedKeySpec privKeySpec =
            new PKCS8EncodedKeySpec(Base64.decode(str.getBytes()));
    return fac.generatePrivate(privKeySpec);
}

I get the exception

java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException : algid parse error, not a sequence
    at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:200) ~[na:1.6.0_23]
    at java.security.KeyFactory.generatePrivate(KeyFactory.java:342) ~[na:1.6.0_23]

at the fac.generatePrivate(privKeySpec) call.

What does this error mean?

Thanks

Dmitri

Dimitris · Accepted Answer · 2013-09-20 08:43:31Z

170

I was having this same issue, and the format of the key was NOT the actual problem.
All I had to do to get rid of that exception was to call

java.security.Security.addProvider(
         new org.bouncycastle.jce.provider.BouncyCastleProvider()
);

and everything worked

answered Sep 20, 2013 at 8:43

Dimitris

4,3975 gold badges28 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

Tobi Akinyemi Over a year ago

How does this fix the issue?

barathz Over a year ago

It works...but why?!

Filomat Over a year ago

How does this magic work? 0_o

Samet Baskıcı Over a year ago

What is the magic behind this?

Given Over a year ago

Wow thank you time saver! I added following dependancy to get the BouncyCastleProvider: <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcprov-jdk15on</artifactId> <version>1.70</version> </dependency>

|

yegor256 · Accepted Answer · 2013-06-27 06:20:19Z

114

It means your key is not in PKCS#8 format. The easiest thing to do is to use the openssl pkcs8 -topk8 <...other options...> command to convert the key once. Alternatively you can use the PEMReader class of the Bouncycastle lightweight API.

edited Jun 27, 2013 at 6:20

yegor256

106k131 gold badges466 silver badges633 bronze badges

answered Jul 2, 2011 at 23:37

President James K. Polk

42.3k34 gold badges113 silver badges149 bronze badges

3 Comments

Glory to Russia Over a year ago

Thanks, it worked. Here's the command: openssl pkcs8 -topk8 -nocrypt -in myrsakey.pem -out myrsakey_pcks8

Satish Patro Over a year ago

if it is not in PKCS8 format, what format it can be? If multiple options it can be, how to know the format before converting to PKCS8 using OPENSSL command?

President James K. Polk Over a year ago

@PSatishPatro: The private key was in PKCS#1 format. In this case the clue was the "-----BEGIN RSA PRIVATE KEY-----" which signals this is a PKCS#1 private in "PEM" format.

Community · Accepted Answer · 2020-06-20 09:12:55Z

90

You must make your PCKS8 file from your private key!

private.pem => name of private key file

openssl genrsa -out private.pem 1024

public_key.pem => name of public key file

openssl rsa -in private.pem -pubout -outform PEM -out public_key.pem

‫‪private_key.pem‬‬ => name of private key with PCKS8 format! you can just read this format in java

openssl pkcs8 -topk8 -inform PEM -in private.pem -out private_key.pem -nocrypt

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Oct 28, 2017 at 9:58

Pasha

1,65517 silver badges29 bronze badges

7 Comments

Guss Over a year ago

This was my problem - the file was generated using genrsa which creates a PKCS#1 format (this is the format the OP loads, as can be seen by the BEGIN RSA PRIVATE KEY header), while PKCS#8 is a different format (and in PEM encoding can be detect due to the different header: BEGIN PRIVATE KEY). My key generator now looks like this: openssl genrsa 2048 | openssl pkcs8 -topk8 -nocrypt -out private.pem

Rahul Agrawal Over a year ago

Do you have a similar key generator for EC private key?

Pasha Over a year ago

@RahulAgrawal, unfortunately, don't have

Sai Ram Reddy Over a year ago

What about the public key ? Will it be in PKCS#8 format by default ?

Pasha Over a year ago

@SaiRamReddy "-outform PEM" sets output format, take a look at documentation: openssl.org/docs/man1.0.2/man1/openssl-rsa.html

|

Shashanth · Accepted Answer · 2024-10-22 07:05:46Z

0

I faced a similar issue in Spring Boot REST API. I was calling DocuSign APIs from Spring Boot code. It was working fine in the local environment but after deploying the war file in Tomcat 9 server, it started throwing an error:

java.security.InvalidKeyException: IOException : algid parse error, not a sequence

Then I restarted the Tomcat service, and it started working as expected. Maybe Tomcat failed to load BouncyCastleProvider into the classpath.

I hope this will be helpful to someone who visits this question in the future.

answered Oct 22, 2024 at 7:05

Shashanth

5,2208 gold badges44 silver badges53 bronze badges

Collectives™ on Stack Overflow

Algid parse error, not a sequence

4 Answers 4

9 Comments

3 Comments

private.pem => name of private key file

public_key.pem => name of public key file

‫‪private_key.pem‬‬ => name of private key with PCKS8 format! you can just read this format in java

7 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

9 Comments

3 Comments

private.pem => name of private key file

public_key.pem => name of public key file

‫‪private_key.pem‬‬ => name of private key with PCKS8 format! you can just read this format in java

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related