title: How to encode jwtToken from es256 pem files java
body: <p>I have private and public key <code>.pem</code> files that are created within ES256 algorithm. I want to sign JWT token with private key that I can later check with public key.</p>
  <p>On <a href="https://jwt.io/" rel="nofollow noreferrer">jwt.io</a> I found that there are multiple libs that support ES256: jose4j, nimbus-jose-jwt, jjwt, fusionauth-jwt,  vertx-auth-jwt. Unfortunately I'm unable to find any examples that load keys from pem file and create JWT token.</p>
  <p><strong>Example N1:</strong></p>
  <p>I imported pem file into .keystore with</p>
  <pre><code>openssl pkcs12 -export -in ES256-public-key.pem -inkey ES256-private-key.pem -out ~/keystore.p12 -name selfsigned -nocerts
  </code></pre>
  <p>I tried jose4j with the following code:</p>
  <pre><code>KeyStore store = KeyStore.getInstance(&quot;PKCS12&quot;);
  
  store.load(new FileInputStream(&quot;/home/andrew/keystore.p12&quot;), &quot;test&quot;.toCharArray());
  Key key = store.getKey(&quot;selfsigned&quot;, &quot;test&quot;.toCharArray());
  
  JsonWebEncryption jwe = new JsonWebEncryption();
  jwe.setPayload(&quot;Hello World!&quot;);
  jwe.setAlgorithmHeaderValue(KeyManagementAlgorithmIdentifiers.ECDH_ES_A256KW);
  jwe.setEncryptionMethodHeaderParameter(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);
  jwe.setKey(key);
  String serializedJwe = jwe.getCompactSerialization();
  System.out.println(&quot;Serialized Encrypted JWE: &quot; + serializedJwe);
  jwe = new JsonWebEncryption();
  jwe.setAlgorithmConstraints(new AlgorithmConstraints(AlgorithmConstraints.ConstraintType.WHITELIST,
      KeyManagementAlgorithmIdentifiers.ECDH_ES_A256KW));
  jwe.setContentEncryptionAlgorithmConstraints(new AlgorithmConstraints(AlgorithmConstraints.ConstraintType.WHITELIST,
      ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256));
  jwe.setKey(key);
  jwe.setCompactSerialization(serializedJwe);
  System.out.println(&quot;Payload: &quot; + jwe.getPayload());
  </code></pre>
  <p>It throws exception:</p>
  <pre><code>Exception in thread &quot;main&quot; org.jose4j.lang.InvalidKeyException: Invalid key java.lang.ClassCastException: Cannot cast sun.security.ec.ECPrivateKeyImpl to java.security.interfaces.ECPublicKey
      at org.jose4j.jwx.KeyValidationSupport.castKey(KeyValidationSupport.java:64)
      at org.jose4j.jwe.EcdhKeyAgreementAlgorithm.validateEncryptionKey(EcdhKeyAgreementAlgorithm.java:188)
      at org.jose4j.jwe.EcdhKeyAgreementWithAesKeyWrapAlgorithm.validateEncryptionKey(EcdhKeyAgreementWithAesKeyWrapAlgorithm.java:73)
      at org.jose4j.jwe.JsonWebEncryption.getCompactSerialization(JsonWebEncryption.java:264)
      at com.icthh.A.main(A.java:30)
  </code></pre>
  <p>I don't even get why it requires public key to create JWT token.</p>
  <p><strong>Example N2</strong></p>
  <pre><code>    private static void nimbus() throws IOException, JOSEException {
          JWSObject jwsObject = new JWSObject(new JWSHeader(JWSAlgorithm.ES256),
              new Payload(&quot;Hello, world!&quot;));
  
  // We need a 256-bit key for HS256 which must be pre-shared
  
          byte[] sharedKey = IOUtils.toByteArray(new FileInputStream(&quot;/home/andrew/ES256-private-key.pem&quot;));
  // Apply the HMAC to the JWS object
          jwsObject.sign(new MACSigner(sharedKey));
  
  // Output in URL-safe format
          System.out.println(jwsObject.serialize());
      }
  </code></pre>
  <p>This throws:</p>
  <pre><code>Exception in thread &quot;main&quot; com.nimbusds.jose.JOSEException: The &quot;ES256&quot; algorithm is not supported by the JWS signer
      at com.nimbusds.jose.JWSObject.ensureJWSSignerSupport(JWSObject.java:269)
      at com.nimbusds.jose.JWSObject.sign(JWSObject.java:318)
      at com.icthh.A.main(A.java:57)
  </code></pre>
  <p><strong>Example N3</strong>:</p>
  <p>jjwt  - this library seems to be good for android I'm not even sure that it's able to sign token, since android is a client.</p>
  <p>What I want to find is complete example how to create signed JWT token from ES256 private and public key.</p>