Encoding may be performed on Java API cryptographic objects that implement DEREncodable^PREVIEW. The encode(DEREncodable) and encodeToString(DEREncodable) methods encode a DEREncodable into PEM and return the data in a byte array or String.

Private keys can be encrypted and encoded by configuring a PEMEncoder with the withEncryption(char[]) method, which takes a password and returns a new PEMEncoder instance configured to encrypt the key with that password. Alternatively, a private key encrypted as an EncryptedKeyInfo object can be encoded directly to PEM by passing it to the encode or encodeToString methods.

PKCS #8 2.0 defines the ASN.1 OneAsymmetricKey structure, which may contain both private and public keys. KeyPair objects passed to the encode or encodeToString methods are encoded as a OneAsymmetricKey structure using the "PRIVATE KEY" type.

When encoding a PEMRecord^PREVIEW, the API surrounds the PEMRecord.content()^PREVIEW with the PEM header and footer from PEMRecord.type()^PREVIEW. PEMRecord.leadingData()^PREVIEW is not included in the encoding. PEMRecord will not perform validity checks on the data.

The following lists the supported DEREncodable classes and the PEM types that each are encoded as:

• X509Certificate : CERTIFICATE
• X509CRL : X509 CRL
• PublicKey: PUBLIC KEY
• PrivateKey : PRIVATE KEY
• PrivateKey (if configured with encryption): ENCRYPTED PRIVATE KEY
• EncryptedPrivateKeyInfo : ENCRYPTED PRIVATE KEY
• KeyPair : PRIVATE KEY
• X509EncodedKeySpec : PUBLIC KEY
• PKCS8EncodedKeySpec : PRIVATE KEY
• PEMRecord : PEMRecord.type()

This class is immutable and thread-safe.

Here is an example of encoding a PrivateKey object:

    PEMEncoder pe = PEMEncoder.of();
    byte[] pemData = pe.encode(privKey);

Here is an example that encrypts and encodes a private key using the specified password:

    PEMEncoder pe = PEMEncoder.of().withEncryption(password);
    byte[] pemData = pe.encode(privKey);