gistfile1.cs

// signature
var signature = headerEncoded + "." + claimEncoded;
var signatureBytes = Encoding.UTF8.GetBytes(signature); 

var certificate = new X509Certificate2(privateKey, privateKeyPassword);

// sign signature using SHA256 with RSA
var rsa = (RSACryptoServiceProvider)certificate.PrivateKey;

// As of .NET 3.5 SP1 the CSP instance works with a provider of type PROV_RSA_AES
var cspParameters = new CspParameters
{
    KeyContainerName = rsa.CspKeyContainerInfo.KeyContainerName,
    KeyNumber = rsa.CspKeyContainerInfo.KeyNumber == KeyNumber.Exchange ? 1 : 2
};

var rsaAes = new RSACryptoServiceProvider(cspParameters) { PersistKeyInCsp = false };
var signatureSignedBytes = rsaAes.SignData(signatureBytes, CryptoConfig.MapNameToOID("SHA256"));

var signatureSignedAndEncoded = _base64Encoder.ToBase64UrlEncodedString(signatureSignedBytes);

var jwt = headerEncoded + "." + claimEncoded + "." + signatureSignedAndEncoded;