apim-validate-jwt-certificate.xml

<!-- Assumption is that the certificate (rsa-cert.pfx), containing issuer's keys has already been uploaded to API Management -->

<validate-jwt header-name="Authorization">
  <issuer-signing-keys>
    <key certificate-id="rsa-cert" />
  </issuer-signing-keys>
</validate-jwt>

thanks for your article: https://platform.deloitte.com.au/articles/validating-rsa-jwt-tokens-with-azure-api-management

hi I am using this command generate key for jwt singing.
#ssh-keygen -t rsa -b 4096 -m PEM -f jwt

#openssl rsa -in jwt -pubout -outform PEM -out jwt.pub
May I ask how to convert to pfx for apim?

You are welcome! Have you tried this https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/ ? Inputs need to be the certificate and key file.