Re: usercertificate attribute fingerprint (possibly OT)

> On 17 May 2015, at 16:10, Natxo Asenjo <[email protected]> wrote:
>=20
> hi,
>=20
> connecting to a freeipa ldap host (that uses the 389 directory server =
under the hood) I can successfully retrieve certificates belonging to =
hosts.
>=20
> I can then use Crypt::X509 to extract info from that. But how could I =
get the fingerprints? If I use the apache directory studio ldap client I =
can see the md5 and sha1 fingerprints of the attribute but I seem =
uncapable of getting it using my script.
>=20
> my $ldap =3D Net::LDAP->new( $server ) or die "$@";
>=20
> my $mesg =3D $ldap->start_tls(
>     verify =3D> 'require',
>     sslversion =3D> 'tlsv1',
> );
>=20
> $mesg =3D $ldap->bind (
>     "testuser",
>      password    =3D> 'pwd',
>      version     =3D> 3,
> );
>=20
> my $search =3D $ldap->search(
>                         base    =3D> $base,
>                         scope   =3D> 'sub',
>                         filter  =3D> '(objectclass=3D*)',
>                         attr    =3D> ['usercertificate'],
>                     );
>=20
>=20
> for my $entry ( $search->entries) {
>     my $cert =3D  $entry->get_value( 'usercertificate' );;
>     my $decoded =3D Crypt::X509->new ( cert =3D> $cert );
>     if ( $decoded->error ) {
>         warn "Error parsing certificate: ", $decoded->error;
>     }
>     print "Subject: " . $decoded->subject_cn, "\n";=20
>     print "notafter: " . gmtime( $decoded->not_after) , "\n";
> }
>=20
> So this works, but I see no method to get the fingerprint. Is there a =
way to get it from the info I get from ldap?

This code uses Net::SSLeay to extract a fingerprint from something like =
your $cert.

=
http://cpansearch.perl.org/src/MIKEM/Net-SSLeay-1.46/examples/x509_cert_de=
tails.pl

Chris=