cert: add fingerprint helper

for usage in pve-cluster's certificate cache.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index 5ab920f24869a4aff5cc7920232445a961e5d62b..2421f3f1574368b26b0df28486826d763faffe99 100644 (file)
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -216,6 +216,20 @@ sub convert_asn1_to_epoch {
     return Date::Parse::str2time($iso_time);
 }
 
     return Date::Parse::str2time($iso_time);
 }
 

+sub get_certificate_fingerprint {
+    my ($cert_path) = @_;
+
+    my $cert = $read_certificate->($cert_path);
+
+    my $fp = Net::SSLeay::X509_get_fingerprint($cert, 'sha256');
+    Net::SSLeay::X509_free($cert);
+
+    die "unable to get fingerprint for '$cert_path' - got empty value\n"
+       if !defined($fp) || $fp eq '';
+
+    return $fp;
+}
+

 sub get_certificate_info {
     my ($cert_path) = @_;
 
 sub get_certificate_info {
     my ($cert_path) = @_;