FAQ: Why Does a Certificate Show sha256 as Signature Algorithm but sha1 as Thumbprint Algorithm?

Version Affected: All

 

Overview

A certificate's Signature Algorithm can show sha256 while its Thumbprint Algorithm still shows sha1. Is this a problem?
 

Answer

No, this is expected behavior, not a defect.

The thumbprint is just a property attached to the certificate object -- a computed value used to make it easy to locate a particular certificate in a system's certificate store. It is not part of the certificate's actual data, and its algorithm is always SHA1, regardless of the certificate's own signature algorithm.

The signature algorithm, on the other hand, is part of the digital certificate itself, and is what's actually used to verify the certificate's signature. A certificate showing sha256 as its signature algorithm is using SHA-256 to verify the certificate, independent of whatever algorithm its thumbprint happens to use.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.