1

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my server's certificate? That way, anyone verifying the JWT can use the public key in my certificate.

(We can assume the private key meets the JWT recommendations in terms of keylength)

1 Answer 1

3

Generally, it is discouraged to re-use cryptographic secrets.

From a security perspective, your private key's exposure will probably increase, as the application signing the JWTs will need to have access to it. Depending on your setup this may or may not be the case. If the process terminating the TLS connection is a reverse proxy or a load balancer than this is extra exposure. You need to decide whether this is acceptable.

Engineering wise, you are creating a hidden dependency here. Certificates are renewed and the underlying keypair used may or may not change. If it does, all your previously signed JWTs will be "invalid" (given that the pub key is taken from the current certificate). Note that the "Web" does not rely on the fact that the key is the same in the renewed certificate.

I do not see anything seriously wrong with this idea but would recommend against it for the reasons stated above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .