3 ms·
That's mostly only if you use them for HTTPS/SSL. There are many more uses for certificates, like signing payloads via JWS/Jose, CWS or CMS/PKCS7.
by selfmodruntime 2y ago
That's mostly only if you use them for HTTPS/SSL. There are many more uses for certificates, like signing payloads via JWS/Jose, CWS or CMS/PKCS7.
- candiddevmike 2y agoX.509 isn't used for JWTs?
- lmz 2y agoUnfortunately they are. https://datatracker.ietf.org/doc/html/rfc7517 https://datatracker.ietf.org/doc/html/rfc7517
- candiddevmike 2y agoJSON Web Keys include (optional) X.509-related properties but don't necessarily use X.509 for anything. X.509 isn't used in JWT signing or really with any part of a JWT.
- selfmodruntime 2y agoYou can deliver x5c certificates that need to have been signed by the same public key as the token signature.