title: How to get SHA1 fingerprint of a certificate
body: <p>My aim is to achieve SHA1 fingerprint of a third party website's certificate. I am able to get it successfully using <code>openssl</code> command line however, it's not getting same when I tried to achieve it using python code. The SHA1 fingerprint obtained using python code is totally different than the one obtained via openssl.</p>
  <p>openssl steps --&gt;</p>
  <p><code>openssl s_client -servername token.actions.githubusercontent.com -showcerts -connect token.actions.githubusercontent.com:443</code></p>
  <p>The above command output contains chain and root certificate;</p>
  <pre><code>Certificate chain
   0 s:/C=US/ST=California/L=San Francisco/O=GitHub, Inc./CN=*.actions.githubusercontent.com
     i:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1
  -----BEGIN CERTIFICATE-----
  MIIG9jCCBd6gAwIBAgIQCFCR4fqbkQJJbzQZsc87qzANBgkqhkiG9w0BAQsFADBP
  MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMSkwJwYDVQQDEyBE
  aWdpQ2VydCBUTFMgUlNBIFNIQTI1NiAyMDIwIENBMTAeFw0yMjAxMTEwMDAwMDBa
  </code></pre>
  <p>Save the chain certificate with <code>.crt</code> extension as MaingithubOIDC.crt and running below command gives SHA1 fingerprint;</p>
  <pre><code>❯ openssl x509 -in MaingithubOIDC.crt -fingerprint -noout
  SHA1 Fingerprint=15:E2:91:08:71:81:11:E5:9B:3D:AD:31:95:46:47:E3:C3:44:A2:31
  </code></pre>
  <p>Reference link - <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html</a></p>
  <p>Python code (version 3.8/3.9) --&gt;</p>
  <pre><code>import ssl
  import socket
  import hashlib
   
  addr = 'token.actions.githubusercontent.com'
   
  sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  sock.settimeout(1)
  wrappedSocket = ssl.wrap_socket(sock)
   
  try:
    wrappedSocket.connect((addr, 443))
    print (wrappedSocket)
  except:
    response = False
  else:
    der_cert = wrappedSocket.getpeercert(True)
    pem_cert = ssl.DER_cert_to_PEM_cert(wrappedSocket.getpeercert(True))
    print(pem_cert)
   
    #Print SHA1 Thumbprint
    thumb_sha1 = hashlib.sha1(der_cert).hexdigest()
    print(&quot;SHA1: &quot; + thumb_sha1)
  </code></pre>
  <p>Python code output;
  <code>SHA1: 55a7ef500a3a99f64c99c665daaf3f07403cff3d</code></p>
  <p>So, the SHA1 fingerprint doesn't match with the one obtained using <code>openssl</code>. Am I missing something in python code?</p>