IdentityServer4: How to Download Signature Credentials from the Cert Store in the Docker App

Question

We have an IdentityServer4-based STS that successfully runs on Windows, where the signature account was installed on the local computer with .pfx under Personal> Certificates and .cer under Trusted People> Certificates. Then we can load the Signing Credential using its common name as follows:

services.AddIdentityServer() .AddSigningCredential("CN=CERT_NAME") ... 

Now we want to run our STS implementation in the Docker container and are executed with the following exception:

 Unhandled Exception: System.PlatformNotSupportedException: Unix LocalMachine X509Store is limited to the Root and CertificateAuthority stores. at Internal.Cryptography.Pal.StorePal.FromSystemStore(String storeName, StoreLocation storeLocation, OpenFlags openFlags) at System.Security.Cryptography.X509Certificates.X509Store.Open(OpenFlags flags) at IdentityModel.X509CertificatesFinder.Find(Object findValue, Boolean validOnly) at Microsoft.Extensions.DependencyInjection.IdentityServerBuilderExtensionsCrypto.AddSigningCredential(IIdentityServerBuilder builder, String name, StoreLocation location, NameType nameType) 

Based on the above error message and the source for the AddSigningCredential method we use here: https://github.com/IdentityServer/IdentityServer4/blob/ec17672d27f9bed42f9110d73755170ee9265116/src/IdentityServer4/Configuration/xtenction it seems obvious that our problem is that IdentityServer4 is looking for a certificate on the local Personal computer ("My"), however such a store is not available in Unix environments according to the error message.

So, I'm curious to know if there is any practice to load Signing Credential for IdentityServer4 in Docker containers if it is not possible to load it by name or fingerprint. Will the only option be to associate a certificate with our application and then upload it by file name?

Thanks for any help you can offer!

Answer 1

I am developing on a Windows machine and use the following code to get the certificate from the store

 X509Certificate2 cert = null; X509Store certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser); certStore.Open(OpenFlags.ReadOnly); X509Certificate2Collection certCollection = certStore.Certificates.Find( X509FindType.FindByThumbprint, "‎thumbprint", false); if (certCollection.Count > 0) { cert = certCollection[0]; Log.Logger.Information($"Successfully loaded cert from registry: {cert.Thumbprint}"); } if (cert == null) // Fallback { cert = new X509Certificate2(Path.Combine(_env.ContentRootPath, "certificate.pfx"), "password"); //Log.Logger.Information($"Falling back to cert from file. Successfully loaded: {cert.Thumbprint}"); } else { certStore.Dispose(); } 

Answer 2

When you use Docker containers and IdentityServer, you have two options:

• Add the certificate to the container image ( COPY certificate.pfx. )
• Mount the certificate in a container ( -v/path/to/certificate.pfx: /certificate.pfx )

Whichever option you choose, the only thing you need is to add the following ConfigureServices code to ConfigureServices during Startup

 var identityServerBuilder = services.AddIdentityServer(); /* store configuration and etc. is omitted */ if (_hostingEnvironment.IsDevelopment()) { identityServerBuilder.AddDeveloperSigningCredential(); } else { var certificate = new X509Certificate2("certificate.pfx", "certificate_password"); identityServerBuilder.AddSigningCredential(certificate); } 

It would also be nice to read the certificate password from a configuration, environment variable or secret store.