JWK is not verified in debugger

jlaudenbach · October 26, 2022, 8:50am

Hi, I am quite new in this topic, so I just might miss a main thing that is easy to solve.
I generated a JWT, private_key.pem, public_key.pem and a JWKS.
I used the debugger on jwt.io to verify my components.

When I use Encoded JWT with private_key.pem and public_key.pem, signature is verified.
When I use Encoded JWT with private_key.pem and JWK, signature is NOT verified

My JWK contains the public_key.pem as x5c value. This might be the problem, but I am not sure about this. Here are the components I used in the debugger:

Encoded JWT:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJteV9qd3RfaWQiLCJpYXQiOjE2NjY3NzEyNDZ9.w31MBueBSGxkemCU5_lnPwvD-SFY-h0TW664hWvjN7Doho2fAK5Fs8QtjaPDvnNVosttT401G4ZRbbC9ReLJmDulIpp-b0oFj7TQAkU3O6YZyADJL0rW7FuFv3ZXkGwI1FRpH1rhi9TS1qO1wpoeIZeVxYEqrDHRt5AWKrQhrn6wcy__ZVr5HPjZDsdbA5QDXuZnBhNX4SzvSUFuM9qRFjS97WOs-9gfgS56b09EsWoX89Krq1FhN2HUOrB85i__K2QEAylJshEjzYaNyJb8wqMQPA3J9kaqsLLCnydIxhocgJcBYhr-CJQIoTggZdZNyJWIRcsruz5w8xb43FItDg

private_key.pem

public_key.pem

JWK String:

    {
      "kty": "RSA",
      "use": "sig",
      "kid": "my_jwt_id",
      "x5c": [ 
       "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9SMKlb2jufWzisdDs1SGaHlDdN5BVW7Gjp4B8G+5e36xtMzSn2k1RXIp8dNrRy+NWAq1VzQjQWbMNhoOE1Uy4FC0lffev5gKeurgquw4Du91XxBLXMl0oVQ1oj5NZSuC7xRcx4hVzVCMERW/VDwbxi+UeCr3XXAjAOT9WxDQ24+yHzryrBWdq9shdnxZne1NhbfAoI/95S07h36N59rjssASQpMnyLtmCdgVungOWozPEL+ORk5SCDbpq9U5Tu07OG11kv2PLE6edKNrsAMs1Sd76+h6Am164QoP1DqV6yJEOIBDPE2gG3q9XXSLOoQ6OW1qJ3Xk11MAxsDwrSZMTwIDAQAB"
      ]
    }

I think I might be missing something between the relationship between private_key.pem and x5c

dan.woda · October 28, 2022, 5:15pm

Hi @jlaudenbach,

Have you seen this FAQ on the subject?

A very important note at the bottom that might help clarify:

You’ll notice the x5c claim in the first key in the JWKS matches the body of the PEM certificate!

jlaudenbach · November 7, 2022, 2:50pm

Hi @dan.woda,

thank you for your reply.
Yes i know the post you mentioned. Actually this was my blueprint for my own JWK.
And as in your post, I chose x5c exactly the same as the public_key.pem string.
I am still not sure, why it is not working, but I use now onlyn and e parameter for my JWK and this works fine.

dan.woda · November 7, 2022, 6:04pm

Can you post an example of the public key you are trying to use?

jlaudenbach · November 8, 2022, 7:51am

You will find all above at the beginning of the Post: JWT, private.pem, public.pem and JWK String.
Maybe you have an idea, why public.pem is working but not JWK String.

dan.woda · November 8, 2022, 3:46pm

Are you adding the header and footer to the x5c?

jlaudenbach · November 9, 2022, 7:50am

You mean -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- string?
No I haven’t add this to the x5c.

dan.woda · November 9, 2022, 5:13pm

Yep, try adding those and see if it works correctly.

jlaudenbach · November 16, 2022, 3:00pm

I tried

    {
      "kty": "RSA",
      "use": "sig",
      "kid": "my_jwt_id",
      "x5c": [ 
       "-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9SMKlb2jufWzisdDs1SG
aHlDdN5BVW7Gjp4B8G+5e36xtMzSn2k1RXIp8dNrRy+NWAq1VzQjQWbMNhoOE1Uy
4FC0lffev5gKeurgquw4Du91XxBLXMl0oVQ1oj5NZSuC7xRcx4hVzVCMERW/VDwb
xi+UeCr3XXAjAOT9WxDQ24+yHzryrBWdq9shdnxZne1NhbfAoI/95S07h36N59rj
ssASQpMnyLtmCdgVungOWozPEL+ORk5SCDbpq9U5Tu07OG11kv2PLE6edKNrsAMs
1Sd76+h6Am164QoP1DqV6yJEOIBDPE2gG3q9XXSLOoQ6OW1qJ3Xk11MAxsDwrSZM
TwIDAQAB
-----END PUBLIC KEY-----"
      ]
    }

with no success.
This looks version looks quite strange for me

dan.woda · November 16, 2022, 4:27pm

Try this:

JWK is not verified in debugger

You’ll notice the x5c claim in the first key in the JWKS matches the body of the PEM certificate!