如何使用 node-forge 从 x.509 获取 AWS 使用的相同指纹？

Question

How to get the certificate ID / fingerprint of an x.509 certificate using node-forge ?

Update

I need this for AWS IoT. I've been investigating and ended up that AWS probably uses some fingerprint algorithm to extract the certificate ID. It is not baked into the cert, probably the public key is used as a base for the fingerprint.

Update 2

Running this command returns the correct fingerprint: openssl x509 -noout -fingerprint -sha256 -inform pem -in cert.crt

How to achieve this with node-forge ?

I've put together the following one but it does not return the same fp.:

const fs = require('fs')
const forge = require('node-forge')
const { pki } = forge
const { promisify } = require('es6-promisify')
const readFile = promisify(fs.readFile)

async function main() {
  const certPem = await readFile('./cert.crt', 'utf-8')
  const cert = pki.certificateFromPem(certPem)
  const fingerprint = pki.getPublicKeyFingerprint(cert.publicKey, {
    md: forge.md.sha256.create(),
    encoding: 'hex',
  })
}

main()

Answer 1

To expand on the solution of haxpanel with some code in your requested NodeJS code:

const crypto = require("crypto");

function getCertificateFingerprint(certString) {
    const baseString = certString.match(/-----BEGIN CERTIFICATE-----\s*([\s\S]+?)\s*-----END CERTIFICATE-----/i);
    const rawCert = Buffer.from(baseString[1], "base64");
    const sha256sum = crypto.createHash("sha256").update(rawCert).digest("hex");
    return sha256sum.toUpperCase().replace(/(.{2})(?!$)/g, "$1:");
    // eg 83:6E:3E:99:58:44:AE:61:72:55:AD:C6:24:BE:5C:2D:46:21:BA:BE:87:E4:3A:38:C8:E8:09:AC:22:48:46:20
}

Answer 2

here you are. The result will same as openssl x509 -in a.pem -fingerprint -sha256 -noout

  import forge from 'node-forge'
  fingerprint() {
    const der = forge.asn1.toDer(forge.pki.certificateToAsn1(cert)).getBytes()
    const m = forge.md.sha256.create().start().update(der)
    return  m.digest()
        .toHex()
        .match(/.{2}/g)
        .join(':')
        .toUpperCase()
  }

Answer 3

The solution is:

You just need to extract the string from between the "-----BEGIN CERTIFICATE-----" header and "-----END CERTIFICATE----- " footer, base64 decode it and compute SHA1 hash of decoded data.

In this case SHA256.