2

I looked at a certificate of (e.g. stackoverflow) a website and the fingerprint in chrome was different then microsoft edge, so I was wondering how it that possible?

chrome: f67e91c916ce8f5f8aee8abdf99328613dd298a3  

edge: 3D:BB:0B:22:63:21:01:3B:1B:6A:2D:9A:FF:5A:84:5B:25:C0:D3:17:49:B9:15:42:EC:50:3A:D7:1A:67:7F:2F

I thought that one might be hex and the other converted to ascii or something ...but converting does not help.

Improve this question
1
  • Where did you get that thumbprint value in Edge? As far as I know, on Windows both Chrome and Edge use the same built-in certificate viewer from the OS. I'm intrigued as to how you got a different display representation on the two browsers.
    – Polynomial
    Feb 17, 2021 at 18:26

1 Answer 1

Reset to default
5

Chrome is showing you the SHA-1 hash of the certificate.

Edge is showing you the SHA-256 hash of the certificate.

FYI, Firefox shows both. Copied below is a snip of the fingerprints of the certificate for *.stackexchange.com as displayed by Firefox:

enter image description here

Finally, hashing does not involve exponents. You might be thinking of assymmetic RSA or DH encryption, which involve exponents.

Improve this answer
8
  • Ty, and for the exponent. I knew that its relevant for rsa which is why I was refering to certificates in general and not only the fingerprint. Do you know how I can extract the exponent of an rsa public key shown in a certificate
    – Barry
    Feb 17, 2021 at 18:56
  • @Barry In Firefox, Firefox shows the public key modulus and exponent when you view the certificate. See the snip I posted at ibb.co/VqDs89J. I'm fairly sure other browsers do the same.
    – mti2935
    Feb 17, 2021 at 19:41
  • 2
    @Barry Here's a way to do it on the command line, using openssl: ` openssl s_client -connect security.stackexchange.com:443 | openssl x509 -pubkey -noout | openssl rsa -inform PEM -pubin -text -noout`
    – mti2935
    Feb 17, 2021 at 21:57
  • 1
    @Jitin The CA hashes the cert, then signs the hash, then the signature is appended to the cert. But, the hash that the CA signs is not the same as the hash displayed by the browser. The hash displayed by the browser is a hash of the entire cert, including the signature. You can see this if you download a cert (for example, the leaf cert for *.stackexchange.com), then base64-decode the base64 between --BEGIN CERTIFICATE--- and ---END CERTIFICATE--- in the .pem file, then hash these underlying bytes. The result will be the same as the result displayed by the browser.
    – mti2935
    Jun 2, 2023 at 21:30
  • 1
    @Jitin You can see what I mean above by running the following command: openssl s_client -showcerts -connect security.stackexchange.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM | grep -v '^-' | base64 -d | sha256sum This produces 437d98870780b4abd31ac4d301965e9698cb3eb04da49a70f95d3c269d0b20f6 which is the same sha256 fingerprint for *.stackexchange.com displayed by Firefox.
    – mti2935
    Jun 3, 2023 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .