How to compute a public key fingerprint in PHP

1<?php
2/** SHA-256 over the DER SubjectPublicKeyInfo of a public key, private key or certificate. */
3function spkiFingerprint(OpenSSLAsymmetricKey $key): string
4{
5    $pem = openssl_pkey_get_details($key)['key']; // SPKI PEM, re-encoded by OpenSSL
6    $der = base64_decode(preg_replace('/-----[^-]+-----|\s+/', '', $pem), true);
7    return hash('sha256', $der, true); // raw 32 bytes
8}
9 

1<?php
2require 'spki-fingerprint.php';
3 
4$key = openssl_pkey_get_public(file_get_contents('pub.pem'));
5if ($key === false) {
6    throw new RuntimeException('not a public key: ' . openssl_error_string());
7}
8$digest = spkiFingerprint($key);
9 
10echo implode(':', str_split(bin2hex($digest), 2)), "\n"; // the layout of openssl dgst -c
11echo base64_encode($digest), "\n"; // pin-sha256 (RFC 7469)
12 

1<?php
2require 'spki-fingerprint.php';
3 
4// The key inside a certificate — not openssl_x509_fingerprint(), which hashes the whole certificate
5$cert = openssl_x509_read(file_get_contents('cert.pem'));
6echo 'certificate key: ', bin2hex(spkiFingerprint(openssl_pkey_get_public($cert))), "\n";
7echo 'certificate itself: ', openssl_x509_fingerprint($cert, 'sha256'), "\n";
8 

How it works

1. openssl_pkey_get_details($key)['key'] re-encodes any key — public, private or taken from a certificate — as SPKI PEM, so one function covers every input.
2. Stripping the armor lines and whitespace and decoding with base64_decode(..., true) (strict mode) yields the 91-byte SPKI DER of a P-256 key.
3. hash('sha256', $der, true) returns the raw digest; bin2hex with str_split gives the openssl dgst -c layout, base64_encode the pin-sha256 form.
4. The run compares both the key's and the certificate key's digests with openssl ... -outform DER | openssl dgst -sha256.

Gotchas

• openssl_x509_fingerprint hashes the whole certificate — a different value (54:7a:73:… for the example versus 3d:bb:28:… for its key) that changes on every renewal. Pinning needs the key fingerprint.
• Hashing file_get_contents('pub.pem') hashes PEM text, line endings included; only the DER inside is canonical across tools.
• hash('sha256', $der) without true returns hex text; base64-encoding that text produces an 88-character string, twice as long as a real 44-character pin, that matches nothing.
• OpenSSH fingerprints (SHA256:… from ssh-keygen -lf) hash the SSH encoding of the key and never equal the SPKI value.

Related recipes

• How to export a public key as PEM in PHP
• How to decode an X.509 certificate in PHP
• How to compute a public key fingerprint in Python
• How to compute a public key fingerprint with OpenSSL