Skip to content

Invalid PKCS#7 Structure

URI: https://docs.ankatech.co/errors/invalid-pkcs7
HTTP Status: 400 Bad Request

When You See This

You attempted to convert a PKCS#7/CMS file to JOSE format, but the provided file is not a valid PKCS#7/CMS structure. The parser was unable to recognize the file as valid DER-encoded PKCS#7 data.

Common Causes

  • Wrong file type provided – You uploaded a JSON, JWK, text file, or other non-PKCS#7 format

  • Corrupted PKCS#7 file – The .p7m, .p7s, or .p7e file is truncated or damaged

  • Incorrect encoding – File is not in DER binary format (PEM format not supported for conversion)

  • Invalid ASN.1 structure – The binary data doesn't follow the PKCS#7/CMS ASN.1 schema

  • Structure above the structure budget (streaming endpoints) – More than 1 MiB of non-content bytes, or a declared ASN.1 length above the structure budget: an element declaring more bytes than the budget is refused before it is allocated. The body is the one a malformed file receives and does not name the limit

What this error is NOT

It is raised only when the bytes are not a recognisable PKCS#7/CMS structure. A valid file with an incomplete or inconsistent request is a different error:

  • a decryptionKid whose certificate matches none of the recipients, or a serialization / targetFormat outside its vocabulary → 400 invalid-input (decryptionKid itself is optional)
  • a targetFormat that does not match the structure → 422 unsupported-pkcs7-format (INCOMPATIBLE_TARGET_FORMAT)
  • serialization COMPACT for a file with several signers or recipients → 422 unsupported-pkcs7-format (INCOMPATIBLE_SERIALIZATION)
  • a structure that is valid but uses an identifier, recipient type or algorithm the conversion does not convert → 422 unsupported-pkcs7-format

Several signers or several recipients are not an error of any kind: every signer and recipient is converted. On POST /api/v3/migration/stream/convert-pkcs7-to-jose each of these is returned as an HTTP status with a problem document before the first byte of output, at every file size.

Response Example

{
  "type": "https://docs.ankatech.co/errors/invalid-pkcs7",
  "title": "Invalid PKCS#7 Structure",
  "status": 400,
  "detail": "The provided file is not a valid PKCS#7/CMS structure. Expected formats: SignedData (.p7m, .p7s), EnvelopedData (.p7e), or SignedAndEnvelopedData with DER encoding.",
  "instance": "/api/v3/migration/convert-pkcs7-to-jose",
  "timestamp": 1738117563,
  "extensions": {
    "expectedFormats": [
      "SignedData (.p7m, .p7s)",
      "EnvelopedData (.p7e)",
      "SignedAndEnvelopedData"
    ],
    "expectedEncoding": "DER (binary)",
    "hint": "For a JSON/JWK public key, use the Admin API import-key operation instead"
  }
}

How to Resolve

If you have a JSON/JWK key file:

Use the key import endpoint instead:

POST /api/v3/admin/tenants/{tenantId}/keys/import-key
Content-Type: application/json

{
  "kid": "my-imported-key",
  "kty": "RSA",
  "alg": "RSA-2048",
  "publicKey": "<base64-encoded-public-key>",
  "privateKey": "<base64-encoded-private-key>",
  "keyOps": ["encrypt", "decrypt"]
}

If you have a valid PKCS#7 file:

  1. Verify file format: 

    # Check if it's a valid PKCS#7 file using OpenSSL
openssl pkcs7 -in yourfile.p7m -inform DER -print_certs -noout

  2. Ensure DER encoding (not PEM): 

    # If your file is in PEM format, convert to DER
openssl pkcs7 -in yourfile.pem -inform PEM -out yourfile.p7m -outform DER

  3. Verify file integrity:

    • Check file size (must be > 0 bytes)
    • Ensure file is not corrupted
    • Verify file extension matches content (.p7m for SignedData, .p7e for EnvelopedData)

  4. Re-submit with correct PKCS#7 file

If you need to create a PKCS#7 file:

# Create SignedData (.p7m)
openssl cms -sign -in document.txt -out document.p7m \
  -outform DER -signer certificate.pem -inkey privatekey.key

# Create EnvelopedData (.p7e)
openssl cms -encrypt -in document.txt -out document.p7e \
  -outform DER -recip recipient-cert.pem

Need Help?

If you're unsure about your file format:

  1. Use the Analyze PKCS#7 endpoint first: 
    POST /api/v3/migration/analyze-pkcs7
    This will provide detailed structure information without attempting conversion.