Tech Mastery: Deep Dives into AEM, Cloud Technologies, AI Innovations, and Advanced Marketing Strate

 While configuring SSO recently, I noticed a common question: Why do some applications ask for a certificate fingerprint instead of the actual certificate?

Here's a quick explanation:

🔹 Certificate (X.509 Certificate)

• Contains the public key, issuer, validity period, and digital signature.
• Used to verify SAML assertions or JWT signatures.

🔹 Certificate Fingerprint (Thumbprint)

• A cryptographic hash of the certificate (typically SHA-1 or SHA-256).
• Used as a unique identifier for a certificate.
• Much smaller than the certificate itself.

Some SSO applications require you to upload the full certificate, while others only ask for the certificate fingerprint. If a fingerprint is required, you can generate it from the certificate:

# SHA-1
openssl x509 -in certificate.pem -noout -fingerprint -sha1

# SHA-256
openssl x509 -in certificate.pem -noout -fingerprint -sha256

If you're using Microsoft Entra ID (Azure AD), you can download the signing certificate from the Federation Metadata URL and generate the required fingerprint.

💡 Key takeaway: The fingerprint is derived from the certificate—it isn't a different certificate. Whether you provide the certificate or its fingerprint depends on what the Service Provider expects during SSO configuration.

Have you come across applications that still require only the SHA-1 fingerprint instead of the full certificate? I'd be interested to hear your experience.