# Certificate fingerprints

A certificate fingerprint is a cryptographic hash of the certificate's DER encoding, normally SHA-256. It identifies that exact certificate and nothing else. Converting between PEM and DER does not change it, because both encode the same bytes — but reissuing or renewing does, even for the same key and hostname, which is why pinning a fingerprint breaks every time a certificate is renewed. Get one with `openssl x509 -in certificate.crt -noout -fingerprint -sha256`.

Source: https://certguru.io/concepts/fingerprint/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Getting one

```bash
openssl x509 -in certificate.crt -noout -fingerprint -sha256
```

Expected output:

```
sha256 Fingerprint=A1:B2:C3:D4:...
```

*Other algorithms*

```bash
openssl x509 -in certificate.crt -noout -fingerprint -sha1
openssl x509 -in certificate.crt -noout -fingerprint -md5
```

*From a live server*

```bash
openssl s_client -connect example.com:443 -servername example.com /dev/null \
  | openssl x509 -noout -fingerprint -sha256
```

## What is being hashed

The DER encoding of the whole certificate — signature included. That has two useful consequences:

**It survives format conversion.** PEM is Base64-encoded DER, so both produce the same value:

*Identical, before and after converting*

```bash
openssl x509 -in certificate.crt -noout -fingerprint -sha256
openssl x509 -in certificate.der -inform der -noout -fingerprint -sha256
```

That makes the fingerprint the cleanest way to prove a conversion changed nothing.

**It changes on every reissue.** A renewal produces a new serial number and new validity dates, so
the bytes differ and the fingerprint differs — even with the same key and the same hostname.

## Fingerprint or public key hash?

They answer different questions, and confusing them causes real problems:

| | Fingerprint | Public key hash |
| --- | --- | --- |
| Hashes | The whole certificate | Just the SubjectPublicKeyInfo |
| Changes on renewal | Yes, always | Only if the key changes |
| Identifies | One exact certificate | A key pair |
| Good for | Confirming two files are identical | Matching a key to a certificate |

*Public key hash — the one that survives renewal*

```bash
openssl x509 -in certificate.crt -noout -pubkey | openssl sha256
```

That is the value used to check a
[key matches a certificate](/openssl/check-key-matches-certificate/).

## Comparing certificates

*Are these two files the same certificate?*

```bash
a=$(openssl x509 -in certificate.crt -noout -fingerprint -sha256)
b=$(openssl x509 -in cert-00.pem  -noout -fingerprint -sha256)
[ "$a" = "$b" ] && echo "identical" || echo "different certificates"
```

Useful for confirming the certificate you deployed is the one being served, which is a surprisingly
common source of confusion when a load balancer or CDN sits in front.

## On pinning

> **Pinning a fingerprint schedules an outage**
>
> A certificate fingerprint changes at every renewal. Pinning one means every renewal breaks every
>   client that has not been updated first — and because renewals are automated and client updates are
>   not, the two rarely coincide.

Pinning the **public key** is more durable, since it survives renewal as long as the key is reused.
That does trade against rotating the key at renewal, which is itself a good practice, so pinning of
any kind is worth reserving for cases where you control both ends and can coordinate changes.


## Frequently asked questions

### Does converting PEM to DER change the fingerprint?

No. The fingerprint hashes the DER bytes, and PEM is those same bytes Base64-encoded. Both forms produce an identical fingerprint, which makes it a reliable way to confirm a conversion was lossless.

### What is a thumbprint?

The same thing. Windows and .NET call it a thumbprint, and default to SHA-1 where most other tooling now defaults to SHA-256.

### Is a SHA-1 fingerprint still safe to use?

For comparing two files you already have, yes — you are checking equality, not resisting a forgery. For anything where an attacker chooses the input, use SHA-256. Tools still print SHA-1 mostly for historical compatibility.

### Should I pin certificate fingerprints?

Rarely. A fingerprint changes on every renewal, so pinning one guarantees an outage on a schedule. Pinning the public key instead survives renewal as long as the key is reused — though that conflicts with rotating keys at renewal, which is itself good practice.


## References

- [RFC 5280: X.509 and CRL profile](https://www.rfc-editor.org/rfc/rfc5280) — the specification every field on a certificate comes from
- [openssl-x509(1)](https://docs.openssl.org/3.5/man1/openssl-x509/) — -fingerprint and the digest it hashes

## Related pages

- https://certguru.io/openssl/view-certificate/
- https://certguru.io/formats/der/
- https://certguru.io/formats/pem/
- https://certguru.io/concepts/certificate-chain/
- https://certguru.io/openssl/check-key-matches-certificate/

--
CertGuru — https://certguru.io