PKCS#12 : DerInputStream.getLength() exception

Question

I generate a certificate using the keytool command:

keytool -genkeypair -alias myRSAKey -keyalg RSA -keysize 1024 -keystore test.p12 -storepass test -storetype pkcs12

Then if I try to load it using java security API, after getting the file as a byte[] :

KeyStore ks = KeyStore.getInstance("PKCS12");
try{
   ks.load(new ByteArrayInputStream(data), "test".toCharArray())
} catch (Exception e){
   ...
}

I get a DerInputStream.getLength(): lengthTag=127, too big exception.

What is wrong?

score 24 · Accepted Answer · answered Nov 06 '13 at 11:57

24

I had this problem and I've searched the depths of google and still couldn't find the answer. After some days battling with a terrible quality legacy code, I found what was causing this error.

KeyStore.load(InputStream is, String pass);

this method takes an InputStream and if there's any problem with such InputStream, this exception is thrown, some problems that I've encountered:

The InputStream points to the wrong / blank / just created file
The InputStream is already open or something else is holding the resource
The InputStream was already used and read, thus the position of the next byte of InputStream is it's end

The last one was the responsible for my problem. The code was creating an InputStream from a certificate, and proceeding to use it in two KeyStore.load() calls, the first one was successful, the second one always got me this error.

answered Nov 06 '13 at 11:57

ibrabeicker

1,786
2
19
31

Thank you. The error message is really misleading. In my case `data` (the key) was an empty byte array and that caused this error. And all because i reused the input stream. – Stroboskop Jan 20 '14 at 09:49
4

The first cause you point out it's IMO the most commonly cause: normally wrong file. ie sometimes it's happen to me when I try to use a `JKS` keystore file with a `KeyStore.getInstance("PKCS12")` or reversal `:)`. – albciff Oct 30 '14 at 17:10
@albciff In my case, it was that. I was using the default type on KeyStore which is PKCS12 while I wanted was "JKS". – Arjun Kalidas Feb 22 '23 at 18:23
For me, it was specifying the right keystore type: KeyStore keyStore = KeyStore.getInstance("JCEKS"); Our keyStore has a naming format of: xyz.jceks – logixplayer Mar 31 '23 at 02:36

score 17 · Answer 2 · edited Nov 07 '16 at 12:49

17

For others with a similar problem:

"keystore load: DerInputStream.getLength(): lengthTag=109, too big."

For me solution was to remove the param: -storetype pkcs12 since the standard type is jks

edited Nov 07 '16 at 12:49

SiHa

7,830
13
34
43

answered Nov 07 '16 at 11:29

Jan vO

281
4
8

Amanpreet · Answer 3 · 2016-05-10T07:12:04.837

9

Probably the certificate you create has an extra character at the end which is misinterpreted to be another certificate. Use one or more blank lines at the end.

Refer: Java Certificate Parsing

edited May 10 '16 at 07:12

answered Sep 13 '11 at 09:23

Amanpreet

526
3
12

Yeah I checked already as I had a similar error on a x509 certificate but that's not it. Thanks for your answer, I'll +1 it because it could have been the issue. – Gad Sep 13 '11 at 14:10
1

Looks like link is dead. – Aniket Thakur Dec 07 '15 at 13:15
@AniketThakur: I fixed the link. You can refer to it now. – Amanpreet May 10 '16 at 07:12
1

This has been fixed in Java 7+. – Ben Green Oct 26 '17 at 12:20

Lee Chee Kiam · Answer 4 · 2019-09-17T05:25:13.347

My issue (lengthTag=109, too big) was the .p12 file actually is JKS format and not PKCS # 12 format. Someone renamed the file extension. By regenerating in proper PKCS format resolved the issue.

java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
    at sun.security.util.DerInputStream.getLength(DerInputStream.java:599)
    at sun.security.util.DerValue.init(DerValue.java:365)
    at sun.security.util.DerValue.<init>(DerValue.java:320)
    at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1914)
    at java.security.KeyStore.load(KeyStore.java:1445)

To check the format of a security file, may use KeyStore Explorer to open the file. The left bottom bar shows the actual format.

