@SuppressWarnings("serial")
protected String getNewCertificateRequest(final KeyPair userKey, final String nonce, final PKCS10CertificationRequest csr) throws IOException {
	return Jwts.builder()
			.setHeaderParam(NONCE_KEY, nonce)
			.setHeaderParam(JwsHeader.JSON_WEB_KEY, JWKUtils.getWebKey(userKey.getPublic()))
			.setClaims(new TreeMap<String, Object>(){{
				put(RESOURCE_KEY, RESOURCE_NEW_CERT);
				put(CSR_KEY, TextCodec.BASE64URL.encode(csr.getEncoded()));
			}})
			.signWith(getJWSSignatureAlgorithm(), userKey.getPrivate())
			.compact();
}
 

public static TreeMap<String, Object> getWebKey(PublicKey publicKey) {
	TreeMap<String, Object> key = new TreeMap<>();
	if (publicKey instanceof RSAPublicKey){
		key.put("kty","RSA");
		key.put("e", TextCodec.BASE64URL.encode(toIntegerBytes(((RSAPublicKey) publicKey).getPublicExponent())));
		key.put("n", TextCodec.BASE64URL.encode(toIntegerBytes(((RSAPublicKey) publicKey).getModulus())));
		return key;
	}else{
		throw new IllegalArgumentException();
	}
}
 

public static String getWebKeyThumbprintSHA256(PublicKey publicKey){
	try {
		TreeMap<String, Object> webKey = JWKUtils.getWebKey(publicKey);
		String webKeyJson = new ObjectMapper().writeValueAsString(webKey);
		return TextCodec.BASE64URL.encode(SHA256(webKeyJson));
	} catch (JsonProcessingException e) {
		throw new RuntimeException(e);
	}
}
 

public Map<String, String> refreshSecrets() {
    SecretKey key = MacProvider.generateKey(SignatureAlgorithm.HS256);
    secrets.put(SignatureAlgorithm.HS256.getValue(), TextCodec.BASE64.encode(key.getEncoded()));
    key = MacProvider.generateKey(SignatureAlgorithm.HS384);
    secrets.put(SignatureAlgorithm.HS384.getValue(), TextCodec.BASE64.encode(key.getEncoded()));
    key = MacProvider.generateKey(SignatureAlgorithm.HS512);
    secrets.put(SignatureAlgorithm.HS512.getValue(), TextCodec.BASE64.encode(key.getEncoded()));
    return secrets;
}
 

@Override
public byte[] resolveSigningKeyBytes(JwsHeader header, Claims claims) {
    return TextCodec.BASE64.decode(secrets.get(header.getAlgorithm()));
}
 

public byte[] getHS256SecretBytes() {
    return TextCodec.BASE64.decode(secrets.get(SignatureAlgorithm.HS256.getValue()));
}
 

public byte[] getHS384SecretBytes() {
    return TextCodec.BASE64.decode(secrets.get(SignatureAlgorithm.HS384.getValue()));
}
 

public byte[] getHS512SecretBytes() {
    return TextCodec.BASE64.decode(secrets.get(SignatureAlgorithm.HS512.getValue()));
}
 

@Override
public boolean isValid(String jwtWithoutSignature, String base64UrlEncodedSignature) {

    byte[] data = jwtWithoutSignature.getBytes(US_ASCII);

    byte[] signature = TextCodec.BASE64URL.decode(base64UrlEncodedSignature);

    return this.signatureValidator.isValid(data, signature);
}
 

@Override
public String sign(String jwtWithoutSignature) {

    byte[] bytesToSign = jwtWithoutSignature.getBytes(US_ASCII);

    byte[] signature = signer.sign(bytesToSign);

    return TextCodec.BASE64URL.encode(signature);
}