I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6):

public AccessTokenResult CreateAccessToken(
             IAccessTokenRequest accessTokenRequestMessage)
    var token = new AuthorizationServerAccessToken();
    token.Lifetime = TimeSpan.FromMinutes(10);

    var signCert = LoadCert(Config.STS_CERT);
    token.AccessTokenSigningKey = 
             (RSACryptoServiceProvider) signCert.PrivateKey;

    var encryptCert = LoadCert(Config.SERVICE_CERT);
    token.ResourceServerEncryptionKey = 
             (RSACryptoServiceProvider) encryptCert.PublicKey.Key;

    var result = new AccessTokenResult(token);
    return result;


STS_CERT is created for signatures by the authorization server

SERVICE_CERT is designed for decoding the resource server

Why different certificates are used? Is it secure to use only one instead of both STS_CERT and SERVICE_CERT certificates?

  • Based on your code the STS is cert+private key (so you can sign with it) but the SERVICE is "just" public certificate, so you do not have its private key. – csikos.balint Mar 14 '17 at 6:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.