Alternate issuer URL. If specified, you must be prepared to serve .well-known/openid-configuration and jwks from that location as application/json documents. Jenkins will continue to maintain the private key, but beware that unauthorized modification of either document could allow id tokens to be forged.