Obtain an OIDC IdP thumbprint with OpenSSL - Resource Access Management

Use OpenSSL to obtain the SSL/TLS certificate thumbprint of an OpenID Connect (OIDC) identity provider (IdP).

Prerequisites

OpenSSL is installed on your system. The following example uses Windows 10.

Install OpenSSL.
1. Download the installation package from Win32/Win64 OpenSSL.
2. Run the installer.
  
  Use the default installation path (C:\Program Files\OpenSSL-Win64).
Configure the environment variable.

On your desktop, right-click This PC and select Properties > Advanced system settings > Environment Variables > System variables. In the Path variable, add the path to the OpenSSL bin directory, for example, C:\Program Files\OpenSSL-Win64\bin.
Verify the installation.

Run the following command in a command prompt or PowerShell:
```
openssl version  
```
- If the output resembles the following, OpenSSL is installed:
```
OpenSSL 3.4.1 11 Feb 2025 
```
- If a "command not found" or "not recognized" error appears, verify that the x:\xxx\OpenSSL-Win64\bin directory is in the Path environment variable.

Procedure

The following steps use https://oauth.aliyun.com as an example. Replace it with your IdP domain name.

Step 1: Get the fully qualified domain name

Append /.well-known/openid-configuration to the IdP base URL. For example, for https://oauth.aliyun.com:
```
https://oauth.aliyun.com/.well-known/openid-configuration
```

Open the URL in a browser. In the returned JSON, find the jwks_uri field and extract the fully qualified domain name (FQDN). In this example, the FQDN is oauth.aliyun.com.

IdP configuration document

{
    "authorization_endpoint": "https://signin.aliyun.com/oauth2/v1/auth",
    "code_challenge_methods_supported": [
        "plain",
        "S256"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "issuer": "https://oauth.aliyun.com",
    //Fully qualified domain name: oauth.aliyun.com
    "jwks_uri": "https://oauth.aliyun.com/v1/keys",
    "requestid": "f7d3899f-5677-4634-a7dd-832818bb062a",
    "response_types_supported": [
        "code"
    ],
    "revocation_endpoint": "https://oauth.aliyun.com/v1/revoke",
    "scopes_supported": [
        "openid",
        "aliuid",
        "profile"
    ],
    "subject_types_supported": [
        "public"
    ],
    "token_endpoint": "https://oauth.aliyun.com/v1/token",
    "userinfo_endpoint": "https://oauth.aliyun.com/v1/userinfo"
}

Step 2: Get the certificate

Run the following command. Replace oauth.aliyun.com with the domain name obtained in Step 1.
```
openssl s_client -servername oauth.aliyun.com -showcerts -connect oauth.aliyun.com:443
```
In the output, locate the certificate block between the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. If multiple blocks appear, use the last one.
Note
A PEM certificate includes these boundary markers:
- Start marker: -----BEGIN CERTIFICATE-----.
- End marker: -----END CERTIFICATE-----.
```
-----BEGIN CERTIFICATE-----
MIIEaTCCA1GgAwIBAgILBAAAAAABRE7wQkcwDQYJKoZIhvcNAQELBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
···
-----END CERTIFICATE-----
```
Copy the last certificate block, including the boundary markers, and save it as a .crt file, for example, certificate.crt.
(Optional) Verify that the file is valid.

Run the following command. If certificate details appear without errors, the file is valid.
```
openssl x509 -in certificate.crt -text -noout
```

Step 3: Get the thumbprint

Run the following command:

openssl x509 -in certificate.crt -fingerprint -sha1 -noout

The output shows the SHA-1 thumbprint, labeled Fingerprint by OpenSSL.

SHA1 Fingerprint=90:2E:F2:DE:EB:3C:5B:13******

Remove all colons (:) from this value to get the final thumbprint.
```
902EF2DEEB3C5B13******
```