Certificate Fingerprint (Certificate thumbprint)
Definition
Certificate fingerprints are hashes, usually SHA-256, of a certificate's DER encoding, used to identify one exact certificate; they are not stored in it.
A fingerprint, which Windows calls a thumbprint, is calculated by whoever is looking at the certificate: take the certificate's DER bytes and run them through a hash function such as SHA-256. Because the hash covers every field, including the CA's signature, any change produces a different fingerprint, and two certificates with identical names and keys but different serial numbers have different fingerprints.
Why it matters
Fingerprints let people and systems refer to one exact certificate: comparing what a server presents with what you deployed, allow-listing a certificate in an application, looking a certificate up in Certificate Transparency search tools, or confirming a self-signed certificate over a separate channel. Fingerprints change on every renewal, so configurations that hard-code a certificate fingerprint break when the certificate is replaced. Pinning the public key (an SPKI hash) instead survives renewals that reuse the same key.
Example
openssl x509 -in cert.pem -noout -fingerprint -sha256
The output is a colon-separated hexadecimal string of 32 bytes.
Common misconceptions
- The fingerprint is part of the certificate and signed by the CA. It is computed locally; certificate viewers display it only for convenience.
- A SHA-1 fingerprint means the certificate uses SHA-1. The fingerprint algorithm is chosen by the viewer and is unrelated to the certificate's signature algorithm.
- PEM and DER files of the same certificate have different fingerprints. Fingerprints are computed over the DER encoding, so both give the same result.