Hash generator · Guide
SHA256 Certificate Generator: Fingerprints and Signing Algorithms
SHA-256 appears in two distinct places around certificates: as the fingerprint you compare when pinning, and as the hash inside the signature the CA produced. They are different things and get confused constantly.
The fingerprint
A certificate fingerprint is simply SHA-256 over the certificate DER bytes. It identifies that exact certificate and is what you compare when verifying a pin or checking you deployed the file you meant to:
openssl x509 -in cert.pem -noout -fingerprint -sha256
# fingerprint of a live server
openssl s_client -connect example.com:443 </dev/null 2>/dev/null \
| openssl x509 -noout -fingerprint -sha256The fingerprint changes on every renewal, because the certificate bytes change. Pinning a fingerprint therefore breaks at renewal — pin the public key instead if you need pinning at all.
The signature algorithm
Separately, the CA signs the certificate, and that signature includes a hash of the certificate contents. sha256WithRSAEncryption or ecdsa-with-SHA256 in the certificate text means SHA-256 was that hash.
Anything showing sha1WithRSAEncryption is obsolete and rejected by every current browser — SHA-1 certificates were distrusted in 2017 after practical collision attacks made forged certificates conceivable.
openssl x509 -in cert.pem -noout -text | grep "Signature Algorithm"Generating a CSR with SHA-256
When you create a certificate signing request, the digest algorithm is yours to choose and SHA-256 is the correct default:
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.key -out example.csr -sha256Modern OpenSSL defaults to SHA-256 anyway, but being explicit documents the intent and protects against an old default on an unfamiliar machine. Note the CA re-signs with its own policy, so your -sha256 governs the CSR, not necessarily the final certificate.
Frequently asked questions
Is the fingerprint the same as the signature?
No. The fingerprint is a hash you compute over the certificate; the signature is produced by the CA using its private key.
Why did my pinned fingerprint stop working?
The certificate was renewed, which changes the bytes and therefore the fingerprint. Pin the public key rather than the certificate.
Are SHA-1 certificates still usable?
No. Browsers have rejected them since 2017.
Ready to try it?
Open the free browser-based Hash generator and apply what you just read — no sign-up, runs locally.
Open the Hash generator tool