Certificate Transparency & SPKI Fingerprinting

Updated 13 Sep 2026

• •

  What it is

  • •

    Since 2018, Chrome has enforced Certificate Transparency: every CA must publish each certificate it issues to public, append-only logs, searchable via services like crt.sh or censys.io. This exists because CAs occasionally issue fraudulent or unauthorized certificates, and transparency logs make that discoverable. Certificates (and even bare public keys) can be located in these logs by their SHA-256 SPKI fingerprint — the hash of the DER-encoded Subject Public Key Info.

• •

  When to apply

  • •

    You're given a public key (not a full certificate) and asked to identify the real-world domain/certificate that uses it.

• •

  Worked example

  • •

    openssl pkey -pubin -in key.pem -outform der | sha256sum gives a fingerprint you can search directly at crt.sh/?spkisha256=<fingerprint>.

• •

  Python

  • •

    import hashlib
    from Crypto.PublicKey import RSA
    der = RSA.import_key(open("key.pem").read()).publickey().export_key(format="DER")
    fingerprint = hashlib.sha256(der).hexdigest()
    

• •

  Related

  • •

    X.509 Certificate

• •

  Cards

  • •

    What does an SPKI fingerprint hash?

    • •

      The DER-encoded Subject Public Key Info (the public key), not the whole certificate.

  • •

    What's one public service for searching Certificate Transparency logs?

    • •

      crt.sh (or censys.io).

◌ Explore connections in Graph view