我将如何生成Identity Server签名证书

Question

在身份服务器示例中,我们找到了这样的代码 Startup.cs

var certFile = env.ApplicationBasePath + "\\idsrv3test.pfx";

var signingCertificate = new X509Certificate2(certFile, "idsrv3test");

我如何在生产场景中更换它？

Answer 1

为了记录,RuSs发布的图像中提出的代码:

options.SigningCertificate = LoadCertificate();

public X509Certificate2 LoadCertificate()
{
    string thumbPrint = "104A19DB7AEA7B438F553461D8155C65BBD6E2C0";
    // Starting with the .NET Framework 4.6, X509Store implements IDisposable.
    // On older .NET, store.Close should be called.
    using (var store = new X509Store(StoreName.My, StoreLocation.LocalMachine))
    {
        store.Open(OpenFlags.ReadOnly);
        var certCollection = store.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, validOnly: false);
        if (certCollection.Count == 0)
            throw new Exception("No certificate found containing the specified thumbprint.");

        return certCollection[0];
    }
}

Answer 2

获得专用证书 - 通过您的PKI或自我生成证书:

http://brockallen.com/2015/06/01/makecert-and-creating-ssl-or-signing-certificates/

将密钥对导入Windows证书存储区,并在运行时从那里加载密钥对.

为了提高安全性,有些人将密钥部署到专用设备(称为HSM)或专用机器(例如防火墙后面).该ITokenSigningService可移动的实际令牌签名到单独的机器.

Answer 3

以下是我在配置中从指纹加载它的方法: 单击此处查看图像

Answer 4

最近我决定改进我的令牌签名发布流程.如果您运行的是Windows 10,则可以使用名为New-SelfSignedCertificate的awesome powershell cmdlet .

这是我的示例用法:

    New-SelfSignedCertificate -Type Custom
 -Subject "CN=TokenSigningForIdServer"
 -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3")
 -KeyUsage DigitalSignature
 -KeyAlgorithm RSA 
 -KeyLength 2048
 -CertStoreLocation "Cert:\LocalMachine\My"

确保以管理员身份运行该命令.您可以通过打开certlm.msc获取证书详细信息.它应存储在Personal\Certificates下面.

除了-TextExtention之外,大多数标志应该是显而易见的.它指定Enhaced Key Usage字段设置为"Code Signing"值.您可以参考以下文档页面来使用所使用的算法,密钥长度,甚至添加范围.