# What Is Certificate Fingerprint (Certificate thumbprint)?

> Certificate fingerprints are hashes, usually SHA-256, of a certificate's DER encoding, used to identify one exact certificate; they are not stored in it.

Source: https://ssl.sh/glossary/certificate-fingerprint/
Last updated: 2026-11-10

A fingerprint, which Windows calls a thumbprint, is calculated by whoever is looking at the certificate: take the certificate's DER bytes and run them through a [hash function](https://ssl.sh/glossary/hash-function/) such as [SHA-256](https://ssl.sh/glossary/sha-256/). Because the hash covers every field, including the CA's signature, any change produces a different fingerprint, and two certificates with identical names and keys but different serial numbers have different fingerprints.

## Why it matters
Fingerprints let people and systems refer to one exact certificate: comparing what a server presents with what you deployed, allow-listing a certificate in an application, looking a certificate up in Certificate Transparency search tools, or confirming a self-signed certificate over a separate channel. Fingerprints change on every renewal, so configurations that hard-code a certificate fingerprint break when the certificate is replaced. [Pinning](https://ssl.sh/glossary/certificate-pinning/) the public key (an SPKI hash) instead survives renewals that reuse the same key.

## Example
```bash
openssl x509 -in cert.pem -noout -fingerprint -sha256
```

The output is a colon-separated hexadecimal string of 32 bytes.

## Common misconceptions
- **The fingerprint is part of the certificate and signed by the CA.** It is computed locally; certificate viewers display it only for convenience.
- **A SHA-1 fingerprint means the certificate uses SHA-1.** The fingerprint algorithm is chosen by the viewer and is unrelated to the certificate's signature algorithm.
- **PEM and DER files of the same certificate have different fingerprints.** Fingerprints are computed over the DER encoding, so both give the same result.

## Related terms

- [哈希函数](https://ssl.sh/zh/glossary/hash-function/): 哈希函数（密码学哈希函数）把任意长度的输入映射为固定长度的摘要，且在计算上无法逆推输入，也无法找到摘要相同的两个输入。
- [SHA-256](https://ssl.sh/zh/glossary/sha-256/): SHA-256 是 SHA-2 哈希家族中输出 256 位摘要的成员，由 NIST FIPS 180-4 规定，是当今 TLS 证书签名和指纹的标准哈希算法。
- [SHA-1](https://ssl.sh/zh/glossary/sha-1/): SHA-1 是 1995 年发布的 160 位哈希函数，已出现实际可行的碰撞攻击，公开信任的 TLS 证书早已不再允许使用它签名。
- [证书序列号](https://ssl.sh/zh/glossary/certificate-serial-number/): 证书序列号是 CA 为每张证书分配的正整数，与颁发者名称一起唯一标识一张证书，吊销列表和 OCSP 都靠它定位证书。
- [证书锁定](https://ssl.sh/zh/glossary/certificate-pinning/): 证书锁定是客户端侧的一项检查：只有服务器证书链中包含事先配置好的特定证书或公钥时，客户端才接受这次连接。
- [DER](https://ssl.sh/zh/glossary/der/): DER 是 ASN.1 的二进制编码规则，保证每个值只有唯一一种字节表示，X.509 证书和密钥都以它为基础。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。