0

I'm currently building my web application with identity server 4. I dynamically create clients with a secret generated with Sha256() method of identityserver 4. However, i'm worrying that when i will renew or change my certificate all those secret will be invalidate which will pose a serious problem.

Are SHA256 linked with the certificat ? Or only Token will be invalidate?

Thanks!

Pilouk
  • 1,267
  • 1
  • 18
  • 36

1 Answers1

0

No, the signing credential used for token signing and validation has nothing to do with the hashing of secrets.

mackie
  • 4,996
  • 1
  • 17
  • 17