How to generate x5t#S256 header to compare with keycloak access token

user_5533745 0
Viewed 199

When generating an access token on keycloak, I can see the value of x5t#S256 attribute with the following value: szfuvFcylKT5PRso0QIWK5fE6mB3Pn08ya2crsp5h1U

I'm trying to generate the same value, using the same certificates (pem and key) but I'm always getting a different value.

I've tried with the code below:

const certPem = await fs.readFileSync('./src/mycert.pem');
const cert = pki.certificateFromPem(certPem);

const fingerprint = pki.getPublicKeyFingerprint(cert.publicKey, {
  md: forge.md.sha256.create(),
  encoding: 'hex',
});

console.log(fingerprint);

The result is: 758a4d6b08c40764ba0342f2f55a0e86cd806b35fe9231ca0cecf10ff0c53d3e

What I'm doing wrong? Or, is there a lib to make it easier?

node.js ssl-certificate
1 Answers

x5t#S256 is a thumbprint of a whole certificate, not just of the public key in the certificate. And it is the base64url-encoding, not a hex.

user_101960440
Related