# SSL/TLS failed to load, java.io.IOException: extra data given to DerValue constructor

**URL:** <https://discuss.elastic.co/t/ssl-tls-failed-to-load-java-io-ioexception-extra-data-given-to-dervalue-constructor/256711>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 25, 2020, 8:41pm UTC](https://discuss.elastic.co/t/ssl-tls-failed-to-load-java-io-ioexception-extra-data-given-to-dervalue-constructor/256711 "2020-11-25T20:41:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ctan](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@ctan](https://discuss.elastic.co/u/ctan)\
**Post date:** [November 25, 2020, 8:41pm UTC](https://discuss.elastic.co/t/ssl-tls-failed-to-load-java-io-ioexception-extra-data-given-to-dervalue-constructor/256711/1 "2020-11-25T20:41:48Z")

</div>

Hello! We are setting up our first Elasticsearch cluster and hit a problem with using our private CAs. I am able to get a cert and upload it, but every time I start elasticsearch I get errs around this:

`java.io.IOException: extra data given to DerValue constructor`

The certs all look good, but am wondering if there is a conversion or process I can do to verify their compatibility.

Thank you.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [November 26, 2020, 12:49am UTC](https://discuss.elastic.co/t/ssl-tls-failed-to-load-java-io-ioexception-extra-data-given-to-dervalue-constructor/256711/2 "2020-11-26T00:49:37Z")

</div>

_(I moved this from the Kibana forum to Elasticsearch)_

Can you provide more details from the logs (for example, the full stack trace)?  
And also a copy of the certificate - you can DM it to me if you prefer.

That exception is triggered deep in the JDK's security parsing code, there's no way to guess what the possible cause might be without a reproduction case.

---

<div class="post-metadata">

**Author:** ![ctan](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@ctan](https://discuss.elastic.co/u/ctan)\
**Post date:** [December 2, 2020, 8:21pm UTC](https://discuss.elastic.co/t/ssl-tls-failed-to-load-java-io-ioexception-extra-data-given-to-dervalue-constructor/256711/3 "2020-12-02T20:21:28Z")

</div>

Thank you! Turns out there was as second certificate in the PEM. And java is looking for a specific value, if that value differs it gets the DerValue error.

I resolved this by removing the extra certificate from the text PEM and re-encoding it to DER for use in ELK.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2020, 8:21pm UTC](https://discuss.elastic.co/t/ssl-tls-failed-to-load-java-io-ioexception-extra-data-given-to-dervalue-constructor/256711/4 "2020-12-30T20:21:28Z")

</div>

Closed on December 30, 2020, 8:21pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.