CertGuru

Certificate fingerprints

A certificate fingerprint is a cryptographic hash of the certificate's DER encoding, normally SHA-256. It identifies that exact certificate and nothing else. Converting between PEM and DER does not change it, because both encode the same bytes — but reissuing or renewing does, even for the same key and hostname, which is why pinning a fingerprint breaks every time a certificate is renewed. Get one with `openssl x509 -in certificate.crt -noout -fingerprint -sha256`.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Getting one # 

openssl x509 -in certificate.crt -noout -fingerprint -sha256
Expected output 
sha256 Fingerprint=A1:B2:C3:D4:...
Other algorithms
openssl x509 -in certificate.crt -noout -fingerprint -sha1
openssl x509 -in certificate.crt -noout -fingerprint -md5
From a live server
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -fingerprint -sha256

What is being hashed #

The DER encoding of the whole certificate — signature included. That has two useful consequences:

It survives format conversion. PEM is Base64-encoded DER, so both produce the same value:

Identical, before and after converting
openssl x509 -in certificate.crt -noout -fingerprint -sha256
openssl x509 -in certificate.der -inform der -noout -fingerprint -sha256

That makes the fingerprint the cleanest way to prove a conversion changed nothing.

It changes on every reissue. A renewal produces a new serial number and new validity dates, so the bytes differ and the fingerprint differs — even with the same key and the same hostname.

Fingerprint or public key hash? #

They answer different questions, and confusing them causes real problems:

Fingerprint Public key hash
Hashes The whole certificate Just the SubjectPublicKeyInfo
Changes on renewal Yes, always Only if the key changes
Identifies One exact certificate A key pair
Good for Confirming two files are identical Matching a key to a certificate
Public key hash — the one that survives renewal
openssl x509 -in certificate.crt -noout -pubkey | openssl sha256

That is the value used to check a key matches a certificate.

Comparing certificates #

Are these two files the same certificate?
a=$(openssl x509 -in certificate.crt -noout -fingerprint -sha256)
b=$(openssl x509 -in cert-00.pem  -noout -fingerprint -sha256)
[ "$a" = "$b" ] && echo "identical" || echo "different certificates"

Useful for confirming the certificate you deployed is the one being served, which is a surprisingly common source of confusion when a load balancer or CDN sits in front.

On pinning #

Pinning the public key is more durable, since it survives renewal as long as the key is reused. That does trade against rotating the key at renewal, which is itself a good practice, so pinning of any kind is worth reserving for cases where you control both ends and can coordinate changes.

Frequently asked questions

Does converting PEM to DER change the fingerprint?
No. The fingerprint hashes the DER bytes, and PEM is those same bytes Base64-encoded. Both forms produce an identical fingerprint, which makes it a reliable way to confirm a conversion was lossless.
What is a thumbprint?
The same thing. Windows and .NET call it a thumbprint, and default to SHA-1 where most other tooling now defaults to SHA-256.
Is a SHA-1 fingerprint still safe to use?
For comparing two files you already have, yes — you are checking equality, not resisting a forgery. For anything where an attacker chooses the input, use SHA-256. Tools still print SHA-1 mostly for historical compatibility.
Should I pin certificate fingerprints?
Rarely. A fingerprint changes on every renewal, so pinning one guarantees an outage on a schedule. Pinning the public key instead survives renewal as long as the key is reused — though that conflicts with rotating keys at renewal, which is itself good practice.

References

Related pages