Use of AddSigningCredential(cert) in Identity Server 4

Question

I have set up an IdentityServer 4 application as per the following answer. The author has used X509Certificate2 in AddSigningCredential(cert). I used AddDeveloperSigningCredential() in development, which has created a tempkey.jwk file in my project folder.

I then tested this Identity Server 4 application with postman:

The above call results in the successful generation of Token. Now, I need to go into production. I have created an Azure App Service to host the Identity Server 4 application.

I have a very little understanding of Digital Certificates and Identity Server 4. I have gone through a few articles/answers but I am getting super confused. Just need to understand all of it in easy words.

My questions are:

• How can I create the X509Certificate2 certificate, as done here?
• How would the Client application be using this certificate?
• Where is it being used in development mode, as I am not providing any Public Key in the Postman call?

Answer 1

How can I create the X509Certificate2 certificate?

This answer might help here: https://stackoverflow.com/a/58136780/1658906.

How would the Client application be using this certificate?

It only uses the public key from the certificate if verifying the token. Your identity provider (your IdentityServer app) uses the certificate to digitally sign the tokens. An app that wishes to verify a token issued by the identity provider can use the public key from the certificate to verify the token is valid.

Apps usually get the public key from the discovery endpoint: https://identityserver4.readthedocs.io/en/latest/endpoints/discovery.html. Getting it from there instead of hard-coding the public key is best practice since it enables key rotation more easily.

The certificate's private key needs to be kept really secure. If someone has the certificate private key, they can create any token they want, and it'll be considered valid by the applications. Meaning they could impersonate any user or elevate their permissions etc.

Where is it being used in development mode, as I am not providing any Public Key in the Postman call?

Client apps do not use it when requesting a token. Only if you want to verify if a token is valid.