Blazor - app.UseIdentityServer(); with .pfx key file - Unexpected character encountered while parsing number

Question

I have created a new Blazor WebAssembly App with Individual User Accounts, Store user accounts in-app and ASP.NET Core hosted in .NET 5. When deploying my app to Azure App Service I get the following error:

Object reference not set to an instance of an object.at Microsoft.Extensions.DependencyInjection.IdentityServerBuilderConfigurationExtensions

Reading these links I have to provide my own certificate in production for IdentityServer:

Blazor Web Assembly App .Net Core Hosted: publish runtime error

https://stackoverflow.com/a/56904000/3850405

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-5.0#example-deploy-to-azure-app-service

I then created a .pfx file like this and I have verified that it works and my password is correct.

https://stackoverflow.com/a/48790088/3850405

I then placed the .pfx file in my Server projects root folder and marked Copy to Output Directory as Copy Always.

I then updated appsettings.json to look like this:

  "IdentityServer": {
    "Clients": {
      "BlazorTest.Client": {
        "Profile": "IdentityServerSPA"
      }
    },
    "Key": {
      "Type": "File",
      "FilePath": "localhost.pfx",
      "Password": "MySercurePassword123?"
    }
  },

Now the project does not work neither locally or on Azure. It fails on app.UseIdentityServer(); in Startup.cs with the following error:

Newtonsoft.Json.JsonReaderException: 'Unexpected character encountered while parsing number: �. Path '', line 1, position 1.'

According to Microsoft docs my certificate should be valid:

A production certificate to use for signing tokens.

• There are no specific requirements for this certificate; it can be a self-signed certificate or a certificate provisioned through a CA authority.
• It can be generated through standard tools like PowerShell or OpenSSL.
• It can be installed into the certificate store on the target machines or deployed as a .pfx file with a strong password.

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-5.0#deploy-to-production

If I load the key like this it works:

"Key": {
  "Type": "Store",
  "StoreName": "My",
  "StoreLocation": "CurrentUser",
  "Name": "CN=blazortest"
}

Answer 1

I was able to fix this problem by removing the entry for IdentityServer in appsettings.Development.json.

Remove the following lines from appsettings.Development.json:

"IdentityServer": {
     "Key": {
       "Type": "Development"
     }
   } 

Answer 2

Try to upload the certificate into Azure App Service TLS/SSL Settings. Then change the Type into "Store", StoreName into "My", StoreLocation to "CurrentUser" and Name into "CN=".

Then restart the app service.

For my version, I created a self signed certificate with the help of these articles:

• step 1~6: New-SelfSignedCertificate.
• step 7~11: Deploy to App Service

Here is the complete step I did (there might be some faster way but this is the raw steps i did):

1. Open Powershell (as Admin)
2. execute the $cert = New-SelfSignedCertificate -Subject MyAppName. You can replace the MyAppName with your own, but you need to remember it until the end of the process
3. execute the command $cert | Format-List -Property * (not sure if this is needed)
4. I searched the generated certificate in Manage user certificates.
5. It turned out that I can't export it to file because it is not trusted so I moved it to the Trusted Root Certification > Certificates folder.
6. Then when I open the certificate, the Copy To File.. in Detail tab became available so I did. (I export the file as base64 Cer file)
7. I open the App Service Resource via Azure Portal.
8. Navigate to TLS/SSL Settings
9. Uploaded the .cer file in the Public Key Certificates (.cer) tab with the name MyAppName (same as what I put in the powershell command -Subject)
10. In the appsettings.json of your app, make sure that you have the following settings:

"IdentityServer": {
  "Key": {
    "Type": "Store",
    "StoreName": "My",
    "StoreLocation": "CurrentUser",
    "Name": "CN=MyAppName"
  }
}

11. Finally, I restarted the App Service.

Answer 3

For Blazor hosting with a generic provider, a development type key may still issue signing keys that change with every program restart.

A .PFX file is not an option for generic hosting because the identity server tries to persist the private key to Windows Store - not an option under shared hosting, as well as no option to directly place into Windows Store and retrieve from there.

If there is a database available, the key storage provider Microsoft.AspNetCore.DataProtection.EntityFrameworkCore is not difficult to implement. Follow the steps at Entity Framework Core Key Storage to integrate with the application.