c# - 如何使用来自pfx文件的证书对JWT令牌进行签名/取消签名？

Question

I'm using asp.net core and I want to sent (POST) a JWT token that is signed using a private key from a .pfx. file. The receiver side must be able to validate the token using the public key from the .pfx file.

How do I do that?

Answer 1

Found the solution:

        string certPath = @"xxxx";
        string certPass = "xxxx";
        var collection = new X509Certificate2Collection();
        collection.Import(certPath, certPass, X509KeyStorageFlags.PersistKeySet);

        var certificate = collection[0];

        // create the token signed with privaet key
        // 1. create private security key to create the token
        var rsaPrivateKey = certificate.GetRSAPrivateKey();
        var privateSecurityKey = new RsaSecurityKey(rsaPrivateKey);

        var descriptor = new SecurityTokenDescriptor
        {
            Issuer = "me",
            Audience = "you",
            IssuedAt = DateTime.UtcNow,
            NotBefore = DateTime.UtcNow,
            Expires = DateTime.UtcNow.AddMinutes(5),
            Subject = new ClaimsIdentity(new List<Claim> { new Claim("sub", "scott") }),
            SigningCredentials = new SigningCredentials(privateSecurityKey, SecurityAlgorithms.RsaSha256Signature)
        };

        var handler = new JsonWebTokenHandler();

        // 2. create the token
        string jwt = handler.CreateToken(descriptor);


        // validate token using public key
        var rsaPublicKey = certificate.GetRSAPublicKey();
        var publicSecurityKey = new RsaSecurityKey(rsaPublicKey);

        var result = handler.ValidateToken(jwt,
            new TokenValidationParameters
            {
                ValidIssuer = "me",
                ValidAudience = "you",
                IssuerSigningKey = publicSecurityKey
            });

        Assert.True(result.IsValid);