WordPress SSO using Azure B2C as IDP

On Windows, use the New-SelfSignedCertificate cmdlet in PowerShell to generate a certificate.

• • Run the following PowerShell command to generate a self-signed certificate. Modify the -Subject argument as appropriate for your application and Azure AD B2C tenant name such as contosowebapp.contoso.onmicrosoft.com;
  • Copy;

				
					New-SelfSignedCertificate `
   -KeyExportPolicy Exportable `
   -Subject "CN=yourappname.yourtenant.onmicrosoft.com" `
   -KeyAlgorithm RSA `
   -KeyLength 2048 `
   -KeyUsage DigitalSignature `
   -NotAfter (Get-Date).AddMonths(12) `
   -CertStoreLocation "Cert:\CurrentUser\My"

				
			

• • On Windows computer, search for and select Manage user certificates;
  • Under Certificates – Current User, select Personal > Certificates>yourappname.yourtenant.onmicrosoft.com;
  • Select the certificate, and then select Action > All Tasks > Export;
  • Select Next > Yes, export the private key > Next;
  • Accept the defaults for Export File Format, and then select Next;
  • Enable Password option, enter a password for the certificate, and then select Next;
  • To specify a location to save your certificate, select Browse and navigate to a directory of your choice;
  • On the Save As window, enter a File name, and then select Save;
  • Select Next>Finish;
  • For Azure AD B2C to accept the .pfx file password, the password must be encrypted with the TripleDES-SHA1 option in the Windows Certificate Store Export utility, as opposed to AES256-SHA256;

On macOS, use Certificate Assistant in Keychain Access to generate a certificate;

1. Follow the instructions for how to create self-signed certificates in Keychain Access on a Mac;
2. In the Keychain Access app on your Mac, select the certificate that you created;
3. Select File > Export Items;
4. Select a file name to save your certificate. For example: self-signed-certificate.p12;
5. For File Format, select Personal Information Exchange (.p12);
6. Select Save;
7. Enter a password in the Password and Verify boxes;
8. Replace the file extension to .pfx. For example: self-signed-certificate.pfx;

• You can use OpenSSL to create self-signed certificates. This example will use WSL / Ubuntu and a bash shell with OpenSSL;
• This will generate a .crt and a .key. Change yourtenant on PARENT command to your tenant. For example PARENT=”testb2c.onmicrosoft.com”;
• Copy;

				
					PARENT="yourtenant.com"
openssl req \
-x509 \
-newkey rsa:4096 \
-sha256 \
-days 365 \
-nodes \
-keyout $PARENT.key \
-out $PARENT.crt \
-subj "/CN=${PARENT}" \
-extensions v3_ca \
-extensions v3_req \
-config <( \
  echo '[req]'; \
  echo 'default_bits= 4096'; \
  echo 'distinguished_name=req'; \
  echo 'x509_extension = v3_ca'; \
  echo 'req_extensions = v3_req'; \
  echo '[v3_req]'; \
  echo 'basicConstraints = CA:FALSE'; \
  echo 'keyUsage = nonRepudiation, digitalSignature, keyEncipherment'; \
  echo 'subjectAltName = @alt_names'; \
  echo '[ alt_names ]'; \
  echo "DNS.1 = www.${PARENT}"; \
  echo "DNS.2 = ${PARENT}"; \
  echo '[ v3_ca ]'; \
  echo 'subjectKeyIdentifier=hash'; \
  echo 'authorityKeyIdentifier=keyid:always,issuer'; \
  echo 'basicConstraints = critical, CA:TRUE, pathlen:0'; \
  echo 'keyUsage = critical, cRLSign, keyCertSign'; \
  echo 'extendedKeyUsage = serverAuth, clientAuth')

				
			

• Use following command to create .pfx file;
• Openssl and paste: pkcs12 -export -out $PARENT.pfx -inkey $PARENT.key -in $PARENT.crt;