Skip to main content
Question

JWT token fails with "OpenSSL unable to verify data"

  • May 22, 2025
  • 2 replies
  • 54 views

Forum|alt.badge.img

I'm attempting to write a simple app to upload files via the API. The enterprise admin requests that we use the OAuth 2.0 authentication scheme, and I've followed the directions to generate my enterprise key, public/private keypair and so on. I'm on a very lightweight platform that has openssl, perl and bash, so I've been attmepting this in either shell or perl. Unfortunately, while I can generate a token that validates on jwt.io, when I post it to  api.box.com/oauth2/token, I receive this error:

 

{"error":"invalid_grant","error_description":"OpenSSL unable to verify data: error:0906D06C:PEM routines:PEM_read_bio:no start line"}

 

Other posts I've read suggest this happens when there are Windows line breaks, or when base64 encoding is used instead of base64url, but I don't have either of these problems.

 

Is it possible to create the JWT completely in bash using simple string concatenation, openssl commands and curl to send? I'd love to start with something simple like that and work my way up from there.

 

Thanks!

2 replies

Forum|alt.badge.img

As it turns out, my problem had nothing to do with the private key PEM file, and was related to generating the wrong kind of signature. So, it was a real issue, but nothing like what the message described.


Forum|alt.badge.img

You didn't have any issues with your PEM file?