Neo OcLib

infrastructure/claims/crypto.go

@@ -99,9 +99,20 @@ func New(privateKey []byte, publicKeys map[string][]byte) (client *Client, err e
 	if privateKey != nil {
 		validPrivateKey, errPrivate := x509.ParsePKCS1PrivateKey(privateKey)
 		if errPrivate != nil {
-			err = errPrivate
-			log.Println(err)
-			return
+			// Fallback to PKCS8 (generated with openssl genpkey or similar)
+			key, errPKCS8 := x509.ParsePKCS8PrivateKey(privateKey)
+			if errPKCS8 != nil {
+				err = errPKCS8
+				log.Println(err)
+				return
+			}
+			rsaKey, ok := key.(*rsa.PrivateKey)
+			if !ok {
+				err = errors.New("PKCS8 private key is not RSA")
+				log.Println(err)
+				return
+			}
+			validPrivateKey = rsaKey
 		}
 		client.PrivateKey = validPrivateKey
 	}
@@ -111,9 +122,20 @@ func New(privateKey []byte, publicKeys map[string][]byte) (client *Client, err e
 		for k, v := range publicKeys {
 			validPublicKey, errPublic := x509.ParsePKCS1PublicKey(v)
 			if errPublic != nil {
-				err = errPublic
-				log.Println(err)
-				return
+				// Fallback to PKIX (SubjectPublicKeyInfo, generated alongside PKCS8 private key)
+				key, errPKIX := x509.ParsePKIXPublicKey(v)
+				if errPKIX != nil {
+					err = errPKIX
+					log.Println(err)
+					return
+				}
+				rsaKey, ok := key.(*rsa.PublicKey)
+				if !ok {
+					err = errors.New("PKIX public key is not RSA")
+					log.Println(err)
+					return
+				}
+				validPublicKey = rsaKey
 			}
 			if validPublicKey == nil {
 				err = errors.New("Invalid Public Key Type")