Token generated using JWTSigner.sign() saying invalid signature in jwt.io debugger about java-jwt

[lbalmaceda]

Hello @rajani007.
I've tried to reproduce the issue using java-jwt 2.2.1 and a key pair generated with openssl:

1. Generate private key. I used the password "secret".

openssl genrsa -des3 -out private.pem 2048

2. Get private key in PEM format

openssl rsa -in private.pem -out private_unencrypted.pem -outform PEM

3. Get public key also in PEM format

openssl rsa -in private.pem -outform PEM -pubout -out public.pem

Outputs for 2 and 3:

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAv96lCis0QPEB7sHRiZ5mHAlFrjuiUuKk3Lmt76cbwX21SF5c
40PT50BC9ZJgfj834pvOut0dNcMF/dzQ80uCyUwL3NjGR+SxUkJ0J9sKFeZLNwS5
zrJi9HB5DeDXw3jTnMvOxIMMzSpf1KoQtyw703qVNw6nfSyywjtLUbCWKvPuKSG/
l3bbSPX+vdqb5NmDlA+afUa00FaxL9vBh49F8K+WZSsnE5xl94yXfEczScmihlxg
GJUz2KTU3LM9Afwv7O0iBEo9yLnLgQZT+SdmbbO9Sjb7KfhAOgjF71pZaZl6zm2X
A9fRlj9zHaY0uYwtQqXPRIGd79ZSi2Yfmi0lhwIDAQABAoIBACrv3isaZAUsaexO
P1/2rI8VnBxTiA3YXmBuxPfeg52XThw10b+iDCex/8oIycM2zoDNsUOr+79uN0cK
RVBM06XMeNMhR64LBYuNB4VrxSQFd0uGqTYSQYbGLLDoYiCCR4jNKyZa1WCMXQmw
TTFQmsrGoeHCS8T9XbuNnVtYkyJlNLGVayamYksvjegQFqXlXDjeE0UtxK8r0K0G
9YwKObezfbol99V6JwImKCiQ8iCO0UQjsy1qxJCQsJTnmaJV/Px3tFA/cP6RF320
DXLi8tmStiJWxGOXvHDdVIBDS/J7uBMEx7Qv5AZIdQ48ayuujyu63R1hnWItKPm5
T7fWQlECgYEA7iMogob2X8c3oeSP681NkKCjjQHoX6slffalIUra9wS5nM/9QepA
grhHidP1A2ZV4hp6Cz04Qaq6/AyX15iYU9dPcm+YGSGh3AuSzbW+5AxIn/NoqG9U
zNqXyj17MZotZPV8DyYrm+NWadZO8EJOV4LGJF6Q/rO5mcNyS3d9y8sCgYEAzkMH
yJD7NkBkulilX5aWJBDzieG1Xgf2lnW4Tx9HUkZA8CnDsnsetzgyi5pEhl7zG97l
3o9dDRJ8l2W7I1OupnQkW406sSsE+lZItDB6zp3JYOhnFF9PWasG5pS5jZQmUvaR
VtWdiyg8lsth2xGWG/MoKYzD7ElMh4G1CLnQTbUCgYEAjaoWsEevi1zNCJ8ayxEw
ImidwwWugjMjM6Mlqv+H8Uk7TkEhDTRYuir8S87uw93+G2razZLWw6HYaJbpQZWC
kOXWWmJungy26FtuMrf63lk8XwMDcKgCT3d+sw4OGnz4okWzTqPLb4o3XvDhtuYL
Ct4+F2a2ZP7v27w8Yw6rpC8CgYEAkxSvXzErQcNnUI5X1rLd+3fvAjpmB1hsWVw2
go1OYXfhZKCTgRlUjNhRCsWF6b+ZYh1vE2Zttx2gpKERch6BIwccygAKgz2m/hA7
JeqQF/fiGu1+W8OfJNTVReV172Rec7iJaT9IaWvW0LzU2c9PmDyrPf231C1smhA/
FKrTxCUCgYA4PJNMoNErycJq2dJBq2j2re9k62bkgAekQDn4nIewr5wkjSd7CpnV
fHmEwLiQ9OSrNQTNyu+AO6eH6qMoo2lum7nYRXBbQrgCkqBYaqX9mJJFkLnuYecW
2zaBbq4m6yikH7ZME8+9l+9kCwPSkBXi2bOWXsGEUZ2uSMMIc4E7Xg==
-----END RSA PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv96lCis0QPEB7sHRiZ5m
HAlFrjuiUuKk3Lmt76cbwX21SF5c40PT50BC9ZJgfj834pvOut0dNcMF/dzQ80uC
yUwL3NjGR+SxUkJ0J9sKFeZLNwS5zrJi9HB5DeDXw3jTnMvOxIMMzSpf1KoQtyw7
03qVNw6nfSyywjtLUbCWKvPuKSG/l3bbSPX+vdqb5NmDlA+afUa00FaxL9vBh49F
8K+WZSsnE5xl94yXfEczScmihlxgGJUz2KTU3LM9Afwv7O0iBEo9yLnLgQZT+Sdm
bbO9Sjb7KfhAOgjF71pZaZl6zm2XA9fRlj9zHaY0uYwtQqXPRIGd79ZSi2Yfmi0l
hwIDAQAB
-----END PUBLIC KEY-----

