I recently learned mechanism of certificates. But I can't understand why a "thumbprint" is included in a certificate.

For intermediate and end-user certificates, it is verified by its issuer. so it can simply be calculated as the certificate itself is trusted.

For root/self-signed certificates, they're not trusted unless it is provided with the OS. So the thumbprint included is also not trusted.

I think that I just misunderstood something, can anyone point it out?

  • Related answers discussing why thumbprints are used: security.stackexchange.com/questions/35691/… and security.stackexchange.com/questions/116343/…
    – Jedi
    Jul 16, 2016 at 4:44
  • @Stalker, Can you tell what are thumbprints and how they are related with certificates? Or you can send a decent link to read.
    – one
    Jul 16, 2016 at 18:18
  • 1
    @one: A thumbprint is actually the hash value of the corresponding certificate in DER format. As far as I know, thumbprints are used to locate certificates easily. When a program is requesting a certificate, instead of using its subject name or something else, it can just provide its thumbprint. I used to think they are stored in the certificates because I can see the thumbprint when opening a certificate in Windows. But now I've understood that they are calculated when they're needed.(Might be cached? I don't know.) Jul 17, 2016 at 0:08

1 Answer 1


There is no thumbprint included in the certificate. What is included is a signature which is used to build the trust chain.

The thumbprint (or fingerprint) is just a hash over the certificate to make it easier for humans to compare certificates. It is not included but computed when needed.

  • So the "Thumbprint" field in the Windows certificate information dialog is simply calculated when the dialog is opened? Jul 16, 2016 at 6:02
  • 5
    @Stalker: yes. And it will often show you even several thumbprints, i.e. SHA-1, SHA-256 etc - all freshly calculated. Jul 16, 2016 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.