Akamai-compatible certificate fingerprinting (for use with mutual TLS and Extract - Client Certificate - Hashed Fingerprint)

certificate-fingerprint

#!/bin/bash
sigAlg=$(
  openssl x509 -text -noout \
    -in api-test-client.crt.pem |
  grep "Signature Algorithm: " |
  cut -d':' -f 2 | tail -n1 | cut -c2- |
  sed 's/WithRSAEncryption//'
)

openssl x509 -noout -fingerprint \
  -sha512 -inform pem -in api-test-client.crt.pem |
  cut -c20- | # remove the "SHA512 Fingerprint=" header
  tr -d ':' | # remove the colons separating hex bytes
  tr '[A-Z]' '[a-z]' # lowercase the output to match Akamai

CertificateFingerprinter.java

import javax.xml.bind.DatatypeConverter;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public final class CertificateFingerprinter
{
    public static void main(String[] args)
            throws FileNotFoundException, CertificateException, NoSuchAlgorithmException
    {
        FileInputStream is = new FileInputStream(args[0]);
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
        X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(is);
        String akamaiFingerprint = getAkamaiFingerprint(cert);
        System.out.println(akamaiFingerprint);
    }

    private static String getAkamaiFingerprint(X509Certificate cert)
            throws NoSuchAlgorithmException, CertificateEncodingException
    {
        return DatatypeConverter.printHexBinary(
                MessageDigest.getInstance(getAkamaiFingerprintAlgorithm(cert))
                             .digest(cert.getEncoded())).toLowerCase();
    }

    private static String getAkamaiFingerprintAlgorithm(X509Certificate cert)
    {
        return cert.getSigAlgName().replace("SHA", "SHA-").replace("withRSA", "");
    }
}