I signed some claims using the private key:

        JWTSigner signer = new JWTSigner(getPrivateKey());
        HashMap<String, Object> claims = new HashMap<String, Object>();
        claims.put("sub", "1234567890");
        claims.put("name", "John Doe");
        claims.put("admin", "true");
        JWTSigner.Options options = new JWTSigner.Options();
        options.setAlgorithm(Algorithm.RS256);
        String jwtSigned = signer.sign(claims, options);

        System.out.println("Signed: " + jwtSigned);

//Prints:  Signed: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJuYW1lIjoiSm9obiBEb2UiLCJzdWIiOiIxMjM0NTY3ODkwIiwiYWRtaW4iOiJ0cnVlIn0.dzAYYUAZtGuQYscPAQ2XZLq15ijlNSYml7CS12Ek_Byah2ENgUnjuHgBLWhGtUJHXBbb6EpqHbgr5gtSiJN1liLBHTnK28EpwsJAiKWN4TEyIkMfI3VTzg1WoKsJnvVPoH0INbcMwNAZSF_E5KDlrBbD73l1c8IPaWOBQG3hbW9iF6WkdgX6_FanYrnL4ULfVmZ2D2WY16W8Ewo0ycU42Si-ErOkHyNX2592mtdMHBi_mHIi5fHuiVN8adwMcu1AdltRfrzQDSTpAd_5yqzSJ9e6K4DYh22Rzx4kWqZ-ZVWFk2RRb3wlXtJaV4xpbjKJj2TXBSPt_rtNCrQXf-TPtg

After that, I verify the output using the public key.

        JWTVerifier verifier = new JWTVerifier(getPublicKey());
        try {
            verifier.verify(jwtSigned);
            System.out.println("Verify ok!");
        } catch (Exception e) {
            System.out.println("Verify fail!");
            e.printStackTrace();
        }
//Prints: Verify ok!

The verification also passes on the http://jwt.io site, so I guess it's something related to how you generate the keys or how you read the file.

Also if this is an option for you guys @rajani007 @tyy10002, I recommend you to move to the latest version (currently 3.0.2).

Cheers.

[tyy10002]

I have a similar issue. I generated a jwt in java with ES256. Then, I have other node applications using hapi-jwt plugin, and I got this error [TypeError: "ES256" signatures must be "64" bytes, saw "72"].

[rajani007]

Hi,
Thanks for trying. I should have updated here saying that i was able to make it work with simple fix as suggested here.

http://stackoverflow.com/questions/40295469/token-generated-using-jwtsigner-sign-saying-invalid-signature-in-jwt-io-debugg

[lbalmaceda]

@rajani007 I'm glad you could resolve it! 😄