如何使用X509证书在IdentityServer 4中签名令牌？

Question

I'm trying to use AddSigningCredential instead of AddDeveloperSigningCredential while moving it from dev to test.

1. I can generate a self signed X509 certificate using openssl and save it in Webroot folder and use it as an argument in AddSigningCredential. Is it an acceptable approach ?
2. I am using it on Linux and I'm not able to figure out how to get and use a CA signed certificate for token signing.

Answer 1

1. Yep, loading from a file deployed with your application is fine - just ensure that the private key is present and the application has the passphrase. On Windows it's preferable to use the certificate store and manage access to the private key from there.

2. You don't need the certificate to be signed by a CA - you just need a valid key pair.