javassl-certificatejwtx509certificatejose4j

How to Decode JWT RS256 token using .cer file Provided?

I converting Certificate to publickey and passing to JwtConsumer using below Code:

  jwt = "eU13VUDPQsLv2fvbCPEyeuQubditVOguIa2UWvaMhx2ES7cMlTL8F6IgplgpG_H7bXpduPnFUncn7zUYRXmvw_Bts8EfqICeGa5db6RGmofeA01OqowgCfxhWLwmU786riJIT0twMFe...............................BzR7DOvqsahbsx93yKqB_5Q";
            // read public key from a file or config or something
            String publicKeyPEM =
                    "-----BEGIN CERTIFICATE-----\n" +
                            "MIIFuDCCBKCgAwIBAgIQXQ/D2sE/XdZYvdViF83mMzANBgkqhkiG9w0BAQsFADB+\n" +
.........................................................................................................                                                      "saQRa7TBj6gAdlYwJVR+4hpLngANpwAG+bXHuEs+Ns/dE/s+b7aUb8/IJTWNtaaQ\n" +
                            "lMvr/4xtT6ZNCiaIM3uvIvzHqPxCn3sWa94FP9FIg3mbIia1ZbUx8NyMpETOjxaO\n" +
                            "X242VTjKf7mLCqibyn3kj93zZjgNa0AlbF/QdE9z4tQ58BwoDVlNK4mGv7Uq2nca\n" +
                            "2qTrgWcVVKyhKMnytiQ4LTs5O45R/YNbnEH7CA==\n" +
                            "-----END CERTIFICATE-----";


            RsaKeyUtil rsaKeyUtil = new RsaKeyUtil();
            PublicKey publicKey = rsaKeyUtil.fromPemEncoded(publicKeyPEM);

            // create a JWT consumer
            JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                    .setRequireExpirationTime()
                    .setVerificationKey(publicKey)
                    .build();

            // validate and decode the jwt
            JwtClaims jwtDecoded = jwtConsumer.processToClaims(jwt);

However I get the below error while creating a PublicKey instance.

Starting Applicationjava.security.InvalidKeyException: IOException: ObjectIdentifier() -- data isn't an object ID (tag = -96)

What could be the reason for this?enter image description here JWT.IO shows Signature is valid.

The certificate recived is in .cer format.

Solution

  • -----BEGIN CERTIFICATE----- means you have a certificate, not a public key. A certificate contains the public key

    InputStream is = new          ByteArrayInputStream(pemString.getBytes("UTF-8));
CertificateFactory cf = CertificateFactory.getInstance("X.509");
Certificate cert = cf.generateCertificate(is);
PublicKey publicKey= cert.getPublicKey();