Ask HN: How the hash value get calculated from AWS CA?

#1

Post by singlewind » Wed, May 05, 2021, 5:29 AM UTC

Ask HN: How the hash value get calculated from AWS CA?
amazontrust.com

Re: Ask HN: How the hash value get calculated from AWS CA?

#2

Post by singlewind » Wed, May 05, 2021, 5:33 AM UTC

In the CPS document it said this is SHA256 fingerprint. So I run the following command and the value doesn't match. I have asked AWS support. They said it is out of scope. Mostly like the support team doesn't know either.

openssl x509 -in AmazonRootCA1.pem -noout -fingerprint -sha256

Re: Ask HN: How the hash value get calculated from AWS CA?

#3

Post by wahern » Wed, May 05, 2021, 5:46 AM UTC

singlewind wrote: post #2

In the CPS document it said this is SHA256 fingerprint. So I run the following command and the value doesn't match. I have asked AWS support. They said it is out of scope. Mostly like the support team doesn't know either. openssl x509 -in AmazonRootCA1.pem -noout -fingerprint -sha256

The fingerprint is the "SHA-256 Hash of Subject Public Key Information", not the entire [unsigned] certificate. Basically, the DER encoding of the PKIX SubjectPublicKeyInfo structure. See https://tools.ietf.org/html/rfc5280#section-4.1.2.7 and https://tools.ietf.org/html/rfc3279#section-2.3.1 for RSA; for ECC keys see https://tools.ietf.org/html/rfc5480 and https://tools.ietf.org/html/rfc8410.

Calculating this is generally easy from a typical WebPKI library; less straight-forward from the command line:

  % openssl x509 -pubkey -noout


(Note: That matches the AWS hash.)The hash of the public key is often used as a stable identifier for entities. Hashes of certificates will, of course, change w/ the validity dates and serial number.


    
      Permalink
      View on HN
      Reply on HN
      Top