问题 We are testing our own OIDC-IDP with a commercial client. (We don't have access to the clients code.) After some tests, the client always returns OpenID Connect token validation failed: Token signature invalid (ID_TOKEN) The IDP is in the wild of the web, the client is in our own network with a SSL breaker in between. We have a test client, also in the WWW, which works fine. My question is, which certificate does the OIDC-client use to verify the signature. Is it the certificate of the