Hi Team,

I am doing some work around processing JWT token in Pega. In my test app, I create a keystore.jks and use it to generate an JWT token by calling pxGenerateJWT. Then I call pxProcessJWT to process the token with my truststore.jks (generated by the keystore.jks). However, I got this error in the log:

2021-09-05 01:43:11,634 [http-nio-8080-exec-4] [  STANDARD] [                    ] [    TestApp:01.01.01] (ta_Admin_Security_Token.Action) ERROR localhost| Proprietary information hidden diepd - Unable to process the Json Web Token 
com.pega.pegarules.pub.PRRuntimeException: Unable to retrieve JWK public key 
	at com.pega.platform.securitycore.internal.jwt.JWTSignatureVerifier.getJWSKeySelectorFromPubKey(JWTSignatureVerifier.java:280) ~[security-core.jar:?] 
	at com.pega.platform.securitycore.internal.jwt.JWTSignatureVerifier.getJWSKeySelector(JWTSignatureVerifier.java:211) ~[security-core.jar:?] 
	at com.pega.platform.securitycore.internal.jwt.JWTSignatureVerifier.validateSignature(JWTSignatureVerifier.java:191) ~[security-core.jar:?] 
	at com.pega.platform.securitycore.internal.jwt.JWTProcessorImpl.processGeneratedJsonWebToken(JWTProcessorImpl.java:172) ~[security-core.jar:?] 
	at com.pega.pegarules.integration.engine.internal.security.jwt.JWTUtilsImpl.processJSONWebToken(JWTUtilsImpl.java:244) ~[printegrint.jar:?] 
	at com.pegarules.generated.activity.ra_action_pxprocessjwt_99e447b231b02066bcf63faa704cca68.step3_circum0(ra_action_pxprocessjwt_99e447b231b02066bcf63faa704cca68.java:378) ~[?:?] 
	at com.pegarules.generated.activity.ra_action_pxprocessjwt_99e447b231b02066bcf63faa704cca68.perform(ra_action_pxprocessjwt_99e447b231b02066bcf63faa704cca68.java:114) ~[?:?] 

If I use keystore.jks directly when calling pxProcessJWT, everything is ok. So I guess my issue is about the way I generate my truststore.jks. Could you tell me how to generate a truststore.jks from keystore.jks (or from a certification.crt file) ?

This is how I generate my truststore.jks from keystore.jks.:

1/ keytool -export -alias dattest -file dattest.der -keystore keystore.jks  

2/ openssl x509 -inform der -in dattest.der -out dattest.pem     

3/ keytool -importcert -file dattest.pem -keystore truststore.jks -alias dattest  

Thank you,

Dat