diff --git a/backend/src/services/cmek/cmek-service.ts b/backend/src/services/cmek/cmek-service.ts
index a708e8315..8373dc271 100644
--- a/backend/src/services/cmek/cmek-service.ts
+++ b/backend/src/services/cmek/cmek-service.ts
@@ -302,7 +302,9 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
 
     const publicKey = await kmsService.getPublicKey({ kmsId: keyId });
 
-    return { publicKey, projectId: key.projectId };
+    const base64EncodedPublicKey = publicKey.toString("base64");
+
+    return { publicKey: base64EncodedPublicKey, projectId: key.projectId };
   };
 
   const cmekSign = async ({ keyId, data, signingAlgorithm }: TCmekSignDTO, actor: OrgServiceActor) => {
diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts
index dd68bf02e..78356aefb 100644
--- a/backend/src/services/kms/kms-service.ts
+++ b/backend/src/services/kms/kms-service.ts
@@ -454,13 +454,16 @@ export const kmsServiceFactory = ({
 
     const publicKeyBuffer = signingService(encryptionAlgorithm).getPublicKeyFromPrivateKey(kmsKey);
 
-    return crypto
-      .createPublicKey({
-        key: publicKeyBuffer,
-        format: "pem",
-        type: "spki"
-      })
-      .export({ type: "spki", format: "pem" }) as string; // format 'pem' makes it a string
+    return (
+      crypto
+        .createPublicKey({
+          key: publicKeyBuffer,
+          format: "pem",
+          type: "spki"
+        })
+        // We return as a DER encoded X.509 certificate (https://datatracker.ietf.org/doc/html/rfc5280)
+        .export({ type: "spki", format: "der" })
+    );
   };
 
   const signWithKmsKey = async ({ kmsId }: Pick<TSignWithKmsDTO, "kmsId">) => {