diff --git a/jni/jni_rsa.c b/jni/jni_rsa.c
index 75a92865..976ba99c 100644
--- a/jni/jni_rsa.c
+++ b/jni/jni_rsa.c
@@ -561,23 +561,6 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateKeyToP
         }
     }
 
-    /* Get PKCS#8 output size, into pkcs8Sz */
-    if (ret == 0) {
-        ret = wc_CreatePKCS8Key(NULL, &pkcs8Sz, derKey, derKeySz, algoID,
-                                curveOID, oidSz);
-        if (ret == LENGTH_ONLY_E) {
-            pkcs8 = (byte*)XMALLOC(pkcs8Sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-            if (pkcs8 == NULL) {
-                ret = MEMORY_E;
-            }
-            else {
-                XMEMSET(pkcs8, 0, pkcs8Sz);
-                pkcs8BufSz = pkcs8Sz;
-                ret = 0;
-            }
-        }
-    }
-
     if (ret == 0) {
         /* Allocate temp buffer to hold DER encoded key */
         derKey = (byte*)XMALLOC(derKeySz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -599,6 +582,23 @@ JNIEXPORT jbyteArray JNICALL Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateKeyToP
         }
     }
 
+    /* Get PKCS#8 output size, into pkcs8Sz. */
+    if (ret == 0) {
+        ret = wc_CreatePKCS8Key(NULL, &pkcs8Sz, derKey, derKeySz, algoID,
+                                curveOID, oidSz);
+        if (ret == LENGTH_ONLY_E) {
+            pkcs8 = (byte*)XMALLOC(pkcs8Sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            if (pkcs8 == NULL) {
+                ret = MEMORY_E;
+            }
+            else {
+                XMEMSET(pkcs8, 0, pkcs8Sz);
+                pkcs8BufSz = pkcs8Sz;
+                ret = 0;
+            }
+        }
+    }
+
     /* Create PKCS#8 from DER key */
     if (ret == 0) {
         ret = wc_CreatePKCS8Key(pkcs8, &pkcs8Sz, derKey, derKeySz,
diff --git a/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java b/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java
index 738e01aa..83eee480 100644
--- a/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java
+++ b/src/test/java/com/wolfssl/wolfcrypt/test/RsaTest.java
@@ -423,6 +423,21 @@ public class RsaTest {
         pub.releaseNativeStruct();
     }
 
+    @Test
+    public void rsaPrivateKeyToPkcs8RoundTrip() {
+        Rsa key = makeKeyWithRetry(2048, 65537, rng);
+
+        byte[] pkcs8 = key.privateKeyEncodePKCS8();
+        assertNotNull(pkcs8);
+        assertTrue(pkcs8.length > 0);
+        key.releaseNativeStruct();
+
+        /* PKCS8 output must decode back into a usable private key */
+        Rsa decoded = new Rsa();
+        decoded.decodePrivateKeyPKCS8(pkcs8);
+        decoded.releaseNativeStruct();
+    }
+
     @Test
     public void publicKeyDecodeAndEncodeWithByteBuffer() {
         Rsa key = new Rsa();