◐ Shell
clean mode source ↗

X509Certificate GetCertHash and GetCertHashString with SHA256

As the current implementation uses SHA1 for calculating X509 hashes and SHA1 can't be considered safe anymore the hash calculation should be updated to SHA256. E.G.:

X509Certificate cert = new X509Certificate("mycert.pxf");
byte[] b = cert. GetCertHash256()
string s = cert. GetCertHashString256()

Alternatively, a variable hashing algorithm as function parameter would be desirable for future hashing methods.
A use case is the ssl certificate validation on IoT devices to prevent man-in-the-middle attacks. Many IoTs connect to a web api via ssl and thus, should validate the server’s certificate. With limited compute power on the device the certificate’s thumbprint can be verified much cheaper than the whole chain of certificates.
For example, the validation of a server certificate can be done with python on a Raspberry:

import ssl
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes

thumbprint = 'e959fd5c80f76df7a593aae09686e604f74be8b0'
pem = ssl.get_server_certificate( (host, port) )
certx509 = x509.load_pem_x509_certificate(str.encode(pem), default_backend())
tp = certx509.fingerprint(hashes.SHA256())
tpHex = ''.join('{:02x}'.format(x) for x in tp)
if tpHex != thumbprint:
	print(‘Validation failed’)