Retrieving SHA256 thumbprint (fingerprint) for SAML SSO Certificates

Question

The fingerprint for SAML-based sign-on for enterprise applications is currently only displayed in SHA1. Even when the signing algorithm is chanbed to SHA256 or it is SHA256 when a New Certificate is created, the thumbprint doesn't change and always remains as SHA1.

Having the fingerprint displayed in the selected signing algorithm would be extremely helpful -so if MS is reading, please do this!

Generate Your Own SHA256 Fingerprint from Certificate:

1. Download the certificate in Base64 format from the ellipses menu.
2. Visit www.samltool.com/fingerprint.php and paste in your X.509 cert.
3. Choose SHA1 and calculate, match the calcuated fingerpring with the AD thumbprint.
4. Then recalculate in SHA256, this is your SHA256 thumbprint.
5. Use the resulting SHA256 thumbprint (fingerprint) in your app.

Answer 1

@cyberScotty

Thank you for your post and I'm glad that you were able to resolve your issue!

From your issue, I understand that the fingerprint of the SAML based certificate is only displayed in SHA1, even when changing or creating a new certificate with the Certificate signing algorithm set to SHA256.

• Related issue - https://github.com/MicrosoftDocs/azure-docs/issues/11624

Note: The thumbprint is used to identify the certificate and it is not related to the signing algorithm.

I've reached out to our SAML team to see if they can share any inputs on this limitation within the Portal, and I've also created an internal feature request so our engineering team can look into implementing this.

Thank you!