asmhatreandClaude Sonnet 5.5
2e25042a68
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
24 lines
1.9 KiB
Markdown
24 lines
1.9 KiB
Markdown
# pem-api
|
|
|
|
Companion code for the ankurm.com article **PEM Encodings in Java (JEP 538 / JEP 542): Read and Write Keys and Certificates Without BouncyCastle**.
|
|
|
|
`java.security.PEMDecoder` / `PEMEncoder` were previewed in JDK 25 (JEP 470) and 26 (JEP 524), and are a **third preview in JDK 27 (JEP 538)**,
|
|
so JDK 27 needs `--enable-preview`. JEP 542 finalizes the API in JDK 28 (targeted; not GA until March 2027). The scripts run on JDK 27.0.1 (Temurin) and on the JDK 28 early-access build 21 (no flag).
|
|
|
|
| File | What it shows | Output |
|
|
|---|---|---|
|
|
| `src/RoundTrip.java` | decode / encode keys and certificates, CRLF line endings, what untyped `decode` returns | `output/01-round-trip.txt` |
|
|
| `src/JwtSigning.java` | RS256 / ES256 / EdDSA signing with keys from PEM, the ES256 DER vs R||S trap | `output/02-jwt-signing.txt` |
|
|
| `src/TlsFromPem.java` | key + certificate chain + CA from PEM into an `SSLContext`, a local HTTPS server and client | `output/03-tls.txt` |
|
|
| `src/EncryptedKeys.java` | write / read encrypted PKCS#8, choose algorithm and cost, wrong password, OpenSSL files | `output/04-encrypted.txt` |
|
|
| `src/Failures.java` | wrong target class, SEC1 `EC PRIVATE KEY`, malformed text, bundles | `output/05-failures.txt` |
|
|
| `src/Migration.java` | the same jobs with BouncyCastle `bcpkix` 1.86, Spring Security 7.1.2 `RsaKeyConverters`, and the JDK | `output/06-migration.txt` |
|
|
| (script) | compile without `--enable-preview`; run without it | `output/07-preview-flag.txt` |
|
|
| (script) | the same demos on JDK 28 EA, no flag, diffed against the JDK 27 run | `output/08-jdk28-final.txt` |
|
|
|
|
```bash
|
|
JDK27=/path/to/jdk-27 JDK28=/path/to/jdk-28-ea ./run.sh # JDK28 is optional; needs Maven Central once, for bcpkix and spring-security-core
|
|
```
|
|
|
|
`fixtures/` holds throw-away OpenSSL-generated keys and certificates (see `fixtures/README.md`). Output is byte-stable; the ECDSA DER length (random, 70-72) is printed as a range check for that reason.
|