Convert PKCS#7/CMS to JOSE format

post

https://{host}:{port}/api/v3/migration/convert-pkcs7-to-jose

Converts legacy PKCS#7/CMS files to modern JOSE (JWE/JWS) format.

This is a format conversion (PKCS#7 container → JOSE container), not an algorithm conversion.
Classical algorithms (RSA, ECDSA, AES) are preserved or upgraded (CBC→GCM).

Supported conversions:

SignedData (1 signer) → JWS Compact
EnvelopedData (1 recipient) → JWE Compact
SignedAndEnvelopedData (1 signer + 1 recipient) → JWE(JWS) Compact

Future enhancement: Multi-signer/multi-recipient support with JSON serialization

Process:

Parse PKCS#7 structure
Verify signatures (optional)
Decrypt if encrypted (using imported key)
Match signers/recipients with imported keys
Re-sign/re-encrypt with JOSE format

Prerequisites: Import private keys via POST /api/migration/pkcs12

Next steps: For PQC algorithms, use POST /api/crypto/reencrypt or POST /api/crypto/resign

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

PKCS#7/CMS conversion request with Base64-encoded data and options

Request for converting PKCS#7/CMS to JOSE (JWE/JWS).

pkcs7Data

string

required

PKCS#7/CMS data encoded as Base64 (DER format)

decryptionKid

string

Optional: Key identifier for decrypting EnvelopedData.
Required if PKCS#7 structure is encrypted (EnvelopedData or SignedAndEnvelopedData).
Must reference a key imported via /api/migration/pkcs12.
System will validate that this key matches the PKCS#7 recipient (issuerDN + serialNumber).

serialization

string

enum

Defaults to AUTO

Output serialization mode.

AUTO (default): Choose Compact if 1 signer + 1 recipient, else error
COMPACT: Force Compact serialization (error if >1 actor)
JSON: Force JSON serialization (not yet available)

Allowed:

targetFormat

string

enum

Defaults to AUTO

Target JOSE format.

AUTO (default): Detect from PKCS#7 structure
- SignedData only → JWS
- EnvelopedData only → JWE
- Both → JWE_JWS_NESTED
JWS: Force JWS output (error if PKCS#7 has encryption)
JWE: Force JWE output (error if PKCS#7 has signature)
JWE_JWS_NESTED: Force nested output (error if PKCS#7 lacks signature or encryption)

Allowed:

validateCertificates

boolean

Defaults to false

Policy flag: validate certificate chains using PKIX (default: false).
If true, performs full PKIX validation of embedded certificates.
Not yet available.

validateTimestamp

boolean

Defaults to false

Policy flag: validate RFC 3161 timestamps (default: false).
If true, verifies timestamp token signature and messageImprint.
Not yet available.

algorithmPolicy

object

Algorithm transformation policy.
Controls how legacy PKCS#7 algorithms are upgraded to modern JOSE algorithms.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200PKCS#7 conversion successful

400Bad Request: invalid Base64 or file is not a valid PKCS#7/CMS structure

401Unauthorized: missing or invalid JWT token

413Payload Too Large: decoded PKCS#7 data exceeds 5MB

422Unprocessable Entity: valid PKCS#7 but conversion not supported or required private key missing

500Internal Server Error: unexpected conversion error