4 ms·
X509 certs are more or less interoperable as seen everyday on the Internet where your HTTPS sites mostly work. Keys are another matter (and a private one at tha
by lmz 2y ago
X509 certs are more or less interoperable as seen everyday on the Internet where your HTTPS sites mostly work. Keys are another matter (and a private one at that).
- selfmodruntime 2y agoThat's mostly only if you use them for HTTPS/SSL. There are many more uses for certificates, like signing payloads via JWS/Jose, CWS or CMS/PKCS7.
- candiddevmike 2y agoX.509 isn't used for JWTs?
- lmz 2y agoUnfortunately they are. https://datatracker.ietf.org/doc/html/rfc7517 https://datatracker.ietf.org/doc/html/rfc7517
- candiddevmike 2y agoJSON Web Keys include (optional) X.509-related properties but don't necessarily use X.509 for anything. X.509 isn't used in JWT signing or really with any part of a JWT.
- selfmodruntime 2y agoYou can deliver x5c certificates that need to have been signed by the same public key as the token signature.
- michaelt 2y agoThat's because some people came along and produced a parallel standard [1] adding loads more rules, clarifications and constraints to convert X509 into something approximately fit for purpose. [1] https://github.com/cabforum/servercert https://github.com/cabforum/servercert