identityserver-key-management

To manage signing keys across multi-instance deployments, configure automatic key management with a shared key storage backend. This ensures all load-balanced instances retrieve consistent key material for validation and data protection at rest.

Automatic key rotation periodically generates new cryptographic signing keys while retiring old ones. Configurable propagation times ensure all instances recognize new keys before activation, preventing validation failures during multi-instance synchronization.

Yes, you can migrate from static key configuration to automatic management using phased migration workflows. This approach supports adding static keys initially, then transitioning to automatic rotation intervals while maintaining consistent key validation.

Data protection at rest for signing keys is configured through your key storage backend settings. The system ensures cryptographic key material remains encrypted and protected when persisted, satisfying precise configuration needs for secure storage.

Static key configuration lacks automated rotation and retirement, requiring manual key distribution across multi-instance environments. This increases the risk of inconsistent key material and complicates secure migration to automated key management workflows.