usercertificate attribute fingerprint (possibly OT)

--089e01493d443e694c0516487ba6
Content-Type: text/plain; charset=UTF-8

hi,

connecting to a freeipa ldap host (that uses the 389 directory server under
the hood) I can successfully retrieve certificates belonging to hosts.

I can then use Crypt::X509 to extract info from that. But how could I get
the fingerprints? If I use the apache directory studio ldap client I can
see the md5 and sha1 fingerprints of the attribute but I seem uncapable of
getting it using my script.

my $ldap = Net::LDAP->new( $server ) or die "$@";

my $mesg = $ldap->start_tls(
    verify => 'require',
    sslversion => 'tlsv1',
);

$mesg = $ldap->bind (
    "testuser",
     password    => 'pwd',
     version     => 3,
);

my $search = $ldap->search(
                        base    => $base,
                        scope   => 'sub',
                        filter  => '(objectclass=*)',
                        attr    => ['usercertificate'],
                    );


for my $entry ( $search->entries) {
    my $cert =  $entry->get_value( 'usercertificate' );;
    my $decoded = Crypt::X509->new ( cert => $cert );
    if ( $decoded->error ) {
        warn "Error parsing certificate: ", $decoded->error;
    }
    print "Subject: " . $decoded->subject_cn, "\n";
    print "notafter: " . gmtime( $decoded->not_after) , "\n";
}

So this works, but I see no method to get the fingerprint. Is there a way
to get it from the info I get from ldap?

Thanks for any pointers.

--
Groeten,
natxo

--089e01493d443e694c0516487ba6
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div><div>hi,<br><br></div>connecting to a freei=
pa ldap host (that uses the 389 directory server under the hood) I can succ=
essfully retrieve certificates belonging to hosts.<br><br></div>I can then =
use Crypt::X509 to extract info from that. But how could I get the fingerpr=
ints? If I use the apache directory studio ldap client I can see the md5 an=
d sha1 fingerprints of the attribute but I seem uncapable of getting it usi=
ng my script.<br><br>my $ldap =3D Net::LDAP-&gt;new( $server ) or die &quot=
;$@&quot;;<br><br>my $mesg =3D $ldap-&gt;start_tls(<br>=C2=A0=C2=A0=C2=A0 v=
erify =3D&gt; &#39;require&#39;,<br>=C2=A0=C2=A0=C2=A0 sslversion =3D&gt; &=
#39;tlsv1&#39;,<br>);<br><br>$mesg =3D $ldap-&gt;bind (<br>=C2=A0=C2=A0=C2=
=A0 &quot;testuser&quot;,<br>=C2=A0=C2=A0=C2=A0=C2=A0 password=C2=A0=C2=A0=
=C2=A0 =3D&gt; &#39;pwd&#39;,<br>=C2=A0=C2=A0=C2=A0=C2=A0 version=C2=A0=C2=
=A0=C2=A0=C2=A0 =3D&gt; 3,<br>);<br><br>my $search =3D $ldap-&gt;search(<br=
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 base=C2=
=A0=C2=A0=C2=A0 =3D&gt; $base,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 scope=C2=A0=C2=A0 =3D&gt; &#39;sub&#39;,<br>=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 filter=C2=A0 =3D&=
gt; &#39;(objectclass=3D*)&#39;,<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 attr=C2=A0=C2=A0=C2=A0 =3D&gt; [&#39;usercertifica=
te&#39;],<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 );<br><br><br>for my=
 $entry ( $search-&gt;entries) {<br>=C2=A0=C2=A0=C2=A0 my $cert =3D=C2=A0 $=
entry-&gt;get_value( &#39;usercertificate&#39; );;<br>=C2=A0=C2=A0=C2=A0 my=
 $decoded =3D Crypt::X509-&gt;new ( cert =3D&gt; $cert );<br>=C2=A0=C2=A0=
=C2=A0 if ( $decoded-&gt;error ) {<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 warn &quot;Error parsing certificate: &quot;, $decoded-&gt;error;<br=
>=C2=A0=C2=A0=C2=A0 }<br>=C2=A0=C2=A0=C2=A0 print &quot;Subject: &quot; . $=
decoded-&gt;subject_cn, &quot;\n&quot;; <br>=C2=A0=C2=A0=C2=A0 print &quot;=
notafter: &quot; . gmtime( $decoded-&gt;not_after) , &quot;\n&quot;;<br>}<b=
r><br></div>So this works, but I see no method to get the fingerprint. Is t=
here a way to get it from the info I get from ldap?<br><br></div>Thanks for=
 any pointers.<br><div><div><div><div><div><div>=C2=A0<br><div class=3D"gma=
il_signature">--<br>Groeten,<br>natxo</div>
</div></div></div></div></div></div></div>

--089e01493d443e694c0516487ba6--