How to compute a JWK thumbprint (RFC 7638) in PHP

1<?php
2// RFC 7638: the required members of each key type, in lexicographic order
3const REQUIRED = ['EC' => ['crv', 'kty', 'x', 'y'], 'RSA' => ['e', 'kty', 'n'], 'OKP' => ['crv', 'kty', 'x'], 'oct' => ['k', 'kty']];
4 
5function base64url(string $bytes): string
6{
7    return rtrim(strtr(base64_encode($bytes), '+/', '-_'), '=');
8}
9 
10function jwkThumbprint(array $jwk): string
11{
12    $members = [];
13    foreach (REQUIRED[$jwk['kty']] as $name) {
14        $members[$name] = $jwk[$name];
15    }
16    // No escaped slashes, no \u escapes: the members are hashed exactly as RFC 7638 serializes them
17    $canonical = json_encode($members, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
18    return base64url(hash('sha256', $canonical, true));
19}
20 
21foreach (['ec.jwk.json', 'rsa.jwk.json', 'okp.jwk.json'] as $file) {
22    echo "$file: ", jwkThumbprint(json_decode(file_get_contents($file), true, flags: JSON_THROW_ON_ERROR)), PHP_EOL;
23}

1// From a PEM public key: ext-openssl exposes the raw key components
2function publicJwk(string $pem): array
3{
4    $details = openssl_pkey_get_details(openssl_pkey_get_public($pem));
5    return match ($details['type']) {
6        OPENSSL_KEYTYPE_EC => [
7            'kty' => 'EC',
8            'crv' => ['prime256v1' => 'P-256', 'secp384r1' => 'P-384', 'secp521r1' => 'P-521'][$details['ec']['curve_name']],
9            // coordinates are fixed-length: left-pad to the curve size (32 bytes for P-256)
10            'x' => base64url(str_pad($details['ec']['x'], intdiv($details['bits'] + 7, 8), "\0", STR_PAD_LEFT)),
11            'y' => base64url(str_pad($details['ec']['y'], intdiv($details['bits'] + 7, 8), "\0", STR_PAD_LEFT)),
12        ],
13        OPENSSL_KEYTYPE_RSA => ['kty' => 'RSA', 'n' => base64url($details['rsa']['n']), 'e' => base64url($details['rsa']['e'])],
14        OPENSSL_KEYTYPE_ED25519 => ['kty' => 'OKP', 'crv' => 'Ed25519', 'x' => base64url($details['ed25519']['pub_key'])],
15    };
16}
17 
18foreach (['ec.pub.pem', 'rsa.pub.pem', 'okp.pub.pem'] as $file) {
19    echo "$file: ", jwkThumbprint(publicJwk(file_get_contents($file))), PHP_EOL;
20}