Certificate - Digital fingerprint vs Signature

Question

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ?

I understand the certificate signature section, but I can’t see the point with the fingerprint section.

Answer 1

The "fingerprint" (or "thumbprint") is NOT a part of a certificate. It is computed by some software (e.g. Windows) as a hash of the complete certificate (including the signature).

The point of the thumbprint is to serve as a human-manageable identifier for the certificate. For instance, when you import a certificate in the "trusted root" store of a Windows system, a popup appears that displays the thumbprint of the certificate, and asks you to check whether this is the right value. The user who is importing that certificate is then supposed to check the thumbprint against a reference value (e.g. a signed paper document that was provided by the CA sysadmin); comparing two 40-character hexadecimal values is not the summit of user interface conviviality, but it is still a lot more doable than checking the 2000-character hexadecimal encoding of a complete certificate.

The point of such a check is to make sure that what is imported is the genuine root CA certificate, not a fake one that was substituted by a malicious attacker. Thanks to the thumbprint-checking, how the certificate was transported becomes irrelevant (e.g. it could be sent over plain HTTP or even in an email).

Using the thumbprint in that way is safe as long as the thumbprint is computed with a cryptographic hash function that offers second-preimage resistance. As far as we know, this is still the case for SHA-1 (SHA-1 has known theoretical weaknesses with regards to collisions, but collisions are not relevant here).