I have an SSL Certificate used for my website, can I use the same cert for signing tokens?

[anilchinnu21]

Question / Issue

I have an SSL Certificate used for my website, can I use the same cert for signing tokens?

[lukos]

You technically can but consider that it is probably slightly less secure than it would be in IIS (or at least not tested as much). It would make more sense to buy a basic cheap certificate and use that. If it is stolen or suspected stolen, you can easily update the JWT key list and you don't have to update your web site etc.

[brockallen]

You can use a self-signed cert for the token signing (and it should be different from the SSL cert).

https://brockallen.com/2015/06/01/makecert-and-creating-ssl-or-signing-certificates/