sign data and append certificate VS sign data and certificate
Assuming you're using standard PKI certificate standards rather than rolling your own approach there's not really a security benefit to including the certificate chain in the JWT that's covered by the signature.

Each (non-root) certificate is signed by the issuing certificate. So it's already covered by a signature that traces back to your root certificate. Signing it again within the JWT doesn't provide any additional protections.

I also can't see any particular security risk with including the certificate chain within the signed portion of the JWT. A signature exists to prove the authenticity of a known message. So has to be secure when the signed text is known. Including a known certificate chain does not therefore introduce any particular risks.

So really you need to drive this decision from other application design considerations.

Including the certificate chain in the JWT has one advantage I can see which is that you can parse the message using a standard library rather than having to pre-process it.

However in most scenarios that would be out-weighed significantly by the downsides of including the certitificate chain in the JWT which are:


You're signing a lot more content than you need to so are wasting a bit of CPU
You can't seperate the token from the certificate chain. That's likely to reduce the flexibility in the application design.


EOver time you may want to be able to just deal with the license in parts of the application where you know the certificate chain has already been processed, or allow it to be resolved dynamically. By keeping the certificate chain out of the signed JWT you can more easily split the two concerns apart to be dealt with by different parts of the application.

This wil also help if you wanted to move to encrypting the token in future rather than just signing it. By keeping the certificate chain seperate you can work with it before decrypting and checking the token which will make it easier to setup the validation routine.