1 of 7

JWS/JWE Integration

JWS Workflow

The steps of the JWS workflow are as follows:

The client signs with the client private key.
digiRunner verifies with the client public key.
digiRunner signs with the digiRunner’s private key.
The client verifies with the digiRunner’s public key.

JWE Workflow

The steps of the JWE workflow are as follows:

The client encrypts with the digiRunner’s public key.
digiRunner decrypts with the digiRunner’s private key.
digiRunner encrypts with the client public key.
The client decrypts with the client private key.

Exchanging Public Keys

The two parties prepare their key pair (public key and private key).
The two parties exchange their respective public keys.

Generating Certificate

Replace example-pwd123 with your custom password and example-comp with your custom certificate name in the commands below.

Issue the command to create a jks file using keytool.

keytool -genkey -alias example-comp -keystore example-comp.jks -keypass example-pwd123 -storepass example-pwd123 -keyalg RSA -keysize 2048 -validity 365 -v -dname "CN=www.example.com, OU=dgr, O=tpi, L=taipei, ST=taiwan, C=tw" -ext "SAN=DNS: www.example.com,IP:127.0.0.1"

Query the content of the jks file.

keytool -list -v -keystore example-comp.jks -storepass example-pwd123

Generate a keystore in p12 format, and provide a password.

keytool -importkeystore -srckeystore example-comp.jks -destkeystore example-comp.p12 -srcstoretype jks -deststoretype pkcs12 -keypass example-pwd123 -storepass example-pwd123

Convert the file online, from P12 to PEM:

Go to SSL Shopper.
In the Certificate File to Convert field, click Choose File to select and upload the *.p12 file.
In the PFX Password field, enter your password.
Click Convert Certificate to finish the conversion.

The generated PEM file, such as example-comp.pem, contains both the private key and the certificate (including the public key). The content is as follows:

Bag Attributes
    friendlyName: example-comp
    localKeyID: 54 69 6D 65 20 31 36 38 38 36 32 32 38 33 31 36 31 35 
Key Attributes: <No Attributes>

Bag Attributes
    friendlyName: example-comp
    localKeyID: 54 69 6D 65 20 31 36 38 38 36 32 32 38 33 31 36 31 35 
subject=C = tw, ST = taiwan, L = taipei, O = tpi, OU = dgr, CN = www.tpisoftware.com

issuer=C = tw, ST = taiwan, L = taipei, O = tpi, OU = dgr, CN = www.tpisoftware.com

Retain only the data of the certificate (including the public key), such as example-comp-pub.pem. The content is as follows:

Upload the data of the certificate (including the public key), such as example-comp-pub.pem. to digiRunner.

Operating with JWS

API Request in JWS Format

The client signs the plain request with the client private key, resulting in a signed request (JWS).

API Response in JWS Format

The client verifies the signature of the received response (JWS) with the digiRunner’s public key.

Once the signature is verified, decode the payload of the JWS with Base64 to obtain the plain response.

Operating with JWE

API Request in JWE Format

The client encrypts the plain request with the digiRunner’s public key, resulting in an encrypted request (JWS).

API Response in JWE Format

The client decrypts the received response (JWE) with the client private key.

Once the response is decrypted, the client will obtain the plain response.