<p>I need to load a signing certificate for IdentityServer4 in the Startup() class of an asp.net core application.  </p>

<p>I'm deploying as a docker container to an existing Kubernetes cluster on GKE.</p>

<p>I'm unsure of the best way to generate (<code>cert-manager?</code>), store and access the certificate via the IdentityServer asp.net startup class.</p>

<p>If I can figure out the basics I can then learn how to deploy and rotate/expire the keys.</p>

Richard Holland
<p>You can do this several ways I think. Personally, I chose to store this credential in a <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secret</a>. I'm using a .pfx file, which I did not generate, so you'll have to sort that part out.</p>
<p>Once you have generated the certificate and loaded it into a secret using:</p>
<p><code>kubectl create secret generic &lt;secret name&gt; --from-file=&lt;path to file&gt;</code></p>
<p>In your deployment.yaml configure a volume for your container:</p>
<pre><code>spec:
  volumes:
  - name: secrets-volume
    secret:
      secretName: &lt;secret name&gt;
  containers:
    volumeMounts:
    - name: secrets-volume
      mountPath: app/secrets
      readOnly: true
</code></pre>
<p>Lastly, in your Startup.cs you can add something similar to this:</p>
<pre><code>X509Certificate2 rsaCertificate = null;
try
{
     rsaCertificate = new X509Certificate2(
          Path.Combine(Environment.ContentRootPath, &quot;secrets/certificate.pfx&quot;),
          &quot;password!123&quot;
          );
}
catch (System.Exception)
{
    // logs
}

if (Environment.IsDevelopment())
{
    builder.AddDeveloperSigningCredential();
}
else
{
    if (rsaCertificate == null)
    {
         throw new System.Exception(&quot;Signing Credential not found&quot;);
    }

    builder.AddSigningCredential(rsaCertificate);
}
</code></pre>
