如何在jose4j中基于X.509 PEM证书生成JWK

云上老周

2026-8-28

jose4j 实现 X.509 PEM 证书生成 RSA JWK 方案

jose4j 没有提供类似nimbus库中直接解析PEM编码X509证书生成JWK的封装方法，按以下逻辑实现即可和现有nimbus代码的行为完全等价：

清洗PEM证书字符串，移除固定头尾标记、所有空白字符后做Base64解码，生成JDK原生X509Certificate实例
从证书对象中提取RSA公钥，通过jose4j的RsaJwk构建器初始化JWK对象
手动设置公钥用途为enc、绑定算法为RSA-OAEP-256，和原有逻辑的参数保持一致

核心实现代码如下：

import org.jose4j.jwk.RsaJwk;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.io.ByteArrayInputStream;
import java.util.Base64;

// 省略日志、其他业务依赖的导入
RsaJwk jwk1 = null;
try {
    // 解析PEM格式证书为X509Certificate对象
    String cleanPem = certificateString
            .replace("-----BEGIN CERTIFICATE-----", "")
            .replace("-----END CERTIFICATE-----", "")
            .replaceAll("\\s", "");
    byte[] certDer = Base64.getDecoder().decode(cleanPem);
    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
    X509Certificate x509Cert = (X509Certificate) certFactory.generateCertificate(new ByteArrayInputStream(certDer));
    
    // 构建JWK并设置对应参数
    RsaJwk.Builder jwkBuilder = RsaJwk.Builder.newBuilder((java.security.interfaces.RSAPublicKey) x509Cert.getPublicKey());
    jwkBuilder.publicKeyUse("enc");
    jwkBuilder.algorithm("RSA-OAEP-256");
    jwk1 = jwkBuilder.build();
} catch (Exception ex) {
    log.error("Exception while creating JWK from X.509 certificate : {}", ex.getMessage());
}