0

I am aware that I can get the fingerprint of an x509 certificate by typing
openssl x509 -in certificate.crt -noout -fingerprint

But if I try to get the fingerprint of a CSR (openssl req -in certrequest.csr -fingerprint) I get

req: Unrecognized flag fingerprint

As I understand it, the fingerprint is of the key used, so I ought to be able to get it from a .csr file. How can I do that, besides creating a custom script? Or have I misunderstood some key concept?

1
  • 1
    Please check the help of the x509 mode: -fingerprint: Print the certificate fingerprint. Of course that will not work on a cert request as the certificate is not yet issued.
    – Robert
    Commented Jun 3, 2022 at 17:01

2 Answers 2

0

Researching the hyperweb after taking a longish break bears fruit:

From ldapwiki

Certificate Fingerprint is NOT part of the Certificate but rather the hash of the DER encoded certificate

According to that definition, I cannot get the fingerprint of a csr, because it is NOT a certificate. My understanding that it was a hash of the key was erroneous, which makes sense...

1
  • 1
    Some X.509 certs put hash of publickey in the SubjectKeyIdentifier extension (and SKI value of issuer in AuthorityKeyIdentifier), although CSRs don't need to since CA can calculate it at issue, and it's not called fingerprint. For comparison PGP uses hash of publickey as fingerprint and its 'low'/rightmost octets as key-id in the protocol, and OpenSSH uses hash of publickey as fingerprint in the UI (but it is not used in SSH protocol). Commented Jul 4, 2022 at 1:10
0

You can calculate the fingerprint of any piece of data.

Example command for a CSR:

openssl req -in example.csr -outform DER | openssl dgst -sha256 -c
9
  • This is not the "fingerprint", this is just the message digest, i.e. the hash of the file. From the question and the OP's self-answer, they really were looking for the "fingerprint" of the file (even though they couldn't get one based on the tool).
    – schroeder
    Commented Jun 29, 2023 at 8:57
  • @schroeder - are you sure I am wrong? I do not think so but I do want to learn more since I have been working in PKI for decades. To quote: a fingerprint, is a hash of a certificate, computed over all certificate data and its signature. Published example using OpenSSL for CSRs: redkestrel.co.uk/articles/openssl-commands/#fingerprint Commented Jun 29, 2023 at 18:05
  • "You can calculate the fingerprint of any piece of data." -- yes, but that's not a fingerprint in the context the OP is asking for.
    – schroeder
    Commented Jun 29, 2023 at 21:26
  • @schroedern - The question is Getting fingerprint of certificate signing request. I provided the method to calculate the fingerprint of a CSR. That is what was asked and I provided a solution. Feel free to post another solution. BYW: the statement in the self-answer is wrong: I cannot get the fingerprint of a csr. Commented Jun 29, 2023 at 22:44
  • 1
    Now you know how to generate a fingerprint for a CSR. If you know the byte length of their fingerprint, you can guess the algorithm. For example, MD5 is 16 bytes long, SHA-1 is 20 bytes, SHA-256 is 32-bytes. The command in my question can be modified to generate any supported algorithm. Just change the -sh256 flag. Commented Jun 30, 2023 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .