A certificate fingerprint is not the subject name

The fingerprint identifies the certificate

A fingerprint command hashes the certificate encoding and prints the digest. That digest changes if the certificate bytes change. It is how you tell two files apart when both claim a similar name.

The algorithm on the fingerprint matters. A SHA-256 fingerprint and a SHA-1 fingerprint of the same certificate are different strings. Write the algorithm with the hex.

The name is a field

The subject common name, and the subject alternative names, are fields in the certificate. They are what a verifier compares to a hostname when it is doing that check. They are not the fingerprint. A matching name does not mean a matching fingerprint.

If you did not print the names, write “subject not in the note.” Do not reconstruct a name from a filename.

What to write down

File the fingerprint algorithm, the fingerprint, and the subject or SAN you actually printed. If two files share a name, file both fingerprints and do not merge them.

Lab: two lab certificates with one name

lab-a.pem and lab-b.pem both show a subject name lab.example. Their SHA-256 fingerprints differ. A draft says they are the same certificate because the name matches, and keeps only the first fingerprint.

The note lists both filenames and both fingerprints. The shared name is a field on each. They are two certificates. The second fingerprint is not dropped.

lab-a.pem  subject: lab.example  SHA-256 fingerprint: value A
lab-b.pem  subject: lab.example  SHA-256 fingerprint: value B
A and B differ
write: two certificates
not: one certificate because the name matches