Skip to content

Identity Signing Keys

IdentityServer requires signing and validation keys in order to sign and validate tokens.

The Suite Identity Service supports loading a PEM certificate for providing these keys in production, ideally through a kubernetes secret as current implemented in deployments

Generating the x509 certificate

Bash
1
2
3
4
5
# Generate the public key
openssl genrsa -out signing-key.priv.pem 1024

# Generate the private key
openssl req -new -x509 -key signing-key.priv.pem -out signing-key.pub.pem

Identity Signing Key Configuration

To configure the Identity Service to use a PEM Certificate public and private key we can use the SuiteIdentityOptions.SigningCredentialsPublicKeyPath and SuiteIdentityOptions.SigningCredentialsPrivateKeyPath.