score 3 · Answer 5 · edited Nov 17 '16 at 05:59

3

Specify the type of certificate in the code for eg:

System.setProperty("javax.net.ssl.trustStoreType", "jks");
System.setProperty("javax.net.ssl.keyStoreType", "pkcs12");

edited Nov 17 '16 at 05:59

Nikhil

3,711
8
32
43

answered Nov 17 '16 at 05:40

Harikrishnan P.R

39
1

score 3 · Answer 6 · answered Jul 09 '19 at 11:48

This happened to me in Android Studio after AndroidX migration and using the new testing framework. Even deleting the existing ~/.android/debug.keystore was failing for me

The solution was regenerate it manually (accept all questions as empty and say yes at the last one)

$ keytool -genkey -v -keystore debug.keystore -storepass android -alias androiddebugkey -keypass android -keyalg RSA -keysize 2048 -validity 10000

And copy it

$ rm ~/.android/debug.keystore
$ cp debug.keystore ~/.android/debug.keystore

score 2 · Answer 7 · answered Jun 11 '18 at 16:15

This happened to me because I had copy and pasted the .p12 file locally on my windows 10 machine. No clue how/why this is a problem, but when I clone a project that has .p12 files and point my code to them, the files work. However, copy and pasting the files in windows file explorer to somewhere else on the harddrive causes this error!!!!

score 1 · Answer 8 · edited Jan 22 '18 at 21:17

1

I had the same issue.

My solution is to replace PKCS12 with jceks in the line below because I was apparently using the wrong type.

KeyStore clientStore = KeyStore.getInstance("PKCS12");

edited Jan 22 '18 at 21:17

PM 77-1

12,933
21
68
111

answered Jan 22 '18 at 19:03

sindacco

11
1

score 0 · Answer 9 · answered Dec 13 '19 at 17:42

Make sure the scope of the inputstream variable is only to the method where you’re declaring it but not as static/class variable.This way this exception can be avoided. Reason : Inputstream is not getting closed after the first time of loading certificate or data in it while it is declared as class variable.so make it available only to method.

score 0 · Answer 10 · answered Sep 01 '20 at 07:20

This happened to me because the following command:

openssl pkcs12 -export -in import.pem -inkey myhost.key.pem -name shared > server.p12 (from https://docs.oracle.com/en/database/other-databases/nosql-database/12.2.4.5/security/import-key-pair-java-keystore.html)

generated a wrongly formatted pkcs12 file. Using the following corrected the problem:

openssl pkcs12 -export -in import.pem -inkey myhost.key.pem -name shared -out server.p12

score 0 · Answer 11 · edited Oct 01 '21 at 17:26

This error has multpile causes... The log can be realy confusing.

One main cause can be maven filtering. According to maven official documentation Warning: Do not filter files with binary content like images! This will most likely result in corrupt output. Our .jks was corrupted by maven during packaging stage.

This thread helped me to figure it out.

We can exclude some directories or file extensions from filtering directly in concerned pom.xml :

       <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-resources-plugin</artifactId>
            <version>${maven-resources-plugin.version}</version>
            <configuration>
                <nonFilteredFileExtensions>
                    <nonFilteredFileExtension>jks</nonFilteredFileExtension>
                    <nonFilteredFileExtension>p12</nonFilteredFileExtension>
                </nonFilteredFileExtensions>
            </configuration>
        </plugin>

score 0 · Answer 12 · answered Sep 13 '11 at 20:23

You are doing something wrong.
I tried your command and then loaded the p12 just fine.
The following code works:

 FileInputStream fin = new FileInputStream("..\\test.p12");
 KeyStore ks = KeyStore.getInstance("PKCS12");
 ks.load(fin, "123456".toCharArray());
 System.out.println(ks.getCertificate("myrsakey"));

I was wondering if you put the command as is you get an error from keytool that the password must be at least 6 characters.
You did not get that error? What version of java are you using?
Note:if you need to create certificates you can also look into this tool.
http://sourceforge.net/projects/certhelper/

PKCS#12 : DerInputStream.getLength() exception

12 Answers12

Linked