Skip to Content
IdentityServer

Duende IdentityServer is a commercial OIDC framework for .NET that developers can use to create an authorisation server. Rock Solid Knowledge’s Key Rotation v3.0.0 adds support for all pricing tiers of Duende IdentityServer.

Why Key Rotation Is Essential

Duende IdentityServer requires an asymmetric key pair (public and private key) to sign and validate JWTs. The private key signs the JWT, and Duende IdentityServer publishes the public key so clients can verify signed JWTs. If an attacker could create their own tokens, they could gain unauthorised access. To do this, they would need access to the private key.

Therefore, securing the key is very important; an attacker could derive it if they observe enough signed tokens and have sufficient time to perform the necessary computations. 

To mitigate this risk, it's considered best practice to change keys every 60–90 days. Performing this task manually is

  • Time-consuming
  • Requires configuration changes and server restarts

Or a custom implementation to retrieve key material from signing and validation stores. A more practical solution is for the OIDC authorization server to rotate the keys automatically. This prevents teams from using keys indefinitely, gives attackers less time to observe signed material, mitigates the risk of key derivation, and allows teams to revoke keys more easily.

Out of the box, Duende IdentityServer V8 Advanced includes built-in key management. However, if you are running

  • Standard version you will need to pay for it, or
  • Lite there is no offering from Duende

Rock Solid Knowledge has updated its Key Rotation component to support Duende IdentityServer. Adding automatic key rotation to Duende IdentityServer is as simple as adding the Rsk.KeyRotation.DuendeIdentityServer and Rsk.KeyRotation.EntityFrameworkCore NuGet packages to your .NET Core Duende IdentityServer project, then call the extension on the IIdentityServerBuilder to configure the functionality.

How to Use

Using Key Rotation for Duende IdentityServer is simple, and we will guide you through a basic installation. Currently, RSK Key Rotation only supports Entity Framework Core databases for key storage, so the following steps configure it to use a database.

If you already have a Duende IdentityServer instance, you can follow these steps to add Key Rotation.

Install the NuGet Packages


dotnet add package Rsk.KeyRotation.DuendeIdentityServerdotnet add package Rsk.KeyRotation.EntityFrameworkCore

Call the AddRskKeyRotation extension method on IIdentityServerBuilder

services.AddIdentityServer()
 .AddRskKeyRotation(krBuilder =>
 {
     krBuilder.UseEntityFrameworkCore()
              .AddKeyRotationDbContext(opt =>
                {
                    opt.UseSqlServer
                    ("KeyRotationDbConnectionStr",
                     c => c.MigrationsAssembly("Samples.KeyRotationWithEntityFramework"));
                });
              .krBuilder.AddLicense(“DEMO”, “***License Key***”);
 });


Generate Database Tables

dotnet ef migrations add Initial_KeyRotationDataBase --context KeyRotationDbContext
dotnet ef database update

Remove Any Static Signing Keys or Certificates

Key Rotation registers a signing key store implementation that fetches the current signing key for Duende IdentityServer. This does not affect any existing stores. To ensure Duende IdentityServer uses the rotated signing key for signing, remove any other signing key store registrations where possible. Alternatively, register any other signing keys after Key Rotation so the rotated key remains available first.

When removing or reorganising signing key registrations, look out for the following calls:

  • AddSigningCredential
  • AddDeveloperSigningCredential

If you used our sample as a starting point, it adds a development certificate. To remove this certificate from the configured signing credentials, remove the following line from Startup.cs

builder.AddDeveloperSigningCredential();

Migrating from Duende Key Management


If you’re coming from Duende IdentityServer’s built-in Key Management and have registered the read-only compatibility store, you have several options.

1.        Register RSK Key Rotation and remove the call to register the compatibility key store.

This option suits teams that want to switch to the new rotation immediately and invalidate all existing issued tokens.

2.        Register RSK Key Rotation and register the compatibility store after RSK Key Rotation.

This option suits teams that want the RSK Key Rotation setup while still allowing existing token validation. Remove the compatibility store once enough time has passed for old tokens to fall out of use. A sensible time frame might be the retention period set with Duende Key Management; by default, this is 14 days.

builder.Services.AddIdentityServer()
    .AddRskKeyRotation(krBuilder =>
    {
        krBuilder.UseEntityFrameworkCore()
            .AddKeyRotationDbContext(opt =>
            {
                opt.UseSqlServer(
                "KeyRotationDbConnectionStr",
                c => c.MigrationsAssembly("Samples.KeyRotationWithEntityFramework"));
            });

	   krBuilder.AddLicense(“DEMO”, “***License Key***”);

    })
    .AddCompatibilityKeyStores();

Start Duende IdentityServer

Now, when you start Duende IdentityServer, you should see an initial key rotation that generates the first signing key.

By default, RSK Key Rotation generates an RSA key with a 90-day lifespan. Seven days before a new key needs to sign tokens, RSK Key Rotation generates it. When a key expires, RSK Key Rotation stops using it for signing but keeps it in the discovery document for 7 days. You can configure both the publish time and retirement time independently.

You can read about all the configuration options in the Key Rotation documentation.

Take a look at a sample Open.IdentityServer solution encorporating Key Rotation

Sample Code

To Consider

If you are an existing Duende customer and are interested in considering a free alternative, the Key Rotation component also works with Open.IdentityServer

Last updated: 22 July 2026

James Britton He/Him

Job Role
Software Engineer
Company
Rock Solid Knowledge