How to retrieve/compute an X509 certificate's thumbprint in Java?

Question

I have a java client that is calling a web service operation which takes a certificate "thumbprint" as a parameter. I believe the thumbprint is some kind of SHA1 hash, in hexadecimal string format, of the cert's public key, but I'm not sure.

The .NET framework seems to include a simple way to get this value (X509Certificate2.Thumbprint property). Viewing a .cer file's properties in Windows also displays the thumbprint, which looks like:

a6 9c fd b0 58 0d a4 ee ae 9a 47 75 24 c3 0b 9f 5d b6 1c 77

My question is therefore: Does anybody know how to retrieve or compute this thumbprint string within Java, if I have an instance of a java.security.cert.X509Certificate?

user_149808 · Answer

The SHA-1 hash of the DER encoding of the certificate is what .NET is getting with X509Certificate2.Thumbprint.

As noted on the remarks on MSDN:

The thumbprint is dynamically generated using the SHA1 algorithm and does not physically exist in the certificate. Since the thumbprint is a unique value for the certificate, it is commonly used to find a particular certificate in a certificate store.

Java's standard library doesn't provide the thumbprint directly, but you can get it like this:

DatatypeConverter.printHexBinary(
        MessageDigest.getInstance("SHA-1").digest(
                cert.getEncoded())).toLowerCase();

Here's a full worked example using a conveniently accessible PEM file:

Create stackoverflow.crt.pem:

Create X509.java:

import javax.xml.bind.DatatypeConverter;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public final class X509 {
    public static void main(String[] args)
            throws FileNotFoundException, CertificateException, NoSuchAlgorithmException {
        FileInputStream is = new FileInputStream(args[0]);
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
        X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(is);
        String thumbprint = getThumbprint(cert);
        System.out.println(thumbprint);
    }

    private static String getThumbprint(X509Certificate cert)
            throws NoSuchAlgorithmException, CertificateEncodingException {
        MessageDigest md = MessageDigest.getInstance("SHA-1");
        byte[] der = cert.getEncoded();
        md.update(der);
        byte[] digest = md.digest();
        String digestHex = DatatypeConverter.printHexBinary(digest);
        return digestHex.toLowerCase();
    }
}

Compile the program with Java 8:

javac X509.java

Or Java 9 - due to modular JDK/JPMS - DataTypeConverter is not in java.base, but java.xml.bind, so you need to explicitly depend on it during your build:

javac --add-modules java.xml.bind X509.java

Otherwise, on Java 9, you get this when you try to build it:

X509.java:3: error: package javax.xml.bind is not visible
        import javax.xml.bind.DatatypeConverter;
        ^
        (package javax.xml.bind is declared in module java.xml.bind, which is not in the module graph)
        1 error

Run it with Java 8:

java X509 stackoverflow.crt.pem

In Java 9 - due to modular JDK/JPMS - DataTypeConverter is not in java.base, but java.xml.bind, so you need to explicitly depend on it when running your program:

java --add-modules java.xml.bind X509 stackoverflow.crt.pem

Otherwise, on Java 9, you get this when you try to run it:

Exception in thread "main" java.lang.NoClassDefFoundError: javax/xml/bind/DatatypeConverter
    at X509.getThumbPrint(X509.java:29)
    at X509.main(X509.java:19)
    Caused by: java.lang.ClassNotFoundException: javax.xml.bind.DatatypeConverter
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:582)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:185)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:496)
    ... 2 more

Get the expected output:

47adb03649a2eb18f63ffa29790818349a99cab7

user_4515438 · Answer

Short example without using any libraries.

object MessageDigestUtil {

    private val hexCode = "0123456789ABCDEF".toCharArray()

    fun sha1(input: ByteArray): ByteArray {
        return digest(input,"SHA-1")
    }

    @Throws(NoSuchAlgorithmException::class)
    fun getFingerprint(publicKey: PublicKey): String? {
        return printHexBinary(sha1(publicKey.encoded))
    }

    private fun printHexBinary(data: ByteArray): String {
        val r = StringBuilder(data.size * 2)
        for (b in data) {
            r.append(hexCode[b.toInt() shr 4 and 0xF])
            r.append(hexCode[(b and 0xF).toInt()])
        }
        return r.toString()
    }

    @Throws(NoSuchAlgorithmException::class)
    private fun digest(input: ByteArray, algorithm: String): ByteArray {
        val digest = MessageDigest.getInstance(algorithm)
        digest.update(input)
        return digest.digest()
    }
}

How to retrieve/compute an X509 certificate's thumbprint in Java?

6 Answers