I got my JWT generation working with X509 and wanted to ask if you would recommend any changes in respect to:

  • Signing certificate storing / handling.
  • Publishing for anonymous access public key

Background info on service:

  • Generating JWT with refresh token
  • Expiration set in DB
  • Certificate (*.cer) x509 is stored securely on Azure Blob
  • Certificate (*.pfx) x509 is stored securely on Azure Blob

Here is piece of code I'm using to generate JWT:

var cert = _azureBlobService.DownloadFile("container", "certname.pfx");

X509Certificate2 myCert = new X509Certificate2();
// Import from the byte array
myCert.Import(cert, "Password1", System.Security.Cryptography.X509Certificates.X509KeyStorageFlags.PersistKeySet);

var token = new JwtSecurityToken(myCert.SubjectName.Name, 
    audienceId, data.Identity.Claims, 
    new X509SigningCredentials(myCert));

var handler = new JwtSecurityTokenHandler();
var jwt = handler.WriteToken(token);

return jwt;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.