title: How to calculate X.509 certificate's SHA-1 fingerprint?
body: <p>I'm trying to implement an X.509 certificate generator from scratch (I know about the existing ones, but I need yet another one). What I cannot understand is how to calculate the SHA-1 (or any other) fingerprint of the certificate.</p>
  <p>The <a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3" rel="nofollow noreferrer">RFC5280</a> says that the input to the signature function is the DER-encoded tbsCertificate field. Unfortunately, the hash that I calculate differs from the one produced by OpenSSL. Here's a step-by-step example.</p>
  <ol>
  <li>Generate a certificate using OpenSSL's x509 tool (in a binary DER form, <em>not</em> the ASCII PEM)</li>
  <li>Calculate its SHA-1 hash using <code>openssl x509 -fingerprint</code></li>
  <li>Extract the TBS field using <code>dd</code> (or anything else) and store it in a separate file; calculate its hash using the <code>sha1sum</code> utility</li>
  </ol>
  <p>Now, the hashes I get at steps 2 and 3 are different. Can someone please give me a hint what I may be doing wrong?</p>