Get a Website SHA-1 Certificate Fingerprint
You can use OpenSSL to retrieve the SHA-1 fingerprint of a website's SSL/TLS certificate.
Using OpenSSL
Run:
echo | openssl s_client -connect bakadur.com:443 -servername bakadur.com 2>/dev/null \
| openssl x509 -noout -fingerprint -sha1
Example output:
sha1 Fingerprint=AA:BB:CC:DD:EE:FF:...
Replace:
bakadur.com
with the domain you want to check.
For example:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -fingerprint -sha1
What the command does
openssl s_client connects to the HTTPS server and retrieves its certificate.
The -servername option sends the correct SNI hostname, which is important when multiple websites are hosted on the same server.
The certificate is then passed to:
openssl x509 -noout -fingerprint -sha1
which prints its SHA-1 certificate fingerprint.
SHA-256 Fingerprint
For newer systems, SHA-256 is generally preferred:
echo | openssl s_client -connect bakadur.com:443 -servername bakadur.com 2>/dev/null \
| openssl x509 -noout -fingerprint -sha256
Use SHA-1 only when the service or application specifically requires a SHA-1 certificate fingerprint.