How can I import an app cert using crypto.sutble.importKey?

[justinmchase]

Select Topic Area

Question

Body

I have created a github app and I created a cert and downloaded it but am unable to import it.

I am using Deno but a nodejs example would be fine.

Here is what I have below:

function pemToBinary(pem: string): Uint8Array {
  const base64 = pem
    .replace(/-----BEGIN RSA PRIVATE KEY-----/, "")
    .replace(/-----END RSA PRIVATE KEY-----/, "")
    .replace(/\s+/g, "");
  const binary = atob(base64);
  const binaryArray = new Uint8Array(binary.length);
  for (let i = 0; i < binary.length; i++) {
    binaryArray[i] = binary.charCodeAt(i);
  }
  return binaryArray;
}

export async function appJwt(appId: string, privateKey: string): Promise<string> {
  const decoded = pemToBinary(privateKey);
  const key = await crypto.subtle.importKey(
    "pkcs8",
    decoded,
    {
      name: "RSASSA-PKCS1-v1_5",
      hash: { name: "SHA-256" },
    },
    true,
    ["sign"],
  );
}

const contents = await Deno.readAllText("example.pem")
await appJwt(12345, contents);

The error I am getting from the importKey api is:

unexpected ASN.1 DER tag: expected SEQUENCE, got INTEGER at DER byte 7

Copilot seems to think that this means that the cert is actually pkcs1 but needs to be converted into pkcs8

The error "DataError: trailing data at end of DER message" suggests that the conversion from PKCS#1 to PKCS#8 might not be correct. Instead of manually converting the key, you can use a library like pkcs8 to handle the conversion properly.

Though the code it gives me to do the conversion doesn't work at all. Any help would be appreciated!

[justinmchase]

I figured it out, It turns out the above code will work but you need to convert the cert that github generates into pkcs8 format first.

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in ~/Downloads/example.2024-11-12.private-key.pem -out ~/Downloads/pkcs8.key