Skip to Content
IdentityServer

Open.IdentityServer is a free and open-source OIDC framework for .NET that developers can use to create an authorisation server. Rock Solid Knowledge released it on 2nd June 2026 to revive the IdentityServer4 offering. Rock Solid Knowledge’s Key Rotation v3.0.0 adds support for Open.IdentityServer.

Why Key Rotation Is Essential

Open.IdentityServer requires an asymmetric key pair (public and private key) for signing and validating JWTs. The private key signs the JWT, and Open.IdentityServer publishes the public key so clients can verify signed JWTs. If an attacker could create their own tokens, they could gain unauthorised access. To do this, they would need access to the private key.

Therefore, securing the key is very important; an attacker could derive it if they observe enough signed tokens and have sufficient time to perform the necessary computations. 

To mitigate this risk, it's considered best practice to change keys every 60–90 days. Performing this task manually is

  • Time-consuming
  • Requires configuration changes and server restarts

Or a custom implementation to retrieve key material from signing and validation stores. A more practical solution is for the OIDC authorization server to rotate the keys automatically. This prevents teams from using keys indefinitely, gives attackers less time to observe signed material, mitigates the risk of key derivation, and allows teams to revoke keys more easily.

Out of the box, Open.IdentityServer does not offer automatic key rotation. You can configure signing and validation keys in Open.IdentityServer in one of two ways: by using extension methods on the IIdentityServerBuilder or by registering your own implementations of the signing and validation key store.

Rock Solid Knowledge has updated its Key Rotation component  to support Open.IdentityServer as well. Adding automatic key rotation to Open.IdentityServer is as simple as adding the Rsk.KeyRotation.OpenIdentityServer and Rsk.KeyRotation.EntityFrameworkCore NuGet packages to your .NET Core Open.IdentityServer project, then calling the extension on the IIdentityServerBuilder to configure the functionality.

How to Use

Using Key Rotation for Open.IdentityServer is simple, and we will guide you through a basic installation. Currently, RSK Key Rotation only supports Entity Framework Core databases for key storage, so the following steps configure it to use a database.

If you already have an Open.IdentityServer instance, you can follow these steps to add Key Rotation. Alternatively, you can use our sample and follow these steps to set up an instance with key rotation.

Install the NuGet Packages
dotnet add package Rsk.KeyRotation.OpenIdentityServerdotnet add package Rsk.KeyRotation.EntityFrameworkCore

Call the AddRskKeyRotation extension method on IIdentityServerBuilder

services.AddIdentityServer()
 .AddRskKeyRotation(krBuilder =>
 {
     krBuilder.UseEntityFrameworkCore()
              .AddKeyRotationDbContext(opt =>
                {
                    opt.UseSqlServer
                    ("KeyRotationDbConnectionStr",
                     c => c.MigrationsAssembly("Samples.KeyRotationWithEntityFramework"));
                });
              .krBuilder.AddLicense(“DEMO”, “***License Key***”);
 });


Generate Database Tables

dotnet ef migrations add Initial_KeyRotationDataBase --context KeyRotationDbContext
dotnet ef database update

Remove Any Static Signing Keys or Certificates

Key Rotation registers a signing key store implementation that fetches the current signing key for Open.IdentityServer. This does not affect any existing stores. To ensure Open.IdentityServer uses the rotated signing key for signing, remove any other signing key store registrations where possible. Alternatively, register any other signing keys after Key Rotation so the rotated key remains available first.

When removing or reorganising signing key registrations, look out for the following calls:

  • AddSigningCredential
  • AddDeveloperSigningCredential

If you used our sample as a starting point, it adds a development certificate. To remove this certificate from the configured signing credentials, remove the following line from Startup.cs

builder.AddDeveloperSigningCredential();

Start Open.IdentityServer

Now, when you start Open.IdentityServer, you should see an initial key rotation that generates the first signing key.

By default, RSK Key Rotation generates an RSA key with a 90-day lifespan. Seven days before a new key needs to sign tokens, RSK Key Rotation generates a new key. When a key expires, RSK Key Rotation stops using it for signing but keeps it in the discovery document for 7 days. You can configure both the publish time and retirement time independently.

You can read about all the configuration options in the Key Rotation documentation.

Take a look at a sample Open.IdentityServer solution encorporating Key Rotation

Sample Code

James Britton He/Him

Job Role
Software Engineer
Company
Rock Solid Knowledge