Skip to content

Instantly share code, notes, and snippets.

@AlainODea
Created October 28, 2017 23:49
Show Gist options
  • Save AlainODea/caff99e778c0ad882c88795975359c60 to your computer and use it in GitHub Desktop.
Save AlainODea/caff99e778c0ad882c88795975359c60 to your computer and use it in GitHub Desktop.
Akamai-compatible certificate fingerprinting (for use with mutual TLS and Extract - Client Certificate - Hashed Fingerprint)
#!/bin/bash
sigAlg=$(
openssl x509 -text -noout \
-in api-test-client.crt.pem |
grep "Signature Algorithm: " |
cut -d':' -f 2 | tail -n1 | cut -c2- |
sed 's/WithRSAEncryption//'
)
openssl x509 -noout -fingerprint \
-sha512 -inform pem -in api-test-client.crt.pem |
cut -c20- | # remove the "SHA512 Fingerprint=" header
tr -d ':' | # remove the colons separating hex bytes
tr '[A-Z]' '[a-z]' # lowercase the output to match Akamai
import javax.xml.bind.DatatypeConverter;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
public final class CertificateFingerprinter
{
public static void main(String[] args)
throws FileNotFoundException, CertificateException, NoSuchAlgorithmException
{
FileInputStream is = new FileInputStream(args[0]);
CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(is);
String akamaiFingerprint = getAkamaiFingerprint(cert);
System.out.println(akamaiFingerprint);
}
private static String getAkamaiFingerprint(X509Certificate cert)
throws NoSuchAlgorithmException, CertificateEncodingException
{
return DatatypeConverter.printHexBinary(
MessageDigest.getInstance(getAkamaiFingerprintAlgorithm(cert))
.digest(cert.getEncoded())).toLowerCase();
}
private static String getAkamaiFingerprintAlgorithm(X509Certificate cert)
{
return cert.getSigAlgName().replace("SHA", "SHA-").replace("withRSA", "");
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment