FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What is a certificate fingerprint? ​

Short answer

A certificate fingerprint is the hash value calculated from the whole certificate (today usually SHA-256); it identifies the certificate uniquely and is used to compare whether two files are the same certificate. The serial number, on the other hand, is the number the CA gives the certificate; the public key fingerprint is calculated only from the public key and does not change in certificates re-signed with the same key. In TR7, the Details tab of the certificate preview shows the SHA-256 fingerprint and Serial number values, the Chain tab shows the SHA-256 value of each link, and the Private Key Library shows the Public Key Fingerprint value of the keys.

Where It Is Used in TR7 ​

WhereField / labelWhat for
Certificates & PKI → SSL/TLS Certificates → preview → DetailsSHA-256 fingerprint, Serial numberIdentifying the certificate uniquely; comparing it with the record at the CA
SSL/TLS Certificates → preview → ChainSHA-256 on each linkComparing the intermediate and root certificates in the chain
Certificates & PKI → Private Key Library (list and preview)Public Key FingerprintIdentifying the key; records that show the same value are the same key
SSL/TLS Certificates → Issued Certificates (Internal PKI) → previewSerialThe serial number of each certificate issued by the Internal CA

Common Misconceptions ​

  • "The fingerprint is written inside the certificate." It is not present in the certificate as a separate field; it is calculated from the whole certificate. The serial number, however, is inside the certificate.
  • "The fingerprint of a certificate re-signed with the same key does not change." The certificate fingerprint and the serial number change; what does not change is the public key fingerprint. This is why key pinning is bound to the public key.
  • "A certificate fingerprint and a TLS fingerprint are the same thing." A TLS fingerprint (JA3, JA4) is calculated from the ClientHello message of the client and is used to identify the client software (What is a TLS fingerprint (JA3 / JA4); how does TR7 use it in bot detection?).

How it is done in the documentation

Related questions