Self-Signed Certificate for IdentityServer 4 Token Signing

Question

Does the certificate used for signing tokens in IdentityServer4 have to be from a trusted CA in production?

My admittedly limited understanding is that it doesn't. But I can't seem to find a definitive answer either way.

And the obvious follow-up is, should it be from a trusted CA?

Answer 1

OpenID Connect does not mandate the usage of X509 certificates at all - you could also use raw RSA or EC keys.

If you want to use X509 you can self-sign them. Most libraries only check if the public key in the discovery document can be used to validate the token.

Some libraries allow additional checks on the certificate - and some environments mandate such checks.

But generally speaking - CA issued certs are not necessary.