How would I generate the Identity Server signing certificate

Question

In the identity server samples we find code like this in Startup.cs

var certFile = env.ApplicationBasePath + "\\idsrv3test.pfx";

var signingCertificate = new X509Certificate2(certFile, "idsrv3test");

How would I go about replacing this for production scenarios?

Answer 1

For the record, the code proposed in the image posted by RuSs:

options.SigningCertificate = LoadCertificate();

public X509Certificate2 LoadCertificate()
{
    string thumbPrint = "104A19DB7AEA7B438F553461D8155C65BBD6E2C0";
    // Starting with the .NET Framework 4.6, X509Store implements IDisposable.
    // On older .NET, store.Close should be called.
    using (var store = new X509Store(StoreName.My, StoreLocation.LocalMachine))
    {
        store.Open(OpenFlags.ReadOnly);
        var certCollection = store.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, validOnly: false);
        if (certCollection.Count == 0)
            throw new Exception("No certificate found containing the specified thumbprint.");

        return certCollection[0];
    }
}

Answer 2

Get a dedicated cert - either via your PKI or self-generate one:

http://brockallen.com/2015/06/01/makecert-and-creating-ssl-or-signing-certificates/

Import the key pair into the Windows certificate store, and load it from there at runtime.

To step up security, some people deploy the keys to a dedicated device (called an HSM) or to a dedicated machine (e.g. behind a firewall). The ITokenSigningService allows moving the actual token signing to that separate machine.