title: InvalidKeySpecException data isn't an object ID (tag = -96)
body: <p>I get an access token on Azure Portal free subscription, the header is:</p>
  
  <pre><code>{
    "typ": "JWT",
    "alg": "RS256",
    "x5t": "7_Zuf1tvkwLxYaHS3q6lUjUYIGw",
    "kid": "7_Zuf1tvkwLxYaHS3q6lUjUYIGw"
  }
  </code></pre>
  
  <p>so I get the x5c from <a href="https://login.microsoftonline.com/common/discovery/keys" rel="noreferrer">here</a>, and put <br/></p>
  
  <p>-----Begin Certificate-----
  MIIDBTCCAe......cNpO9oReBUsX
  -----End Certificate-----</p>
  
  <pre><code>    ze7xq1zGljQihJgcNpO9oReBUsX
  </code></pre>
  
  <p>in <a href="https://jwt.io/" rel="noreferrer">https://jwt.io/</a>, Signature is Verified.</p>
  
  <p>But when I try to verify the signature with jjwt and jose4j with JDK1.8, following steps in <a href="https://stackoverflow.com/questions/10900643/how-can-i-construct-a-java-security-publickey-object-from-a-base64-encoded-strin">this refrence</a>, I get below exception on the line</p>
  
  <blockquote>
    <p><em>PublicKey publicKey = keyFactory.generatePublic(keySpec);</em></p>
  </blockquote>
  
  <pre><code>java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException: ObjectIdentifier() -- data isn't an object ID (tag = -96)
  at java.base/sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:204)
  at java.base/java.security.KeyFactory.generatePublic(KeyFactory.java:352)
  at com.ipscape.api.v1_0.external.other.JwtExample.decodeJwt(JwtExample.java:41)
  at com.ipscape.api.v1_0.external.other.JwtExample.main(JwtExample.java:72)
  Caused by: java.security.InvalidKeyException: IOException: ObjectIdentifier() -- data isn't an object ID (tag = -96)
  at java.base/sun.security.x509.X509Key.decode(X509Key.java:396)
  at java.base/sun.security.x509.X509Key.decode(X509Key.java:401)
  at java.base/sun.security.rsa.RSAPublicKeyImpl.&lt;init&gt;(RSAPublicKeyImpl.java:86)
  at java.base/sun.security.rsa.RSAKeyFactory.generatePublic(RSAKeyFactory.java:297)
  at java.base/sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:200)
  </code></pre>
  
  <p>The codes using jose4j:</p>
  
  <pre><code>        String publicKeyPEM =
          "MIIDBTCCAe2gAwIBAgIQE7nbxEiAlqhFdKnsKV+nuTANBgkqhkiG9w0BAQsFADAtMSswKQYDVQQDEyJhY2NvdW50cy5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTE4MDYyMTAwMDAwMFoXDTIwMDYyMTAwMDAwMFowLTErMCkGA1UEAxMiYWNjb3VudHMuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL1cxvfI3wPu1HFGZL6wnSHfcqX6DlvezLF1wbqUs6/DS5GhxtvHk6+9nKyNuCjznkEKql6bTIgnUbvTPr0UUKa3hezq/D9nkGu4qX8LVONVWkb53mjnN45lnVfOLh6VQ7J8/9Ut/ybbnhcn2a12vWiR0c6899TgtRp+i0bkT9dYl+3/wfP8+bBqmolwno7yojv/DxMz86mzhS7lW6mS9zzYtdsy6IHcF2P9XIac2TaP0efUpLrQY81wuTE3gUh2s6j7tqNH7aKK2PNAuxXtyGtZ9r+bg0gMrDXXVKJylQO9m4Z5J0vuz8xgCElLg3uJPOI8q/j0YrLe5rHy67ACg0MCAwEAAaMhMB8wHQYDVR0OBBYEFDnSNW3pMmrshl3iBAS4OSLCu/7GMA0GCSqGSIb3DQEBCwUAA4IBAQAFs3C5sfXSfoi7ea62flYEukqyVMhrDrpxRlvIuXqL11g8KEXlk8pS8gEnRtU6NBeHhMrhYSuiqj7/2jUT1BR3zJ2bChEyEpIgOFaiTUxq6tXdpWi/M7ibf8O/1sUtjgYktwJlSL6FEVAMFH82TxCoTWp2g5i2lmZQ7KxiKhG+Vl9nw1bPX57hkWWhR7Hpes0MbpGNZI2IEpZSjNG1IWPPOBcaOh4ed2WBQcLcaTuAaELlaxanQaC0B3029To80MnzpZuadaul3+jN7JQg0MpHdJJ8GMHAWe/IjXc0evJNhVUcKON41hzTu0R+Sze7xq1zGljQihJgcNpO9oReBUsX";
  
      X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(publicKeyPEM.getBytes()));
      KeyFactory keyFactory = KeyFactory.getInstance("RSA");
      PublicKey publicKey = keyFactory.generatePublic(keySpec);
  
      JwtConsumer jwtConsumer = new JwtConsumerBuilder()
          .setRequireExpirationTime()
          .setVerificationKey(publicKey)
          .build();
  </code></pre>