core/src/main/java/org/springframework/security/converter/RsaKeyConverters.java
public static Converter<InputStream, RSAPrivateKey> pkcs8() {
		KeyFactory keyFactory = rsaFactory();
		return source -> {
			List<String> lines = readAllLines(source);
			Assert.isTrue(!lines.isEmpty() && lines.get(0).startsWith(PKCS8_PEM_HEADER),
					"Key is not in PEM-encoded PKCS#8 format, " +
							"please check that the header begins with -----" + PKCS8_PEM_HEADER + "-----");
			String base64Encoded = lines.stream()
					.filter(RsaKeyConverters::isNotPkcs8Wrapper)
					.collect(Collectors.joining());
			byte[] pkcs8 = Base64.getDecoder().decode(base64Encoded);

			try {
				return (RSAPrivateKey) keyFactory.generatePrivate(
						new PKCS8EncodedKeySpec(pkcs8));
			} catch (Exception e) {
				throw new IllegalArgumentException(e);
			}
		};
	}
public static Converter<InputStream, RSAPrivateKey> pkcs8() {
		KeyFactory keyFactory = rsaFactory();
		return source -> {
			List<String> lines = readAllLines(source);
			Assert.isTrue(!lines.isEmpty() && lines.get(0).startsWith(PKCS8_PEM_HEADER),
					"Key is not in PEM-encoded PKCS#8 format, " +
							"please check that the header begins with -----" + PKCS8_PEM_HEADER + "-----");
			String base64Encoded = lines.stream()
					.filter(RsaKeyConverters::isNotPkcs8Wrapper)
					.collect(Collectors.joining());
			byte[] pkcs8 = Base64.getDecoder().decode(base64Encoded);

			try {
				return (RSAPrivateKey) keyFactory.generatePrivate(
						new PKCS8EncodedKeySpec(pkcs8));
			} catch (Exception e) {
				throw new IllegalArgumentException(e);
			}
		};
	}
Construct a {@link Converter} for converting a PEM-encoded PKCS#8 RSA Private Key
into a {@link RSAPrivateKey}.

Note that keys are often formatted in PKCS#1 and this can easily be identified by the header.
If the key file begins with "-----BEGIN RSA PRIVATE KEY-----", then it is PKCS#1. If it is
PKCS#8 formatted, then it begins with "-----BEGIN PRIVATE KEY-----".

This converter does not close the {@link InputStream} in order to avoid making non-portable
assumptions about the streams' origin and further use.

@return A {@link Converter} that can read a PEM-encoded PKCS#8 RSA Private Key and return a
{@link RSAPrivateKey}.