javademos/pem-api/README.md

pem-api

Companion code for the ankurm.com article PEM Encodings in Java (JEP 538 / JEP 542): Read and Write Keys and Certificates Without BouncyCastle.

java.security.PEMDecoder / PEMEncoder were previewed in JDK 25 (JEP 470) and 26 (JEP 524), and are a third preview in JDK 27 (JEP 538), so JDK 27 needs --enable-preview. JEP 542 finalizes the API in JDK 28 (targeted; not GA until March 2027). The scripts run on JDK 27.0.1 (Temurin) and on the JDK 28 early-access build 21 (no flag).

File	What it shows	Output
src/RoundTrip.java	decode / encode keys and certificates, CRLF line endings, what untyped decode returns	output/01-round-trip.txt
src/JwtSigning.java	RS256 / ES256 / EdDSA signing with keys from PEM, the ES256 DER vs R||S trap	output/02-jwt-signing.txt
src/TlsFromPem.java	key + certificate chain + CA from PEM into an SSLContext, a local HTTPS server and client	output/03-tls.txt
src/EncryptedKeys.java	write / read encrypted PKCS#8, choose algorithm and cost, wrong password, OpenSSL files	output/04-encrypted.txt
src/Failures.java	wrong target class, SEC1 EC PRIVATE KEY, malformed text, bundles	output/05-failures.txt
src/Migration.java	the same jobs with BouncyCastle bcpkix 1.86, Spring Security 7.1.2 RsaKeyConverters, and the JDK	output/06-migration.txt
(script)	compile without --enable-preview; run without it	output/07-preview-flag.txt
(script)	the same demos on JDK 28 EA, no flag, diffed against the JDK 27 run	output/08-jdk28-final.txt

JDK27=/path/to/jdk-27 JDK28=/path/to/jdk-28-ea ./run.sh     # JDK28 is optional; needs Maven Central once, for bcpkix and spring-security-core

fixtures/ holds throw-away OpenSSL-generated keys and certificates (see fixtures/README.md). Output is byte-stable; the ECDSA DER length (random, 70-72) is printed as a range check for that reason.