Using an Identity Server signing certificate in Azure

Question

In the IdentityServer sample code (startup.cs), we can see how to use a certificate:

var certFile = env.ApplicationBasePath + "\\idsrv3test.pfx";

var signingCertificate = new X509Certificate2(certFile, "idsrv3test");

How do I do this in a production environment, if I am deploying my STS to Azure as a Web App Service?

For security, I know I cannot add the pfx file to the solution.

Answer 1

Upload certificate to the portal:

https://docs.microsoft.com/en-us/azure/app-service-web/web-sites-configure-ssl-certificate#step-2-upload-and-bind-the-custom-ssl-certificate

Now you can get certificate by:

        var certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
        certStore.Open(OpenFlags.ReadOnly);

        var certCollection = certStore.Certificates.Find(
            X509FindType.FindByThumbprint, certificateThumbprint, false);
        var signingCertificate = certCollection[0];

        certStore.Close();