title: How to work with (and create) X509 Certificates for private/public key encryption of JWT Tokens
body: <p>I am trying to figure out a way of authentication between two distributed services.</p>
  
  <p>I don't want to have a shared secret distributed on every service host, because it would mean that once one host has been compromised, all hosts are compromised. </p>
  
  <p><strong><em>So my scenario is:</em></strong></p>
  
  <ul>
  <li>Host A knows the public key of Host B</li>
  <li>Host A encodes and encryptes the jwt using Host B´s public key</li>
  <li>Host B receives and decrypts the jwt using its private key, that it only knows itself.</li>
  </ul>
  
  <p>The jose-jwt package:
  <a href="https://github.com/dvsekhvalnov/jose-jwt" rel="nofollow noreferrer">https://github.com/dvsekhvalnov/jose-jwt</a></p>
  
  <p>seems like a good option to me. Beside the signing of the jwt, it also supports encryption using private/public keys. </p>
  
  <p>On the page there are the following examples for encoding and decoding a jwt:</p>
  
  <p><strong>Encode:</strong></p>
  
  <pre><code>var publicKey=new X509Certificate2("my-key.p12", "password").PublicKey.Key as RSACryptoServiceProvider;
  
  string token = Jose.JWT.Encode(payload, publicKey, JweAlgorithm.RSA_OAEP, JweEncryption.A256GCM);
  </code></pre>
  
  <p><strong>Decode:</strong></p>
  
  <pre><code>var privateKey=new X509Certificate2("my-key.p12", "password", X509KeyStorageFlags.Exportable | X509KeyStorageFlags.MachineKeySet).PrivateKey as RSACryptoServiceProvider;
  
  string json = Jose.JWT.Decode(token,privateKey);
  </code></pre>
  
  <p><strong><em>Now, here is what i don´t understand:</em></strong></p>
  
  <ul>
  <li>How can I create a .p12 certificate file that only contains the public key information (for the host/service A that encodes the jwt) ?</li>
  <li>.. and how can I create a .p12 certificate file that contains both, the public and the private key information (for the host/service B that decodes the jwt) ?</li>
  </ul>
  
  <p>From all the research that I have done, i get the impression that you can either only make a .p12 file that contains both, or one that contains only the public key. But it seems there is no way to create two .p12 files, one with both information and one with only the public key. What am I missing?</p>
  
  <p>Thanks for your answers.</p>