Why are parameters for AddProductionEncryptionAndSigningCertificate() stored in code and not in settings?

[improwise]

Is there a reason why the parameters to the AddProductionEncryptionAndSigningCertificate() method are stored in code rather than in an appsettings.json etc?

            PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
            {
                serverBuilder.AddProductionEncryptionAndSigningCertificate("openiddict.pfx",
                    "XXXXXX");
                serverBuilder.SetIssuer(new Uri(configuration["AuthServer:Authority"]!));
            });

I know you can and should change this, but there must be a reason for name of cert and passphrase to be stored directly in the code and not in settings like most other stuff like AuthServer:Authority?

[improwise]

Ie something like this:

 PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
 {
     var certificatePath = configuration["OpenIddict:Certificate:Path"];
     var certificatePassword = configuration["OpenIddict:Certificate:Password"];
     serverBuilder.AddProductionEncryptionAndSigningCertificate(certificatePath, certificatePassword);
     serverBuilder.SetIssuer(new Uri(configuration["AuthServer:Authority"]!));
 });

and then in appsettings

  "OpenIddict": {
    "Certificate": {
      "Path": "openiddict.pfx",
      "Password": "XXXXXXXX"
    }
  },

There are of course much better ways to solve this than either of these solutions for production environments.

[maliming]

No particular reason. We should move to apsettings.json file.