---
id: "x509_certificate_fingerprint"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["cryptography"]
langs: ["common"]
quality: 75
url: "http://registry.apicrafter.io/datatype/x509_certificate_fingerprint"
---

# X.509 certificate fingerprint (`x509_certificate_fingerprint`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Hash of the DER encoding of an X.509 certificate, as shown by browsers, certificate stores and openssl x509 -fingerprint: hexadecimal octets separated by colons, 20 octets for SHA-1 and 32 octets for SHA-256. The same value without separators looks like a plain SHA-1 or SHA-256 hash.

- Personal data (PII): no
- Categories: Cryptographic identifiers (cryptography)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^[0-9A-Fa-f]{2}(?::[0-9A-Fa-f]{2}){19}(?:(?::[0-9A-Fa-f]{2}){12})?$
```

## Examples

- `FF:2D:1B:4E:E9:CD:62:5A:52:CA:49:AF:A1:97:4E:A3:3F:09:ED:35:DB:8E:55:4D:F0:EC:7D:4C:73:A7:72:F2` — SHA-256 fingerprint of the example certificate of RFC 7468, section 5.1
- `AE:C4:60:61:F4:58:FC:B5:6E:20:4A:11:79:DE:BB:CF:23:7F:1C:53` — SHA-1 fingerprint of the same certificate
- `AE:C4:60:61:F4:58:FC:B5:6E:20:4A:11:79:DE:BB:CF:23:7F:1C` (invalid example) — one octet short (19 instead of 20)

## Sources

- wikipedia: <https://en.wikipedia.org/wiki/Public_key_fingerprint>
- doc: <https://docs.openssl.org/master/man1/openssl-x509/>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/x509_certificate_fingerprint.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/cryptography/x509_certificate_fingerprint.yaml>