How to get a list of fingerprints of certificates in a PKCS#7 structure?

Question

I have a PKCS#7 structure with a list of certificates stored in a ByteString (originally read from a file). Now I would like to get the fingerprint for the certificates stored inside the structure. Essentially I would like to perform the equivalent of this OpenSSL command line in Haskell:

$ openssl pkcs7 -inform DER -in NOGAPPS.RSA -print_certs | openssl x509 -fingerprint -sha256
SHA256 Fingerprint=9B:D0:67:27:E6:27:96:C0:13:0E:B6:DA:B3:9B:73:15:74:51:58:2C:BD:13:8E:86:C4:68:AC:C3:95:D1:41:65
-----BEGIN CERTIFICATE-----
[...]

Here is minimal example which embeds the key that I want the fingerprint of in base64. In the documentation I have found OpenSSL.PEM.readPkcs7, but there are two reason why this will not work. First of all, it returns a Pkcs7 type which is entirely opaque and I have no idea how to get the certificates out of it, but more importantly it's for PEM encoded PKCS#7 and the key that I'm trying to load is in DER format. How can I achieve what I have described above?

{-# LANGUAGE OverloadedStrings #-}

import Data.ByteString (ByteString)
import Data.ByteString.Char8 (unpack)
import Data.ByteString.Base64 (decode)
import OpenSSL.PEM

input :: Either String ByteString
input = decode "MIIEfwYJKoZIhvcNAQcCoIIEcDCCBGwCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCCAvEwggLtMIIB1aADAgECAgQm/6AJMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNVBAYTAkRFMRgwFgYDVQQKEw9OT0dBUFBTIFByb2plY3QwHhcNMTIxMDA2MTIwNTMyWhcNMzcwOTMwMTIwNTMyWjAnMQswCQYDVQQGEwJERTEYMBYGA1UEChMPTk9HQVBQUyBQcm9qZWN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmo0qUzaw6qrYnORHgox3U7FXRZt54yFdyWLKSPWMLNdlDfZ9Lde9oIgMaCeR8ys1xQTkPne0PD5OVB+G41qCk6VPtG5rFq9U06TtpFjxp8i8G3R5hhynBDM3GA5AB52c3Mt+BRram2yIyexjVUHi6/CEJSHDAkyCb2/W22/RF8dOhZ1a9NsERIllq1RptxznGZOaBu8wWA9Q/r+WxHSn0mW7Y/hqgi/3tkPea3bpZqGFU8KFhBbPMwndJCeDdL3YK0QE729/Eizsk4WTUfxuXqlH48651nN0/pcOWT5c0FyQXh0k9aVIT0qt73ZuSYrfZPfPBL3dYCroE3tu6kByLQIDAQABoyEwHzAdBgNVHQ4EFgQUEQt6qevIQLIDmfaaQx9NumrEKmQwDQYJKoZIhvcNAQELBQADggEBAAfDKtiTNJz4aVL7WknP3JsT9ePIAK7Od7Ln4OnIPjQFLxQPNX7H5vS0Mtwe1UIhihSDWs0t8t7qfv0/1ejxw04fs57GpCfG5vQXi2CbNpBArB+IRLeJ82lNxkDeBuRLJHr+0RY3Fz829YhhcPr9dJVASYWMYJYwj8k8G8TdVoX6eh+YKkIvKjs2uqjJUAR0zyr5HDnL7BvImNEBlNNoql6R8RN+wRUIfDGWLY92zRINKMJJz3b0xw9bqgjHCnI0zkEjvggM7niUd0AZZc/lN7kk7zZ0foyspi3+/dGmKI3LHE/SqqYTGnrSVOl0ICLP1ZfSylxmDOnkH/U35aQEHjcxggFWMIIBUgIBATAvMCcxCzAJBgNVBAYTAkRFMRgwFgYDVQQKEw9OT0dBUFBTIFByb2plY3QCBCb/oAkwCQYFKw4DAhoFADANBgkqhkiG9w0BAQEFAASCAQCS6S9F62sGho2J43QyUEv76YQnXYbfY9B4B5zJvVvB/TLrCXfeoLdN1Ujb/9wQ1jrvKWik+60ycnJQBNJ25E/+36ZtDrCToW2jVY5uXI2GGdGQylSfiNsWODweOV8BUpzkiFxzqF1bo2vTY1x/iD+x4d0fucuw9SN9VhEw7SzrLdX/hPrseWwmtRbda8/EyZeZt/wlF0GeDyV2Kx1v40f42FbryDLzEPwpzM+UfBCA38jcjvUlwxBTxXPERYBfJDQAwUZOxeb4pT+whbAuYFfFIpw71ClNAOBlLMVqrenVy57EuYPhp4bRG5R7YiF96MUmFkAuStfyAlq6U23Z+n3T"

main :: IO ()
main = do
    certs <- case input of
               Left err -> error err
               Right bs -> readPkcs7 (unpack bs)
    -- ???

How to get a list of fingerprints of certificates in a PKCS#7 structure?

0 Answers