I'm looking at a Windows PKI and see that the Thumbprint is SHA1, while the Signature is SHA2 (SHA256).

Is this an acceptable configuration?

Should I recommend that the client update to SHA2 for a Thumbprint?

Would this cause some backward compatibility issues?

1 Answer 1


Computed field

I think that's a calculated value by the Windows GUI. And not actually inside the cert. Have a look at the cert itself using OpenSSL. (openssl x509 -in MYFILENAME.CER -noout -text)

Here's a blog that talks about this:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.