Original Answer

I think the problem could be that you are attempting to load a certificate in a Linux container using the Windows certificate store.

The documentation here gives a good overview regarding how you can use an app service private certificate in a Linux hosted app:

1. In the Azure portal, from the left menu, select App Services > <app-name>.
2. From the left navigation of your app, select TLS/SSL settings, then select Private Key Certificates (.pfx) or Public Key Certificates (.cer).
3. Find the certificate you want to use and copy the thumbprint.
4. To access a certificate in your app code, add its thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting.
5. The WEBSITE_LOAD_CERTIFICATES app setting makes the specified certificate accessible to your Linux hosted apps (including custom container apps) as files. The files are found under the following directories:
   • Private certificates - /var/ssl/private (.p12 files)
   • Public certificates - /var/ssl/certs (.der files)
6. Use the code sample below to load the specified certificate into your Linux hosted apps (including custom container apps):

   using System;
   using System.IO;
   using System.Security.Cryptography.X509Certificates;
   
   var bytes = File.ReadAllBytes($"/var/ssl/private/{Configuration["WEBSITE_LOAD_CERTIFICATES"]}.p12");
   var cert = new X509Certificate2(bytes);
   

Signing Credentials

Here are the steps that I used to generate signing credentials:

1. Install OpenSSL.
2. Generate private key and public certificate.
   1. Run openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout example.com.key -out example.com.crt -subj "/CN=example.com" -days 365 replacing example.com with name of the site.
3. Combine the above into a single PFX file.
   1. Run openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt replacing example.com with the name of the site.
4. Upload the PFX file to Azure.
   1. In the Azure portal, from the left menu, select App Services > <app-name>.
   2. From the left navigation of your app, select TLS/SSL settings, then select Private Key Certificates (.pfx), then upload the above PFX file.
5. Configure app settings.
   1. Add the thumbprint of the PFX file above to the WEBSITE_LOAD_CERTIFICATES app setting in the App Service.

IdentityServer

The below code sample shows a complete Startup.cs configuration which could be used to get an IdentityServer application up and running:

namespace IdentityServer
{
    public class Startup
    {
        public Startup(IConfiguration configuration, IWebHostEnvironment environment)
        {
            Configuration = configuration;
            Environment = environment;
        }

        public IConfiguration Configuration { get; }

        public IWebHostEnvironment Environment { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
        public void ConfigureServices(IServiceCollection services)
        {
            void ConfigureDbContext(DbContextOptionsBuilder builder)
            {
                builder.UseNpgsql(Configuration.GetConnectionString("DefaultConnection"));
            }

            var builder = services.AddIdentityServer()
                .AddConfigurationStore(options => { options.ConfigureDbContext = ConfigureDbContext; })
                .AddOperationalStore(options => { options.ConfigureDbContext = ConfigureDbContext; });

            if (Environment.IsDevelopment())
            {
                builder.AddDeveloperSigningCredential();
            }
            else
            {
                try
                {
                    var bytes = File.ReadAllBytes($"/var/ssl/private/{Configuration["WEBSITE_LOAD_CERTIFICATES"]}.p12");
                    var certificate = new X509Certificate2(bytes);
                    builder.AddSigningCredential(certificate);
                }
                catch (FileNotFoundException)
                {
                    throw new Exception($"The certificate with the thumbprint \"{Configuration["WEBSITE_LOAD_CERTIFICATES"].Substring(0, 8)}...\" could not be found.");
                }
            }
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment()) app.UseDeveloperExceptionPage();

            app.UseIdentityServer();
        }
    }
}

Clean Architecture

The below code sample shows a complete DependencyInjection.cs configuration which could be used to get a Clean Architecture application up and running:

namespace CleanArchitecture.Infrastructure
{
    public static class DependencyInjection
    {
        public static IServiceCollection AddInfrastructure(this IServiceCollection services, IConfiguration configuration)
        {
            void ConfigureDbContext(DbContextOptionsBuilder builder)
            {
                if (configuration.GetValue<bool>("UseInMemoryDatabase"))
                {
                    builder.UseInMemoryDatabase("CleanArchitectureDb");
                }
                else
                {
                    builder.UseSqlServer(configuration.GetConnectionString("DefaultConnection"), b => b.MigrationsAssembly(typeof(ApplicationDbContext).Assembly.FullName));
                }
            }

            services.AddDbContext<ApplicationDbContext>(ConfigureDbContext);

            services.AddScoped<IApplicationDbContext>(provider => provider.GetService<ApplicationDbContext>());

            services.AddScoped<IDomainEventService, DomainEventService>();

            services.AddDefaultIdentity<ApplicationUser>()
                .AddEntityFrameworkStores<ApplicationDbContext>();

            var builder = services.AddIdentityServer()
                .AddConfigurationStore(options => { options.ConfigureDbContext = ConfigureDbContext; })
                .AddOperationalStore(options => { options.ConfigureDbContext = ConfigureDbContext; })
                .AddAspNetIdentity<ApplicationUser>();

            var bytes = File.ReadAllBytes($"/var/ssl/private/{Configuration["WEBSITE_LOAD_CERTIFICATES"]}.p12");
            var certificate = new X509Certificate2(bytes);
            builder.AddSigningCredential(certificate);

            services.AddTransient<IDateTime, DateTimeService>();
            services.AddTransient<IIdentityService, IdentityService>();
            services.AddTransient<ICsvFileBuilder, CsvFileBuilder>();

            services.AddAuthentication()
                .AddIdentityServerJwt();

            return services;
        }
    }
}

I think the problem is that your application in the container does not trust the locally created developer certificate. Its something you can only use on your machine because a dev root certificate is installed on your computer.

The container will never trust the certificate created by dotnet dev-certs.

You need to get a properly trusted certificate, for example from LetsEncrypt.

I faced this issue running a .net core spa template on a linux app service. I also created a self signed .pfx as described in tnc1997's answer. Although the answer can be pieced together, for me the gotchas were:

• When referencing your certificate path, don't use the uploaded .pfx file name. Instead, as previously stated, your cert file gets a new name ".p12" and is (in linux container) found under "/var/ssl/private/".
• Specify a blank password. Don't specify the password for the uploaded .pfx file. Instead set appsetting "IdentityServer__Key__Password" to "" (empty).

The .Net Clean Architecture is calling services.AddIdentityServer() .AddApiAuthorization<ApplicationUser, ApplicationDbContext>(); in DependencyInjection.cs which is extension method. This method internally calls bunch of other methods one of which is .AddSigningCredentials(). Unfortunately this default method will fail in Linux environment because it cannot read bare private keys. According to this issue you need to construct PFX yourself in Linux.

Solution in my view:

1. Remove .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();
2. Write own method

var bytes = File.ReadAllBytes($"/var/ssl/private/{thump_print_goes_here}.p12");
var certificate = new X509Certificate2(bytes);
var builder = services.AddIdentityServer()
                .AddAspNetIdentity<ApplicationUser>()
                .AddOperationalStore<ApplicationDbContext>()
                .AddIdentityResources()
                .AddApiResources()
                .AddClients()
                .AddSigningCredential(certificate);

The solution provided in edit 2 works. I have tested and verified this with my .NET6 app in a Linux App Service on Azure.

My appsettings.Production.json looks like this:

{
    "IdentityServer": {
        "Key": {
            "Type": "File",
            "FilePath": "/var/ssl/private/{thumbprintGoesHere}.p12",
            "Password": ""
          }
    }
}

I have created my SSL certificate and SigningKey certificate in Azure Key Vaults as self-signed keys following this guide https://docs.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/hosted-with-identity-server?view=aspnetcore-5.0&tabs=visual-studio. I use the WEBSITE_LOAD_CERTIFICATES to load the certificates to the /var/ssl/private/ path.

I hope this helps someone struggling with the same issues.