2

We currently only use reference tokens as access tokens. This has me wondering if we could just skip the entire certificate management hell by including a self-signed X509 certificate with a ridiculously long validity and store it with our source code (private github) - stop screaming, this might make sense soon.

The worst case I see would be that someone with access to the private key (i.e. any employee or force with access to our github repository) could issue any JWT and use that in the client (angular) - but that's client-side. The APIs are protected via IdentityServer Access Token Validation and all clients are configured to use reference tokens.

Another possible pitfall would be if we ever added a client that uses JWT for access tokens, but I don't really see that happening.

To me, using a long lived self-signed certificate under source-control seems to be the easiest and okay(-ish) solution for this case - unless I've overlooked something. We would never do that with SSL certificates or similar. I'm focussing only on the IdentityServer4 signing credential in combination with exclusive use of reference tokens.

Otherwise we'll have to somehow get certificate rollover (at runtime), certificate management etc. running. I guess we could implement ISigningCredentialStore to manage where the certificates are loaded from - but that still leaves us with the issue on how to handle certificates in a Docker swarm (or just plain Docker containers).

Am I missing something here? Would this solution have any flaws?

urbanhusky
  • 1,336
  • 13
  • 35

1 Answers1

1

Could you not just look it up?

like this 

var cert = new CertificateService().GetCertificate(appSettings.CertificateName, StoreName.TrustedPeople, StoreLocation.LocalMachine);

 services               
            .AddSigningCredential(cert);
monkeylumps
  • 747
  • 4
  • 10
  • 23
  • We're using docker swarm and didn't want to bake the certificate into the image so we didn't pursue the idea of using the certificate store. However, it seems that we could just mount the host's certificate stores (hosts are all Linux) https://stackoverflow.com/a/26181780/2114813 - so, yeah, that might work :) – urbanhusky Jan 29 '18 at 11:10