笔者最近在鼓捣对Spring Boot项目里应用Spring Security的JWT认证，用了它的官方的demo能跑通
https://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/jwt/loginhttps://github.com/spring-projects/spring-security-samples/tree/main/servlet/spring-boot/java/jwt/login
它里面用到了两个文件： app.key, app.pub 是demo里提供的RSA的密钥对， 笔者想换成自己的，研究了怎么用命令行生成， 找了几个网页都不靠谱，后来找到一个能跑通，分享下，前提条件，在window下用git bash操作。
先建个目录，例如jwt, git bash命令行进入这个目录ssh-keygen -t rsa -m PEM按提示输入保存的文件名，例如 rsa, 其他直接回车
就会发现当前文件夹生成了两个文件
导出符合X509规范的公钥内容ssh-keygen -m PKCS8 -e
把这公钥内容替换到Spring Security JWT里的app.pub文件里内容即可
导出私钥文件openssl pkcs8 -topk8 -inform pem -in rsa -outform pem -nocrypt -out app.key
生成了app.key, 打开内容类似如下
把这个文件替换Spring Security JWT里的app.key文件即可。
参考：
Spring JWT with RSA (asymmetric encryption algorithm)Let's say we have an "auth server" that signs tokens for us and a "resource server" where we store some pretty sensitive data. We trust the auth server and we want to validate that the JWT we get indeed comes from that trusted auth server. In other words, how can we be sure that the guy who wants to detonate our printers is using a JWT that is from that very auth server?https://leaks.wanari.com/2020/09/25/spring-jwt-with-rsa
