How do you setup and retrieve encryption and signing certificates in IIS for OpenIddict?-CodePudding

I am new to OpenIddict and authorization in general. I am having trouble storing and retrieving the encryption and signing certificates that will be used by OpenIddict. I will be deploying this as a production-ready app to IIS.

I would like to know how I would go about storing the certificates in IIS and then retrieving them in my app startup? Here are the two methods I need to use in Startup.ConfigureServices:

options.AddEncryptionCertificate();
options.AddSigningCertificate();

I created both of these certificates manually using this code, then writing them to .pfx files.

I then used the certificate import wizard to import the certificates to my host computer that is running IIS. But right now I am confused on how to retrieve these certificates from IIS storage when calling options.Add_Certificate(). Right now I can retrieve the certificate directly from the project folder but this seems quite unsafe to have the certificates sitting in the folder.

Thank you

CodePudding user response：

You can use this code get list of certificate.

X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);

store.Open(OpenFlags.ReadOnly);

foreach (X509Certificate2 certificate in store.Certificates){
  //TODO's
 }

Then you can add certificate in the foreach.