Checking fingerprints of public keys

Most public key infrastructure schemes offer ways to check the "fingerprint" of a key. a fingerprint is a short, easily transmittable string that is long enough and random enough that it should uniquely identify the key. Different PKI schemes have different ways of displaying a fingerprint once they have a copy of the key.

X509

X509 certificates can be easily fingerprinted with openssl. for a cert you have downloaded to a file foo.pem, you can fingerprint it like this:

openssl x509 -noout -fingerprint foo.pem

SSH

ssh host keys and public keys can be fingerprinted with openssh's ssh-keygen tool. If you are on a machine running sshd from an openssh package, you can obtain the fingerprint of the host's public key with:

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

You can print the fingerprint of your own public key (if you've made one [wiki"ssh public key authentication" the standard way]) with:

ssh-keygen -l -f ~/.ssh/id_rsa.pub

OpenPGP

OpenPGP public keys (the kinds of keys used by GPG and PGP) can be fingerprinted with ​gnupg. If you've obtained a public key foo.gpg for someone named bar@example.org, you should import it into your keyring and then fingerprint it by the e-mail address:

gpg --import foo.gpg
gpg --fingerprint bar@example.org