Checking fingerprints of public keys

A fingerprint is a short, easily transmittable string that uniquely identifies a key or certificate. People often verify that they have a valid, untampered copy of a given key by comparing fingerprints with someone who has a known-good copy of the key.

Different PKI schemes have different ways of displaying a fingerprint. Once you get the fingerprint, you can compare it against

X509

X509 certificates can be easily fingerprinted with openssl. For a cert you have downloaded to a file foo.pem, you can fingerprint it like this:

openssl x509 -noout -fingerprint foo.pem

SSH

ssh host keys and public keys can be fingerprinted with openssh's ssh-keygen tool. If you are on a machine running sshd from an openssh package, you can obtain the fingerprint of the host's public key with:

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

You can print the fingerprint of your own public key (if you've made one [wiki"ssh public key authentication" the standard way]) with:

ssh-keygen -l -f ~/.ssh/id_rsa.pub

If you've already visited host qux.example.com via ssh, its key is probably stored in your ~/.ssh/known_hosts file. You can retrieve its fingerprint with the following (note: this will not work if you use the HashKnownHosts feature of openssh):

ssh-keygen -l -f ~/.ssh/known_hosts | grep qux.example.com

OpenPGP

OpenPGP public keys (the kinds of keys used by GPG and PGP) can be fingerprinted with ​gnupg. If you've obtained a public key foo.gpg for someone named bar@example.org, you should import it into your keyring and then fingerprint it by the e-mail address:

gpg --import foo.gpg
gpg --fingerprint bar@example.org