带证书的IdentityServer4 AddSigningCredentials

Question

I have an SSL certificate installed on my domain and I wanted to use it for signing with IdentityServer 4. Now I found that there is a method which would let me do that:

services.AddIdentityServer().AddSigningCredentials(certificate);

However, I cannot figure out how to actually get my certificate and pass it to the identity server.

I have tried the following:

var cert = X509Certificate.CreateFromCertFile(fileName);
services.AddIdentityServer().AddSigningCredentials(certificate);

The error that I get is it cannot convert from

'System.Security.Cryptography.X509Certificates.X509Certificate' to 'Microsoft.IdentityModel.Tokens.SIgningCredential'

Now I don't understand why it is complaining about signing credentials when one of the overrides for the method is the certificate.

Answer 1

Maybe it can't convert due to issue in permissions or loading the certificate as a stream.

In my case using IdentityServer3 the below code works:

    /// <summary>
    /// Load the certificate that sign the Id or Jw token
    /// </summary>
    /// <returns></returns>
    private static X509Certificate2 LoadCertificate()
    {
        string baseDirectory = AppDomain.CurrentDomain.BaseDirectory;
        return new X509Certificate2(
        Path.Combine(AppDomain.CurrentDomain.BaseDirectory, ConfigMngr.GetAppSettingsValue<string>("IdSrv:SigningCertificatePath")), ConfigMngr.GetAppSettingsValue<string>("IdSrv:SigningCertificatePassword"));
    }

Then in owin's startup file, I am passing it as below:

  SigningCertificate = LoadCertificate(),

I know in Idsrv4 it's a different implementation than the code I posted but it should be the same abstraction, for example, you loading X509Certificate but it's deprecated so make sure to use the correct overloading to load the certificate as stream and make sure to return the correct type.

Also, This code is testable with IdSrv4:

var fileName = Path.Combine(env.WebRootPath, "FileName" );            

    if (!File.Exists(fileName))
    {
        throw new FileNotFoundException("No Signing Certificate!");
    }

    var cert = new X509Certificate2(fileName, "Pass" );

    services.AddIdentityServer().AddSigningCredential(cert)

So instead of using

X509Certificate.CreateFromCertFile(fileName);

You can construct a new X509Certificate2 certificate like this:

var cert = new X509Certificate2(fileName, "Pass" );

And pass it to the owin middleware:

services.AddIdentityServer().AddSigningCredential(cert)

Answer 2

I ended up resolving it like this. I'm using a shared server where I am hosting this and I could not find the file name for the certificate or the path to get it. So I ended up just opening the store and finding it that way. Not very efficient, but it will do the trick until I move it to a dedicated server and have more control.

X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
X509Certificate2 cert = null;

foreach (X509Certificate2 certificate in store.Certificates)
{
    if (!string.IsNullOrWhiteSpace(certificate?.SubjectName?.Name) && certificate.SubjectName.Name.StartsWith("CN=*.mysite.com"))
    {
        cert = certificate;
        break;
    }
}