Linux上ASP.NET 6 ReactJS应用遇IDX10634错误：无法创建签名提供器

方案1：确保RS256算法在Linux环境可用 #

RS256依赖RSA加密体系，Linux环境下需先确认系统加密库支持，再在代码中明确配置：

系统层面依赖安装 #

在CentOS中执行以下命令安装必要加密库：

yum install openssl libssl-devel -y

Program.cs代码修改 #

配置认证服务时，显式指定RS256签名提供者：

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new X509SecurityKey(new X509Certificate2("path/to/your/cert.pfx", "cert-password")),
            ValidAlgorithms = new[] { SecurityAlgorithms.RsaSha256 }
        };

        // 手动绑定RS256签名提供者，适配Linux环境
        options.SecurityTokenValidators.Clear();
        options.SecurityTokenValidators.Add(new JwtSecurityTokenHandler
        {
            SignatureProviderFactory = new SignatureProviderFactory()
            {
                CreateProvider = (securityKey, algorithm) =>
                {
                    if (algorithm == SecurityAlgorithms.RsaSha256 && securityKey is X509SecurityKey x509Key)
                    {
                        return new RsaSignatureProvider(x509Key, SecurityAlgorithms.RsaSha256);
                    }
                    return null;
                }
            }
        });
    });

方案2：切换到ECDSA算法（ES256） #

若RS256仍存在兼容问题，可切换到Linux支持更友好的ES256椭圆曲线算法：

步骤1：生成ECDSA证书 #

用OpenSSL生成ECDSA格式证书：

# 生成私钥
openssl ecparam -name prime256v1 -genkey -noout -out ec-private.key
# 生成证书签名请求
openssl req -new -key ec-private.key -out ec-cert.csr
# 生成证书
openssl x509 -req -days 365 -in ec-cert.csr -signkey ec-private.key -out ec-cert.crt
# 打包成PFX格式（代码中直接使用）
openssl pkcs12 -export -out ec-cert.pfx -inkey ec-private.key -in ec-cert.crt

步骤2：修改Program.cs认证配置 #

替换签名算法为ES256：

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new X509SecurityKey(new X509Certificate2("path/to/ec-cert.pfx", "cert-password")),
            ValidAlgorithms = new[] { SecurityAlgorithms.EcdsaSha256 }
        };
    });

步骤3：同步更新JWT生成逻辑 #

如果是自行生成JWT，需修改签名凭据算法：

var tokenHandler = new JwtSecurityTokenHandler();
var key = new X509SecurityKey(new X509Certificate2("path/to/ec-cert.pfx", "cert-password"));
var tokenDescriptor = new SecurityTokenDescriptor
{
    Subject = new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, username) }),
    Expires = DateTime.UtcNow.AddDays(7),
    Issuer = builder.Configuration["Jwt:Issuer"],
    Audience = builder.Configuration["Jwt:Audience"],
    SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.EcdsaSha256)
};
var token = tokenHandler.CreateToken(tokenDescriptor);
var tokenString = tokenHandler.WriteToken(token);

额外注意事项 #

• 确保证书文件路径在Linux环境下正确，且应用程序有权限读取（可设置文件权限为chmod 644，并归属运行应用的用户组）
• 检查项目中Microsoft.IdentityModel.Tokens包版本，建议使用最新稳定版

内容的提问来源于stack exchange，提问作者user3105469