diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c b/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
index 6d5211657..384777610 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
@@ -439,12 +439,17 @@ static bool encode_rsa(private_pkcs11_public_key_t *this,
 		attr[0].ulValueLen > 0 && attr[1].ulValueLen > 0)
 	{
 		chunk_t n, e;
-		n = chunk_create(attr[0].pValue, attr[0].ulValueLen);
+		/* some tokens/libraries add unnecessary 0x00 prefixes */
+		n = chunk_skip_zero(chunk_create(attr[0].pValue, attr[0].ulValueLen));
 		if (n.ptr[0] & 0x80)
-		{	/* add leading 0x00, encoders expect it already like this */
+		{	/* add leading 0x00, encoders might expect it in two's complement */
 			n = chunk_cata("cc", chunk_from_chars(0x00), n);
 		}
-		e = chunk_create(attr[1].pValue, attr[1].ulValueLen);
+		e = chunk_skip_zero(chunk_create(attr[1].pValue, attr[1].ulValueLen));
+		if (e.ptr[0] & 0x80)
+		{
+			e = chunk_cata("cc", chunk_from_chars(0x00), e);
+		}
 		success = lib->encoding->encode(lib->encoding, type, cache, encoding,
 			CRED_PART_RSA_MODULUS, n, CRED_PART_RSA_PUB_EXP, e, CRED_PART_END);
 	}