oxAuth has an internal timer that rotates its token signing and encryption keys every “keyRegenerationInterval” minutes. The expiry of the newly generated keys is set to the current time + “keyRegenerationInterval” + “idTokenLifetime”. However, whenever the server is rebooted **the timer resets**, meaning the regeneration won’t run again until “keyRegenerationInterval” minutes **after the time of reboot**. Unless the reboot occurs within ““idTokenLifetime” of the last regeneration, all of the keys will expire. The certificates provided in the “x5c” fiields, which have the NotAfter expiry date based on that value. Any RP that uses these certificates to obtain the keys, and then checks the expiry will fail and we have tested such failures with Microsoft OIDC clients.