How to use SHA256 instead of SHA1 for Azure App Registration Thumbprint?

Question

How to use SHA256 instead of SHA1 for Azure App Registration Thumbprint?

Alexander Kuppek 1

When using a X.509 Certificate for authenticate an Azure App Registration, SHA1 thumbprint needs to be used. But in the documentation on how to generate the assertion it says x5t header needs to use SHA256:

https://learn.microsoft.com/en-us/entra/identity-platform/certificate-credentials#assertion-format

So when using a Base64 encoded SHA256 thumbprint authentication is not working an throws following error:

AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application. [Reason - The key was not found.

When using SHA1 thumbprint it works.

I also noticed the documentation for x5t header was adjusted a few month ago where SHA1 was changed to SHA256:

https://github.com/MicrosoftDocs/entra-docs/commit/f46b30295d2ec10db0f9462349812de366b3ab18

I think it should be clearly mentioned in the documentation that for some assertions SHA1 still needs to be used!

Sakshi Devkante 2,905 Reputation points Microsoft External Staff

2025-04-08T12:29:54.1866667+00:00

Hello @Alexander Kuppek

Can you confirm if you are using the same SHA256 certificate uploaded on application side as well when you are testing?

The documentation you referenced updated the x5t (certificate thumbprint) header to use SHA256 for hashing, aligning with modern security standards, given that SHA1 is considered weak and deprecated. As you discovered, SHA1 thumbprints still work in practice for many authentication scenarios, particularly in App Registrations. It looks like for now, using the SHA1 thumbprint remains the working solution.

If SHA256 is required for your specific use case then did you refer to the steps mentioned by one of our colleagues on the below Q&A posts, he has shared the PowerShell script about the same. This is based on the error "Key was not found" is generated when client who uses cert needs to include x5t property when getting a token.

https://learn.microsoft.com/en-us/answers/questions/346048/how-to-get-access-token-from-client-certificate-ca.html#:~:text=Access%20token%20request%20with%20a%20certificate%20is%20a%20bit%20different%20from%20the%20normal%20Access%20token%20request%20with%20a%20shared%20secret%20flow%20(using%20AppId/Secret%20).%20To%20get%20an%20access%20token%20using%20a%20certificate%20you%20have%20to%3A

https://learn.microsoft.com/en-us/answers/questions/882005/aadsts700027-client-assertion-failed-signature-val.html#:~:text=could%20cause%20the%20%22AADSTS700027%3A%20Client%20assertion%20contains%20an%20invalid%20signature.
Venkata Jagadeep 1,005 Reputation points Microsoft External Staff

2025-04-09T10:35:04.9733333+00:00

Hello Alexander Kuppek,

Did you get a chance to review the inputs provided by Sakshi in the previous comment.

Please let me know if you have any questions.
Venkata Jagadeep 1,005 Reputation points Microsoft External Staff

2025-04-11T11:31:54.2566667+00:00

Hello Alexander Kuppek,

Just to followup on this thread, let us know if you get the additional information for your query? Please let me know if you have any additional queries.

Your answer

Sakshi Devkante 2,905 Reputation points Microsoft External Staff

2025-04-08T12:29:54.1866667+00:00

Hello @Alexander Kuppek

Can you confirm if you are using the same SHA256 certificate uploaded on application side as well when you are testing?

The documentation you referenced updated the x5t (certificate thumbprint) header to use SHA256 for hashing, aligning with modern security standards, given that SHA1 is considered weak and deprecated. As you discovered, SHA1 thumbprints still work in practice for many authentication scenarios, particularly in App Registrations. It looks like for now, using the SHA1 thumbprint remains the working solution.

If SHA256 is required for your specific use case then did you refer to the steps mentioned by one of our colleagues on the below Q&A posts, he has shared the PowerShell script about the same. This is based on the error "Key was not found" is generated when client who uses cert needs to include x5t property when getting a token.

https://learn.microsoft.com/en-us/answers/questions/346048/how-to-get-access-token-from-client-certificate-ca.html#:~:text=Access%20token%20request%20with%20a%20certificate%20is%20a%20bit%20different%20from%20the%20normal%20Access%20token%20request%20with%20a%20shared%20secret%20flow%20(using%20AppId/Secret%20).%20To%20get%20an%20access%20token%20using%20a%20certificate%20you%20have%20to%3A

https://learn.microsoft.com/en-us/answers/questions/882005/aadsts700027-client-assertion-failed-signature-val.html#:~:text=could%20cause%20the%20%22AADSTS700027%3A%20Client%20assertion%20contains%20an%20invalid%20signature.
Venkata Jagadeep 1,005 Reputation points Microsoft External Staff

2025-04-09T10:35:04.9733333+00:00

Hello Alexander Kuppek,

Did you get a chance to review the inputs provided by Sakshi in the previous comment.

Please let me know if you have any questions.
Venkata Jagadeep 1,005 Reputation points Microsoft External Staff

2025-04-11T11:31:54.2566667+00:00

Hello Alexander Kuppek,

Just to followup on this thread, let us know if you get the additional information for your query? Please let me know if you have any additional queries.

Share via

How to use SHA256 instead of SHA1 for Azure App Registration Thumbprint?

Your answer