router can not authenticate JWKS token

[killjoy2013]

Hi,
created my JWKS token like this;

and my .well-known/jwks.json endpoint is like this;

finally, my router.yaml is;

authentication:
  experimental:
    jwt:
      jwks_url: http://localhost:3100/.well-known/jwks.json
      header_name: Authorization
      header_value_prefix: Bearer
      cooldown: 15s

However, I'm getting below error in apollo studio;

What am I missing?
Thanks

[garypen]

That is telling you that it is finding a key and using it to verify your JWT, but your JWT wasn't signed with the chosen key.

Are you sure the JWT was signed with this key?

[killjoy2013]

those are the commands I used to create public & private keys;

openssl genrsa -out private.pem 3072

openssl rsa -in private.pem -pubout -out public.pem

keys are like this;

-----BEGIN RSA PRIVATE KEY-----
MIIG4wIBAAKCAYEAr/kIbUEgL9OQImLd+OYzlm/F6iUt0fyNlrf4ciGusahtKTAM
ctBPpFxUdNAniiR3sNcIpHvow8tCXbYNOP5+YChz9+8g/LRacjI+PcHIZvfkcKz8
1z+hUPZO1RXs5eYUjraQ8G8ccDvIYG66STh5a24jp0c1cyEtzelCLdjxkgCw81zb
N64LKEE53hs2pjQ91aiIrZlZ3LUgtclVQ3aXoOBk7jPDa/JI6oN1B5xl6eU0T1kL
RlDXSIdT/lpcKP63Whd5MDU5Mtpd7gnwXZDLoulCQnlz9jYPopF8gBrUr6AR57ZW
YM4SdeXGc+6XnfxyntbTbliL5pm5jZiHrUpAPZ4E4Lp2rZ99kU3iBrxT3ozqVfiv
AyAViY2hvnWCuhkpjiyyM5Ji5qSoLlAq27If7ss5XkYTLFkT7XlXwQ4QeH1AvP0h
AvBTxi8pStreqCAWghtBCM5WkdEmg7D2PQLYujBvjce7n/8N6sPx70oUDdmN9nKB
uOmfBi9dv7vtvoFtAgMBAAECggGAJsPAVHkFQyPi24BWD69+a8Rhn+vixSBSfII4
a8P5vM8yhOE9zMkQ0k84l6cHHspbx4wHLlzRcNhE3WnuTcDaTAp9SX/XD3QXfJKO
3YHjyLMRErU42Z39xl0MDqrOzfI6UxnqodyIMj0pLf0WcmzLapwPpJjuMFd9xJ9+
4aSpypT2ZhXtgL2JXavIuKHcDw7xFDEVMtDWV+VauFEKxFrKmjj0YvjqMsxjva2J
yUxtsvG37UbbUfkbA7I0EZMMPEen9HB/QPmoMOeBdyMZ2Fuu/AAECl3r7IEPpFKl
buIXZq5KvmGNrDL/+MGeAjl5sJNNkCijtyzwDNU7nExe9By+I9rmDHFB25GT341L
BwKBvMkRcCrL+e3/7ZJA4UbqXre5nBvy/m7q8g4d5Y2j9sGBPA/P+mQm1oqmh/SV
RXcB3DO89ER2QBsXBcQ0njrPZoh5DFHhb9PbvLrg8CJWEVdTtZO65r7kXC5xkBj5
P2ZIQkWsst6JHdPrLqF4aj53zqPNAoHBAOnMQVe+U72e+MubkfeTuVlwioQDYgyc
lkfe6K8fvaFAmnTPMrJ9T1nr7nud6BLxh/M8cdmokBwvWhLXsBuHMvUWls4ri7JX
2d/HkXrPw3fhxklcJFAzN5pSjO0xRGy4w40mR9jMm73qUvsRGY8ATWE5QkwJ1yeN
DHD9F6bejTZ2LkXyv10jhQkczC7m0E4P6kXxi1qPOrlKXb5fpAxBM/EzN87t7ZWG
Orh0rO4/91UMedKr/2lINOgQUIzOohEKUwKBwQDArwU/RwQyFeKGe+YTwUEtNNaO
SJBfATj/TPVaE7cO1uKy9tBO9RnuN2V1SIM/ReQ+OiaSPx0vPGKt+2OuR9yZCFhK
kaSxs38lIsF1v9SF5f11tMd42kk9X5oHudBwoGNh8H8hRMBr3GWybhWQ5vLHtplj
aTwYWNJeFx6a87bEK+YwBAGip8fKQq1bhAfNcu5RWqwy94gSpEvrAvDq0EWZq/pd
qghKOQdtEI/zls4/Ou4lz3tV+mB6tRVBIeyGTT8CgcAyXk3JgHh8Bo6lFsv4oXux
+BvvWuc5vlZl/3DzoYvx/IAKIEVUzMhWoAyN1zQTOLPIREJm2PjLCayHGK6ZD6R7
xrUQj7MV5fVLT6xY3//FiP91+ILeQFp/Rb+UriOGpLuEYjXiUBpRbPUZn9J4y2Dg
TDyrMweGPs3qXaxFx/Z2QDmx2h0+DJPxpaGbjSBdYPJgxSv3g5nsJ0hQ5jvqY/Wz
xgwE6Z9gsj1eVcyXu3ImgXyRVXq+DM9RG4qu+ylRMH8CgcEAkHOlz2aCMrpNdNz2
A+Fh524xW8Hy2gakoGElnz4ggrN+iQSX7lm58uj82wxduNXA4xXdTM6cJolywVQx
yrp9Gw0yg9TkT4Rt0X1Y49nIjgl6FwBMesHLHoPJifk31venCgmuhVZxm2tDopz8
9gDuCeNO40RFlUshiwByJWCIqFDw5RZb04FNOsj6Bh3Za6C6IauEZUFFdhROBgXS
b3dsdmSD8ixCwsI2WwGLqeZpAOZBG3+My0xFgDi5knbIR3cpAoHAdB+Vdo9JFur4
gez6TV4A16yJ6hunHt8kQPj77yJNErQ8phoLLXe/MTLkLJi7HfwRjULgTM3+XV7D
A/mEqi381KTl7ALkSVPsfhgm9lmlAE2E/RO2bAxIZ/LRgJxb8LrOj77Ljzqy7axD
62RBsPqC0oizjJAZj9GYuTjq51qw0N2VX3U710AuhFdlY8Ca3Pw0ejUvNmBBGJNL
buYmYCBpcvhUD2+i4VGRclu5+sx+xsR37zsn/WaYiDALqEtodgdZ
-----END RSA PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAr/kIbUEgL9OQImLd+OYz
lm/F6iUt0fyNlrf4ciGusahtKTAMctBPpFxUdNAniiR3sNcIpHvow8tCXbYNOP5+
YChz9+8g/LRacjI+PcHIZvfkcKz81z+hUPZO1RXs5eYUjraQ8G8ccDvIYG66STh5
a24jp0c1cyEtzelCLdjxkgCw81zbN64LKEE53hs2pjQ91aiIrZlZ3LUgtclVQ3aX
oOBk7jPDa/JI6oN1B5xl6eU0T1kLRlDXSIdT/lpcKP63Whd5MDU5Mtpd7gnwXZDL
oulCQnlz9jYPopF8gBrUr6AR57ZWYM4SdeXGc+6XnfxyntbTbliL5pm5jZiHrUpA
PZ4E4Lp2rZ99kU3iBrxT3ozqVfivAyAViY2hvnWCuhkpjiyyM5Ji5qSoLlAq27If
7ss5XkYTLFkT7XlXwQ4QeH1AvP0hAvBTxi8pStreqCAWghtBCM5WkdEmg7D2PQLY
ujBvjce7n/8N6sPx70oUDdmN9nKBuOmfBi9dv7vtvoFtAgMBAAE=
-----END PUBLIC KEY-----

