Getting thumbprint for X.509 certificate in keystore

[Michael255]

Hi,

I am trying to get a SHA-1 thumbprint of private key in a PKC12 key store. I am finding that my call to GlideCertificateEncryption's method getThumbPrintFromKeystore fails silently and due to the fairly light documentation I cannot tell what is happening. I cannot see any log messages being generated.

Is anyone able to steer me in the correct direction to figuring it out?

var cert = new GlideCertificateEncryption();
var certalias = "le-webserverwithpk-0bf4a773-2b1e-4747-a3e8-af8b62d63ab9";
var certID = "709c6defdb4e7b009e0333f43a961933";
var thumbprint = cert.getThumbPrintFromKeystore(certID, certalias, "SHA-1");

------------------------

keytool -v -list -storetype pkcs12 -keystore file.pfx

Enter keystore password:
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: le-webserverwithpk-0bf4a773-2b1e-4747-a3e8-af8b62d63ab9
Creation date: 24 Jun. 2019

...
...
etc

[Michael255 · Accepted solution]

I had to work around the issue, by having two entries for the key in sys_certificate

1) One in PEM format for reading the thumbprint

2) One as a Java Key Store that I imported the PKCS12 formatted cert into

I could not get signing to work with the PKCS12 file either, potentially due to my own ignorance, but without error messages it is hard to tell. Once imported into a JKS file signing silently started working.

Here are some useful commands with the openssl tools at the command line:

convert PKCS12 to pem

> openssl pkcs12 -in file.pfx -out file.pem -nodes

create a JKS keystore with your PKCS12 cert in it:

> keytool -importkeystore -srckeystore file.pfx -srcstoretype PKCS12 -destkeystore keystore.jks

list the keys and their details that are in a JKS keystore:

> keytool -v -list -storetype jks -keystore keystore.jks

[woodyfairley]

Thank you for this helpful guidance. I too am trying to implement e-signing with certificates and the documentation and code samples are not available through ServiceNow documentation. I am attempting to read the certificate from a CAC storage device on the client through middle ware and I see the command sign (opens in new window) but nothing else. I've activated the "approval with e-signature" plugin and it does not even show up in global search results. This is very important in our processes, so it is quite disappointing that customers get this functionality by attaching a pdf file to an email, but I am unable to deliver it within the ServiceNow environment. I realize that I am still learning to develop in this environment, but I do not like admitting that the documentation does not exist.

I am grateful for your willingness to contribute documentation to this forum for developers like me, thank you.

Kind Regards,

Woody