How to compute a public key fingerprint in Rust

1[dependencies]
2p256 = { version = "=0.14.0", features = ["pem"] }
3sha2 = "=0.11.1"
4base64 = "=0.23.1"
5x509-parser = "=0.18.1"
6 

1use base64::Engine;
2use base64::engine::general_purpose::STANDARD;
3use p256::PublicKey;
4use p256::pkcs8::{DecodePublicKey, EncodePublicKey};
5use sha2::{Digest, Sha256};
6 
7fn main() -> Result<(), Box<dyn std::error::Error>> {
8    // parse first: a damaged file fails here instead of yielding a fingerprint of noise
9    let key = PublicKey::from_public_key_pem(&std::fs::read_to_string("pub.pem")?)?;
10    let spki = key.to_public_key_der()?; // canonical SPKI DER, 91 bytes for P-256
11 
12    let digest = Sha256::digest(spki.as_bytes());
13    let hex: Vec<String> = digest.iter().map(|b| format!("{b:02x}")).collect();
14    println!("{}", hex.join(":")); // the layout of openssl dgst -c
15    println!("{}", STANDARD.encode(digest)); // pin-sha256 (RFC 7469)
16    Ok(())
17}
18 

1// The key inside a certificate: hash its SubjectPublicKeyInfo, not the whole certificate
2let data = std::fs::read("cert.pem")?;
3let (_, pem) = x509_parser::pem::parse_x509_pem(&data)?;
4let cert = pem.parse_x509()?;
5let key_digest = Sha256::digest(cert.public_key().raw); // raw = the SPKI DER as it appears in the certificate
6println!("certificate key: {}", key_digest.iter().map(|b| format!("{b:02x}")).collect::<String>());
7