Build: Generate RSA Key Pair for RS256

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

jsonwebtoken, redisRequired
npm install jsonwebtoken ioredis @types/jsonwebtoken
RSA key pairRequired
openssl genrsa -out private.pem 2048 && openssl rsa -in private.pem -pubout -out public.pem
Redis (local)Required
docker run -p 6379:6379 redis:7-alpine

🔑

Step 1 of 4

Generate RSA Key Pair for RS256

Create an RSA-2048 key pair. The private key signs tokens (auth server only). The public key verifies tokens (any service can have it).

Tasks

Generate the key pair with openssl

Store private key in `process.env.JWT_PRIVATE_KEY` — never commit to git

Add `*.pem` to `.gitignore`

🎯 What You'll Learn

▸Understand asymmetric signing vs symmetric (HS256)
▸Know why resource servers don't need the private key
▸Store keys correctly in environment variables

Code

Bashgenerate-keys.sh
1 #!/bin/bash
2 # Generate RSA-2048 key pair for JWT RS256 signing
3 openssl genrsa -out private.pem 2048
4 openssl rsa -in private.pem -pubout -out public.pem
5  
6 echo "Keys generated:"
7 echo "  private.pem — keep SECRET, set as JWT_PRIVATE_KEY env var"
8 echo "  public.pem  — distribute to resource servers for verification"
9  
10 # Add to .gitignore
11 echo "*.pem" >> .gitignore
12 echo "Added *.pem to .gitignore"
13

💡 Pro Tips

▸RS256 is preferred in multi-service architectures — compromise of one service doesn't expose the signing key

Expected Output

private.pem (keep secret) and public.pem (share with services) generated

Discussion

1 #!/bin/bash 2 # Generate RSA-2048 key pair for JWT RS256 signing 3 openssl genrsa -out private.pem 2048 4 openssl rsa -in private.pem -pubout -out public.pem 5 6 echo "Keys generated:" 7 echo " private.pem — keep SECRET, set as JWT_PRIVATE_KEY env var" 8 echo " public.pem — distribute to resource servers for verification" 9 10 # Add to .gitignore 11 echo "*.pem" >> .gitignore 12 echo "Added *.pem to .gitignore" 13

1	#!/bin/bash
2	# Generate RSA-2048 key pair for JWT RS256 signing
3	openssl genrsa -out private.pem 2048
4	openssl rsa -in private.pem -pubout -out public.pem
5
6	echo "Keys generated:"
7	echo " private.pem — keep SECRET, set as JWT_PRIVATE_KEY env var"
8	echo " public.pem — distribute to resource servers for verification"
9
10	# Add to .gitignore
11	echo "*.pem" >> .gitignore
12	echo "Added *.pem to .gitignore"
13