Generating-public-keys-in-PEM-format
In order to implement JWT authentication with public keys signatures we need to pass public keys as PEM format which is different than the format that authenticating entity may expose. In order to convert between formats you can use this procedure.
You'll need a recent version of ssh-keygen tool but old versions of OSX one doesn't support ECDSA keys, here's a way to do that using docker.
If ssh-keygen support ECDSA
- Generate the private key using a PEM format WITHOUT a passphrase
- Transform the public key into .pem
$ ssh-keygen -t ecdsa -b 521 -m pem -f <key-name>
$ ssh-keygen -f <key-name>.pub -m 'PEM' -e > <key-name>.pem
If ssh-keygen doesn't support ECDSA
# Run latest ubuntu
docker run --rm -it -v `pwd`:/keys ubuntu bash
# Inside container
apt-get update && apt-get install -y openssh-client
# Save an ascii file with public key content with this format
# e.g. https://git.treatwell.net/dev/mp-partner-integration-auth/-/merge_requests/13/diffs
ecdsa-sha2-nistp521 <public-key-copied-from-gitlab> root@localhost
# Example test file: key.pub
ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAB5yd+Ma4e9Yduy0WVDW+HlSP2PZZRCtRASeZOAjYzph6lKCl3C2gNZrK5q8KVv5i3R4bw2tutNpyBT1vGyFqXLsgERcberZIPxCa7BToOFH+JSbeO8fCOxSG+OJBua1fAbY+/gbtVgJBBZmZJtxCROy7WgQ9UI3UlyCBYlu/VFhgxNFw== [email protected]
# Export in pem format with this command (remember it won't work with Mac ssh-keygen, nor with the alpine one)
ssh-keygen -e -m pem -f key.pub
# Result is something like
-----BEGIN PUBLIC KEY-----
MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAecnfjGuHvWHbstFlQ1vh5Uj9j2WU
QrUQEnmTgI2M6YepSgpdwtoDWayuavClb+Yt0eG8NrbrTacgU9bxshaly7IBEXG3
q2SD8QmuwU6DhR/iUm3jvHwjsUhvjiQbmtXwG2Pv4G7VYCQQWZmSbcQkTsu1oEPV
CN1JcggWJbv1RYYMTRc=
-----END PUBLIC KEY-----