core/src/main/java/org/springframework/security/converter/RsaKeyConverters.java
public static Converter<InputStream, RSAPrivateKey> pkcs8() {
		KeyFactory keyFactory = rsaFactory();
		return source -> {
			List<String> lines = readAllLines(source);
			Assert.isTrue(!lines.isEmpty() && lines.get(0).startsWith(PKCS8_PEM_HEADER),
					"Key is not in PEM-encoded PKCS#8 format, " +
							"please check that the header begins with -----" + PKCS8_PEM_HEADER + "-----");
			String base64Encoded = lines.stream()
					.filter(RsaKeyConverters::isNotPkcs8Wrapper)
					.collect(Collectors.joining());
			byte[] pkcs8 = Base64.getDecoder().decode(base64Encoded);

			try {
				return (RSAPrivateKey) keyFactory.generatePrivate(
						new PKCS8EncodedKeySpec(pkcs8));
			} catch (Exception e) {
				throw new IllegalArgumentException(e);
			}
		};
	}
public static Converter<InputStream, RSAPrivateKey> pkcs8() {
		KeyFactory keyFactory = rsaFactory();
		return source -> {
			List<String> lines = readAllLines(source);
			Assert.isTrue(!lines.isEmpty() && lines.get(0).startsWith(PKCS8_PEM_HEADER),
					"Key is not in PEM-encoded PKCS#8 format, " +
							"please check that the header begins with -----" + PKCS8_PEM_HEADER + "-----");
			String base64Encoded = lines.stream()
					.filter(RsaKeyConverters::isNotPkcs8Wrapper)
					.collect(Collectors.joining());
			byte[] pkcs8 = Base64.getDecoder().decode(base64Encoded);

			try {
				return (RSAPrivateKey) keyFactory.generatePrivate(
						new PKCS8EncodedKeySpec(pkcs8));
			} catch (Exception e) {
				throw new IllegalArgumentException(e);
			}
		};
	}
public static Converter < InputStream , RSAPrivateKey > pkcs8 ( ) { KeyFactory keyFactory = rsaFactory ( ) ; return source -> { List < String > lines = readAllLines ( source ) ; Assert . isTrue ( ! lines . isEmpty ( ) && lines . get ( 0 ) . startsWith ( PKCS8_PEM_HEADER ) , "Key is not in PEM-encoded PKCS#8 format, " + "please check that the header begins with -----" + PKCS8_PEM_HEADER + "-----" ) ; String base64Encoded = lines . stream ( ) . filter ( RsaKeyConverters :: isNotPkcs8Wrapper ) . collect ( Collectors . joining ( ) ) ; byte [ ] pkcs8 = Base64 . getDecoder ( ) . decode ( base64Encoded ) ; try { return ( RSAPrivateKey ) keyFactory . generatePrivate ( new PKCS8EncodedKeySpec ( pkcs8 ) ) ; } catch ( Exception e ) { throw new IllegalArgumentException ( e ) ; } } ; }
Construct a {@link Converter} for converting a PEM-encoded PKCS#8 RSA Private Key
into a {@link RSAPrivateKey}.

Note that keys are often formatted in PKCS#1 and this can easily be identified by the header.
If the key file begins with "-----BEGIN RSA PRIVATE KEY-----", then it is PKCS#1. If it is
PKCS#8 formatted, then it begins with "-----BEGIN PRIVATE KEY-----".

This converter does not close the {@link InputStream} in order to avoid making non-portable
assumptions about the streams' origin and further use.

@return A {@link Converter} that can read a PEM-encoded PKCS#8 RSA Private Key and return a
{@link RSAPrivateKey}.
Construct a { @link Converter } for converting a PEM - encoded PKCS#8 RSA Private Key into a { @link RSAPrivateKey } .