eventually the token;

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleUlkIn0.eyJyaWdodHMiOlsicmVtb3ZlQ2l0eSIsInJlbW92ZUNvdW50cnkiLCJjb3VudHJpZXMiLCJjaXRpZXMiXSwidXNlcm5hbWUiOiJhZG1pbiIsInN1YiI6MSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDozMTAwIiwiaWF0IjoxNjc2MjMxNjU0LCJleHAiOjMyNzgwMjMxNjU0fQ.AwQF4196BA06WJ0zsoNp0WjnTBRId6jXO4T042mVeo6tsY1NTu16kll_sUEvwf6h3frTzEG3VObFrF05X3YOmRqUdUUDiqJvrpzQ4YBYxlQpQI3iTAA1nH-NPXHLgK4UfgUawU9QMxvhP7thPHP1gsA0uhDqSHbGgex_vK8ACZK0-Qef0e97JiwpjEUIVOojnYKECH_zrQrU0BmRYd6-2uIUVKjwaXsKSpHPgMDf8jDM0F7k9zpO6JzzXsHAKQwBIDPbAqgJcACbecwD9kLZIv64ae8DcXZgdTwYCSB3gk8xb9k-lf2NzeABaLv0q5cMYyHZ-HYdlkaNfhgWChKPHmJ2WMf9xepmxnkTUY-CHIv0_BbnCLtVzcjBTxn3m8WlX8nb2sx9byKjMJR6nLk6ZOrTsvZlHHNEXZso6pTyftp-UWgAnzDmtt6rLvUiqpgjfGNKbO0HgkAy8SPjUj9LbCHhqah_YuDLMZrllnLO6uMneQiaob8q4SASamlTD0iN

what else should I check?

[killjoy2013]

Hi @garypen any idea about still getting JWT invalidSignature with those keys & token?
Should I create public & private keys differently?

Thanks

[garypen]

One other comment. That looks like an older version of the router. The experimental support now expects to receive an array of jwks_urls. If you read the updated documentation at https://www.apollographql.com/docs/router/configuration/authn-jwt, it may be helpful.

[killjoy2013]

Just upgraded to router 1.10.3 & it's working nice 👍