How to compute a public key fingerprint with OpenSSL

1openssl pkey -pubin -in pub.pem -outform DER | openssl dgst -sha256 -c
2# SHA2-256(stdin)= 21:2c:...:9d

1# private key: derive the public half in the same pipe
2openssl pkey -in key.pem -pubout -outform DER | openssl dgst -sha256 -c
3 
4# certificate: extract the key first (NOT the same as -fingerprint!)
5openssl x509 -in cert.pem -pubkey -noout \
6  | openssl pkey -pubin -outform DER | openssl dgst -sha256 -c

1openssl pkey -pubin -in pub.pem -outform DER \
2  | openssl dgst -sha256 -binary | openssl base64

How it works

1. -outform DER is the crucial flag: it re-encodes the key as canonical binary SPKI, so every tool hashing the same key gets the same digest.
2. dgst -c prints colon-separated hex; -binary | base64 produces the pin-sha256 form used in HTTP public key pinning.
3. The certificate variant pipes through pkey deliberately — it normalizes the extracted PEM back to DER before hashing.

Gotchas

• openssl dgst -sha256 pub.pem hashes the PEM *text* — line endings and wrapping included — and matches nothing computed from DER. The -outform DER pipe is not optional.
• openssl x509 -fingerprint -sha256 is the *certificate* fingerprint (hash of the entire cert), which changes on every renewal; the key fingerprint from this recipe survives re-issue with the same key.
• Newer OpenSSL prints the digest labeled SHA2-256(stdin)=; older builds say SHA256(stdin)=. Scripts that match the prefix textually break across versions — parse the hex after = instead.

Related recipes

• How to export a public key as PEM with OpenSSL
• How to decode an X.509 certificate with OpenSSL
• How to generate an ECDSA key pair with OpenSSL