diff --git a/debian/control b/debian/control
index 735d78bd..f8dd0075 100644
--- a/debian/control
+++ b/debian/control
@@ -12,6 +12,7 @@ Build-Depends:
  libclone-perl,
  libconfig-general-perl,
  libconfig-tiny-perl,
+ libcryptx-perl,
  libdata-validate-ip-perl,
  libdbd-mysql-perl,
  libdbi-perl,
@@ -55,6 +56,7 @@ Depends:
  libclone-perl,
  libconfig-general-perl,
  libconfig-tiny-perl,
+ libcryptx-perl,
  libdata-validate-ip-perl,
  libdbd-mysql-perl,
  libdbi-perl,
diff --git a/lib/NGCP/Template/Plugin/Utils.pm b/lib/NGCP/Template/Plugin/Utils.pm
index a6bbc7fb..08c685d4 100644
--- a/lib/NGCP/Template/Plugin/Utils.pm
+++ b/lib/NGCP/Template/Plugin/Utils.pm
@@ -8,6 +8,7 @@ use parent qw(Template::Plugin);
 use MIME::Base64 ();
 use Data::Dumper ();
 use Config::General ();
+use Crypt::PK::RSA ();
 
 sub new {
     my ($class, $context, @params) = @_;
@@ -38,6 +39,26 @@ sub get_ref {
     return ref $params[0];
 }
 
+sub get_private_key_pem {
+    my ($self, @params) = @_;
+    return unless $params[0];
+    return unless keys %{$params[0]};
+    my $pk = Crypt::PK::RSA->new();
+    $pk->import_key($params[0]);
+    die('not a private key: ' . Data::Dumper::Dumper($params[0])) unless $pk->is_private();
+    return $pk->export_key_pem('private');
+}
+
+sub get_public_key_pem {
+    my ($self, @params) = @_;
+    return unless $params[0];
+    return unless keys %{$params[0]};
+    my $pk = Crypt::PK::RSA->new();
+    $pk->import_key($params[0]);
+    die('not a public key: ' . Data::Dumper::Dumper($params[0])) if $pk->is_private();
+    return $pk->export_key_pem('public');
+}
+
 1;
 
 __END__
@@ -79,6 +100,14 @@ Serializes the given input object to string (Config::General syntax).
 
 Get the variable type.
 
+=item [% pem = Utils.get_private_key_pem(private key) %]
+
+Converts the given RSA private key (JWK data structure) to .pem.
+
+=item [% pem = Utils.get_public_key_pem(public key) %]
+
+Converts the given RSA public key (JWK data structure) to .pem.
+
 =back
 
 =head1 AUTHOR