THUMBPRINT(7)

💖 THUMBPRINT(7) 💖

okay so bestie, welcome to THUMBPRINT(7) — the page about public key thumbprints, and honestly it’s giving “tiny file, big trust issues” energy 💅

✨ NAME ✨

thumbprint — public key thumbprints 🫶

🌸 DESCRIPTION 🌸

So Plan 9 applications that use public keys for authentication — like when they call tlsClient and okThumbprint (see pushtls(3)) — check the remote side’s public key by comparing it against thumbprints from a trusted list. No cap, that’s the whole vibe check 🔥

That trusted list is maintained by people who set local policies about which servers can be trusted for which applications. They’re basically playing the role taken by certificate authorities in PKI-based systems 👑 By convention, these lists are stored as files in /sys/lib/tls/ and protected by normal file system permissions. Periodt 🎀

A thumbprint file like this is made of lines that are attribute/value pairs, of the form attr=value or attr. The first attribute must be x509, and the second must be sha1={hexchecksumofbinarycertificate}. Order matters, bestie — no skipping the main character attributes 🙈

All the other attributes are treated as comments. The file may also contain lines of the form:

#includefile

For example, a web server might have thumbprint:

x509 sha1=8fe472d31b360a8303cd29f92bd734813cbd923c cn=*.cs.bell-labs.com

iconic. ate. no crumbs 🍓✨

🦋 SEE ALSO 🦋

• pushtls(3) — go read it, bestie, it’s right there 👀

that’s it, bestie — THUMBPRINT(7) from the Miscellaneous Information Manual, and the footer line in this copy is just THUMBPRINT(7) (no extra date shown here, periodt) 🎀💅