class JwkToPublicKeyConverter {

    public String convertFirstPublicKeyJwkToPem(String jwkJson, String caAlias, String caKeyStore,
            String caKeyStoreType, char[] caKeyStorePassword, char[] caKeyPassword) {
        try {
            HttpsConfig config = HttpsConfig.builder().keyAlias(caAlias).keyStore(caKeyStore)
                    .keyStoreType(caKeyStoreType).keyStorePassword(caKeyStorePassword).keyPassword(caKeyPassword)
                    .build();
            KeyStore keyStore = SecurityUtils.loadKeyStore(config);
            Certificate caCertificate = keyStore.getCertificate(config.getKeyAlias());
            PrivateKey caPrivateKey = (PrivateKey) keyStore.getKey(config.getKeyAlias(), config.getKeyPassword());
            SubjectPublicKeyInfo publicKey = extractPublicKey(jwkJson);

            ContentSigner signer = new JcaContentSignerBuilder("Sha256With" + caPrivateKey.getAlgorithm())
                    .build(caPrivateKey);
            Date now = new Date();
            Calendar c = Calendar.getInstance();
            c.setTime(now);
            c.add(Calendar.YEAR, 10);

            X500Name name = new X500Name(
                    new RDN[] { new RDN(BCStyle.CN, new DERPrintableString("Zowe JWT Public Key")) });

            JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

            X509CertificateHolder caX509Certificate = new X509CertificateHolder(caCertificate.getEncoded());

            X509CertificateHolder x509CertificateHolder = new X509v3CertificateBuilder(caX509Certificate.getSubject(),
                    new BigInteger(Long.toString(System.currentTimeMillis())), now, c.getTime(), name, publicKey)
                            .addExtension(Extension.subjectKeyIdentifier, false,
                                    new BcX509ExtensionUtils().createSubjectKeyIdentifier(publicKey))
                            .addExtension(Extension.extendedKeyUsage, false,
                                    new ExtendedKeyUsage(new KeyPurposeId[] { KeyPurposeId.id_kp_clientAuth,
                                            KeyPurposeId.id_kp_serverAuth }))
                            .addExtension(Extension.authorityKeyIdentifier, false,
                                    extUtils.createAuthorityKeyIdentifier(caCertificate.getPublicKey()))
                            .build(signer);

            return certificateHolderToPem(x509CertificateHolder);
        } catch (ParseException | JOSEException | CertificateException | IOException | OperatorCreationException
                | KeyStoreException | UnrecoverableKeyException | NoSuchAlgorithmException e) {
            throw new JwkConversionError(e);
        }
    }

}