certificateFingerprint

certificateFingerprint

Compute a certificate fingerprint — a hash over the DER encoding.

The certificate is parsed (validating the input and, for PEM, decoding it to DER) before hashing, so the digest is always taken over the canonical DER of a well-formed certificate. Malformed input throws, matching the other DER/PEM boundaries in the library.

Asynchronous: hashing uses WebCrypto's crypto.subtle.digest. Await the returned promise before reading bytes, hex, or colonHex.

function certificateFingerprint(
	certificate: CertificateFingerprintSource,
	algorithm: CertificateFingerprintAlgorithm,
): Promise<CertificateFingerprint>

Parameters

• certificate: CertificateFingerprintSource — PEM string, DER bytes, or a ParsedCertificate.
• algorithm: CertificateFingerprintAlgorithm — Digest algorithm to use. Defaults to 'SHA-256'.

Examples

const fingerprint = await certificateFingerprint(pemString);
console.log(fingerprint.colonHex); // "AB:CD:…" — matches `openssl x509 -fingerprint -sha256`

// Reuse an already-parsed certificate and request SHA-1.
const parsed = parseCertificatePemOrThrow(pemString);
const legacy = await certificateFingerprint(parsed, 'SHA-1');
console.log(legacy.hex);