Calculating thumbprint/fingerprint

Charles_Collinson · November 6, 2020, 2:30pm

I create SSL certs with your cryptography pack and was looking at creating a fingerprint hash so I could pin it using Indy at the client end. How do you extract, for example, the 256 fingerprint from a created cert using your cryptography pack? TIA.

Marion · November 6, 2020, 2:46pm

To compute 256 fingerprint, you need to use TSHA2Hash component with 256 as hashSizeBits. This component is located in the HashObj unit. You can find some examples of use in the manual and the demo.
Best regards,
Marion

Charles_Collinson · November 6, 2020, 3:23pm

Thanks for getting back to me.

I have been using a SHA2Hash component and hashing the whole certificate (to include the begin and end sections) loaded into a stringlist, as well as changing the output format and varying the Unicode but none of the results matches an internet site that does the same (https://www.samltool.com/fingerprint.php)

As an example:

On the above website the 256 comes back as:
6f90ebdb99a11f0efca1f28d8fea3f8819e9a99cbedb96834493f5f4826e69cb

Delphi comes back with:
hexa =4BCE77239C9933A160F865EB8EA83357FA6F4BEB92ECC56C31830BDE7110CFE3

I basically can't get the SHA2Hash component to match the example internet site fingerprint. As far as I know the fingerprint hash is of the whole cert so includes BEGIN/END. Might be I'm hashing the wrong text though I've tried just the CrtStr but didn't work either?

Marion · November 6, 2020, 3:30pm

To compute the fingerprint, you need to convert the certificate (only the base64 string, so without the BEGIN/END tags) from base64 to raw format. You can use TConvert.FormatToString with AType := base64 to do that. Then you can hash the string with TSHA2Hash component.
Best regards,
Marion

system · November 9, 2020, 1:46pm

This topic was automatically closed 60 minutes after the last reply. New replies are no longer allowed.