Exception in thread "main" java.lang.IllegalArgumentException: java.io.IOException Invalid DER: length field too big (186)

Question

I am using REST API's for monitoring Oracle Cloud Compute VM.

String privateKeyFilename = "/.oci/oci_api_key.pem";
PrivateKey privateKey = loadPrivateKey(privateKeyFilename);
RequestSigner signer = new RequestSigner(apiKey, privateKey);

loadPrivateKey(privateKeyFilename) Method looks like this.

private static PrivateKey loadPrivateKey(String privateKeyFilename) {
    try (InputStream privateKeyStream = Files.newInputStream(Paths.get(SystemUtils.getUserHome().toString() + privateKeyFilename))) {
        return PEM.readPrivateKey(privateKeyStream);
    } catch (InvalidKeySpecException e) {
        throw new RuntimeException("Invalid format for private key");
    } catch (IOException e) {
        throw new RuntimeException("Failed to load private key");
    }
}

oci_api_key.pem file(sample) looks like below.

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,93A2E22E154E2EBFE18D170E9E9D1772

xCpRUz2HCa9sd0inFN7BtFO/ZgQDlcieOriynSDGYBYXMO1JWpHtjbiEvt9FbdGk
INKzMQKeDbmG1PqW0Pzflla2IIpyZKEL85s/HpT/EM2qDkKZ15JostR2W1il+u1V
xCpRUz2HCa9sd0inFN7BtFO/ZgQDlcieOriynSDGYBYXMO1JWpHtjbiEvt9FbdGk
SampleSampleSampleSampleSampleSampleSampleSampleSampleSampleSamp
eB04BHrY9RTk2Oe6Bj5j9y0oCOcF0ScTSLRoA2z2PYTY0lacAiv7lq2fWq5/iVb1
KbNqIL7oMBn0oyFr2t9/STiHXU/F5gMbxqCN+A0F+S/Cdua5U5P1icnPF2f/RL32
cUrJM1soChcI1eJIDBlVsvOLOGEM761f5WYXIyMcM0fXi2nLpihrlh9yVU6El0Vq
+vPUlqLfxjlzOZgAjzSjsFSv0MBoSxeFM3zkGQs/OTkqHBVudJ1imoNAQXWRC50k
+OfItUAQmgIpvhQ3hCOXqnMXdgzVphjPS7J39nLSJRKXEKno3t4ahMkaHB6pFRun
hpNdlY3B+9h1iPh4Zxbr+3tIIDadQwV4Ic9JdtS+iUOQ4t/0zFcnMZ33lL81v+Fj
VOpMycKYkJVLVYyrq7gIxDjADR6BGWIJnuTeVyc8NQIBTUkrvYBlJkq5ro3p2jVg
Fh0Er0H1YxfkRTQR4uXWCv5GPIE+uMDHSb+JAvwYSsHQ0Vp+b3VKdkG4p7wgJeNS
7SODuznK2z8YcSiHz/SX7EKbx8kNCOODu/Tw4cav8GS9iUH5j7BRrePMFdQVv+bz
f9l1W429oro2Fxe/RdHzm7zliquiPE+/Wiw+sBIZfJFmwQS69aQOQeDawuHP6xBi
HOwF5Jqr15yTOxwRxmyGtOvj5M5x/uoPa4217fbfmyzc+XNxII4e6r95z3MGCZs0
hVIX4dAu37+i3cnJodWuqOn/it44OiHZbLM3pWGXNWb2BYCub/AUWxOQRfURGDDR
weU25EHFn3Xp5al4T8oHXaZBjJCBlVQ57A5YFX6CBsYRarVF7PJYycvRHa2eEM/y
ZTzDJjZZIaUu0rNPuNrTW7ZSH7mwq4ekCSRRbfyM05RkGWAhNiuXu2YWy7E07bMQ
5IIOdKXzx9FonECowWkAV1vDeesbVjxQTMdO82/dq5FjaErPTNji7RwS3izw9kiX
gcd00iltXKd6rUI8s1EwrFvEpURDcybVTi1D6PAZf25RjEF6MZAeNXKj7qPg3EDs
P4Rmi8y2pn93QHQfJxWI5aLmHP8ZCHrj8XRZFYrijOqM5y2DJBxTqIijd/S9197b
-----END RSA PRIVATE KEY-----

I am getting the below exception

Exception in thread "main" java.lang.IllegalArgumentException: java.io.IOException: Invalid DER: length field too big (186)
    at org.tomitribe.auth.signatures.RSA.privateKeyFromPKCS1(RSA.java:63)
    at org.tomitribe.auth.signatures.PEM.readPrivateKey(PEM.java:71)
    at com.zoho.listeners.Signing.loadPrivateKey(Signing.java:132)
    at com.zoho.listeners.Signing.main(Signing.java:86)
Caused by: java.io.IOException: Invalid DER: length field too big (186)
    at org.tomitribe.auth.signatures.RSA$DerParser.getLength(RSA.java:402)
    at org.tomitribe.auth.signatures.RSA$DerParser.read(RSA.java:358)
    at org.tomitribe.auth.signatures.RSA.newRSAPrivateCrtKeySpec(RSA.java:133)
    at org.tomitribe.auth.signatures.RSA.privateKeyFromPKCS1(RSA.java:59)
    ... 3 more

Any inputs?

Answer 1

Looks like it expects a DER encoded certificate instead of a PEM certificate. The following excerpt from this article should provide some background:

X509 File Extensions

The first thing we have to understand is what each type of file extension is. There is a lot of confusion about what DER, PEM, CRT, and CER are and many have incorrectly said that they are all interchangeable. While in certain cases some can be interchanged the best practice is to identify how your certificate is encoded and then label it correctly. Correctly labeled certificates will be much easier to manipulate.

Encodings (also used as extensions)

• .DER = The DER extension is used for binary DER encoded certificates. These files may also bear the CER or the CRT extension. Proper English usage would be “I have a DER encoded certificate” not “I have a DER certificate”.
• .PEM = The PEM extension is used for different types of X.509v3 files which contain ASCII (Base64) armored data prefixed with a “—– BEGIN …” line.

Common Extensions

• .CRT = The CRT extension is used for certificates. The certificates may be encoded as binary DER or as ASCII PEM. The CER and CRT extensions are nearly synonymous. Most common among *nix systems

[...]

Creating the key like with openssl genrsa -out ~/.oci/oci_api_key.pem 2048 without -aes128 has been suggested as a possible solution here.