How to determine the hashing algorithm of a public key in the certificate

Question

I’ve been looking at an SSL/TLS certificate and would like to know which hashing algorithm is being used for the public key. How can I determine this? Is there a command or method in OpenSSL or any other tool that can give me the specific hashing algorithm used to sign the certificate?

CaLLmeDaDDY · Answer 1 · Jan 8

To determine the hashing algorithm used to sign an SSL/TLS certificate, you can utilize OpenSSL, a widely used toolkit for Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.

Using OpenSSL to Check the Signature Algorithm

Obtain the Certificate
- If you have the certificate file (e.g., certificate.crt), you can proceed to the next step.
- If you need to retrieve the certificate from a remote server, you can use the following OpenSSL command:
```
openssl s_client -connect [hostname]:443 -showcerts
```
  Replace [hostname] with the domain name of the server. This command will display the server's certificate chain.
Inspect the Certificate
- Once you have the certificate file, use the following command to display its details:
```
openssl x509 -in certificate.crt -noout -text
```
  This command outputs the certificate's information in a human-readable format.
Locate the Signature Algorithm
- In the output, look for the Signature Algorithm field. This line indicates the algorithm used to sign the certificate. For example:
```
Signature Algorithm: sha256WithRSAEncryption
```
  In this example, the certificate is signed using the SHA-256 hashing algorithm combined with RSA encryption.

Understanding the Output

The Signature Algorithm field specifies the algorithm used to sign the certificate.
The part before the With (e.g., sha256) indicates the hashing algorithm.
The part after the With (e.g., RSAEncryption) indicates the encryption algorithm used.

Example

If the output includes:

Signature Algorithm: sha256WithRSAEncryption

This means the certificate is signed using the SHA-256 hashing algorithm with RSA encryption.

Additional Notes

If you encounter a certificate in DER format (binary), you can convert it to PEM format (text) using:
```
openssl x509 -in certificate.der -inform DER -out certificate.pem -outform PEM
```
For certificates in PKCS#12 format (e.g., .p12 or .pfx), extract the certificate using:
```
openssl pkcs12 -in certificate.p12 -clcerts -nokeys -out certificate.crt
```

By following these steps, you can determine the hashing algorithm used to sign an SSL/TLS certificate, which is crucial for assessing the security strength of the certificate.