@ReadOperation(produces = MediaType.TEXT_PLAIN_VALUE)
    @Operation(summary = "Get public key for signing operations", parameters = @Parameter(name = "service", required = false, description = "The service to look up"))
    public String fetchPublicKey(
        @Nullable
        final String service) throws Exception {
        var signingKey = tokenCipherExecutor.getSigningKey();

        if (StringUtils.isNotBlank(service)) {
            val webApplicationService = webApplicationServiceFactory.createService(service);
            val registeredService = servicesManager.findServiceBy(webApplicationService);
            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(webApplicationService, registeredService);
            val serviceCipher = new RegisteredServiceJwtTicketCipherExecutor();
            if (serviceCipher.supports(registeredService)) {
                val cipher = serviceCipher.getTokenTicketCipherExecutorForService(registeredService);
                if (cipher.isEnabled()) {
                    signingKey = cipher.getSigningKey();
                }
            }
        }

        if (signingKey instanceof final RSAPrivateCrtKey rsaSigningKey) {
            val factory = KeyFactory.getInstance("RSA");
            val publicKey = factory.generatePublic(new RSAPublicKeySpec(rsaSigningKey.getModulus(), rsaSigningKey.getPublicExponent()));
            val writer = new StringWriter();
            try (val pemWriter = new JcaPEMWriter(writer)) {
                pemWriter.writeObject(publicKey);
                pemWriter.flush();
            }
            return writer.toString();
        }
        return StringUtils.EMPTY;
    }
Fetch public key.

@param service the service
@return the string
@throws Exception the exception
support/cas-server-support-token-core-api/src/main/java/org/apereo/cas/token/JwtTokenCipherSigningPublicKeyEndpoint.java