I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my server's certificate? That way, anyone verifying the JWT can use the public key in my certificate.

(We can assume the private key meets the JWT recommendations in terms of keylength)


Generally, it is discouraged to re-use cryptographic secrets.

From a security perspective, your private key's exposure will probably increase, as the application signing the JWTs will need to have access to it. Depending on your setup this may or may not be the case. If the process terminating the TLS connection is a reverse proxy or a load balancer than this is extra exposure. You need to decide whether this is acceptable.

Engineering wise, you are creating a hidden dependency here. Certificates are renewed and the underlying keypair used may or may not change. If it does, all your previously signed JWTs will be "invalid" (given that the pub key is taken from the current certificate). Note that the "Web" does not rely on the fact that the key is the same in the renewed certificate.

I do not see anything seriously wrong with this idea but would recommend against it for the reasons stated above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.