asmhatreandClaude Sonnet 5.5
2e25042a68
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
pem-api
Companion code for the ankurm.com article PEM Encodings in Java (JEP 538 / JEP 542): Read and Write Keys and Certificates Without BouncyCastle.
java.security.PEMDecoder / PEMEncoder were previewed in JDK 25 (JEP 470) and 26 (JEP 524), and are a third preview in JDK 27 (JEP 538),
so JDK 27 needs --enable-preview. JEP 542 finalizes the API in JDK 28 (targeted; not GA until March 2027). The scripts run on JDK 27.0.1 (Temurin) and on the JDK 28 early-access build 21 (no flag).
| File | What it shows | Output |
|---|---|---|
src/RoundTrip.java |
decode / encode keys and certificates, CRLF line endings, what untyped decode returns |
output/01-round-trip.txt |
src/JwtSigning.java |
RS256 / ES256 / EdDSA signing with keys from PEM, the ES256 DER vs R||S trap | output/02-jwt-signing.txt |
src/TlsFromPem.java |
key + certificate chain + CA from PEM into an SSLContext, a local HTTPS server and client |
output/03-tls.txt |
src/EncryptedKeys.java |
write / read encrypted PKCS#8, choose algorithm and cost, wrong password, OpenSSL files | output/04-encrypted.txt |
src/Failures.java |
wrong target class, SEC1 EC PRIVATE KEY, malformed text, bundles |
output/05-failures.txt |
src/Migration.java |
the same jobs with BouncyCastle bcpkix 1.86, Spring Security 7.1.2 RsaKeyConverters, and the JDK |
output/06-migration.txt |
| (script) | compile without --enable-preview; run without it |
output/07-preview-flag.txt |
| (script) | the same demos on JDK 28 EA, no flag, diffed against the JDK 27 run | output/08-jdk28-final.txt |
JDK27=/path/to/jdk-27 JDK28=/path/to/jdk-28-ea ./run.sh # JDK28 is optional; needs Maven Central once, for bcpkix and spring-security-core
fixtures/ holds throw-away OpenSSL-generated keys and certificates (see fixtures/README.md). Output is byte-stable; the ECDSA DER length (random, 70-72) is printed as a range check for that reason.