title: Securing the JWT with a X509Certificate2 (JwtSecurityTokenHandler)
body: <p>I managed to make the <code>JwtSecurityTokenHandler</code> work with <code>X509Certificate2</code>. I was able to sign the token with a <code>X509Certificate2</code> object. I was also able to validate the token by using the certificate's raw data through <code>X509Certificate2.RawData</code> property.</p>
  
  <p>Here is the code:</p>
  
  <pre><code>class Program
  {
      static void Main(string[] args)
      {
          X509Store store = new X509Store("My");
          store.Open(OpenFlags.ReadOnly);
          X509Certificate2 signingCert = store.Certificates[0];
  
          string token = CreateTokenWithX509SigningCredentials(signingCert);
          ClaimsPrincipal principal = ValidateTokenWithX509SecurityToken(
              new X509RawDataKeyIdentifierClause(signingCert.RawData), token);
      }
  
      static string CreateTokenWithX509SigningCredentials(X509Certificate2 signingCert)
      {
          var now = DateTime.UtcNow;
          var tokenHandler = new JwtSecurityTokenHandler();
          var tokenDescriptor = new SecurityTokenDescriptor
          {
              Subject = new ClaimsIdentity(new Claim[]
                      {
                          new Claim(ClaimTypes.Name, "Tugberk"),
                          new Claim(ClaimTypes.Role, "Sales"), 
                      }),
              TokenIssuerName = "self",
              AppliesToAddress = "http://www.example.com",
              Lifetime = new Lifetime(now, now.AddMinutes(2)),
              SigningCredentials = new X509SigningCredentials(signingCert)
          };
  
          SecurityToken token = tokenHandler.CreateToken(tokenDescriptor);
          string tokenString = tokenHandler.WriteToken(token);
  
          return tokenString;
      }
  
      static ClaimsPrincipal ValidateTokenWithX509SecurityToken(X509RawDataKeyIdentifierClause x509DataClause, string token)
      {
          var tokenHandler = new JwtSecurityTokenHandler();
          var x509SecurityToken = new X509SecurityToken(new X509Certificate2(x509DataClause.GetX509RawData()));
          var validationParameters = new TokenValidationParameters()
          {
              AllowedAudience = "http://www.example.com",
              SigningToken = x509SecurityToken,
              ValidIssuer = "self",
          };
  
          ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(
              new JwtSecurityToken(token), validationParameters);
  
          return claimsPrincipal;
      }
  }
  </code></pre>
  
  <p>My main question is all about what should I expose to the world from my <code>X509Certificate2</code>. Which part of the X509Certificate2 should I reveal so that <strong>the consumer should validate the JWT token</strong> but <strong>cannot create a new token using the same certificate</strong>?</p>