AWS IAM OIDC Thumbprint & X.509 Fingerprint Calculator

What does the AWS IAM OIDC Thumbprint & X.509 Fingerprint Calculator do?

The AWS IAM OIDC Thumbprint Calculator extracts and calculates 40-character lowercase hexadecimal SHA-1 thumbprints from OpenID Connect (OIDC) identity provider endpoints (such as GitHub Actions, GitLab CI/CD, and Google Cloud Workload Identity) as well as direct X.509 PEM certificates. It also calculates SHA-256 and MD5 certificate fingerprints for Terraform aws_iam_openid_connect_provider resources.

Core Concepts

Understanding why AWS IAM requires root CA thumbprints:

• Zero Secrets Authentication: OIDC federation replaces long-lived, static AWS access keys in CI/CD repositories with short-lived OpenID Connect JWT tokens.
• Root CA Thumbprint Pinning: When configuring an OIDC provider in AWS IAM, AWS requires the SHA-1 digest of the top Certificate Authority (CA) that signed the provider's server certificate. AWS validates inbound token signatures against this pinned fingerprint.
• X.509 PEM Fingerprints: Calculates SHA-1, SHA-256, and MD5 hashes across DER-encoded certificate payloads.

How to use the tool?

1. Select Provider or Input:
   • Choose a preset (GitHub Actions, GitLab CI, or Google Cloud), or enter an OIDC Issuer URL.
   • Alternatively, switch to the Direct X.509 PEM Certificate tab and paste certificate text.
2. Calculate Thumbprint: Click Calculate AWS OIDC Thumbprint to compute the 40-character SHA-1 hash.
3. Copy & Deploy: Click Copy next to the AWS OIDC Thumbprint and paste it into your Terraform thumbprint_list or AWS Console configuration.

Related Developer Utilities

If you work with AWS IAM configurations, CloudFormation, and security credentials, explore these complementary tools:

• AWS IAM Policy Minifier: Compress IAM policies and fix 6,144 character quota errors.
• cURL to AWS SigV4 Converter: Convert HTTP requests into AWS Signature Version 4 headers.
• AWS Cron Generator: Build 6-field EventBridge and CloudWatch cron expressions.
• AWS IP Ranges Search: Search official AWS IP ranges and generate security groups.

REST API Integration

Blueutils provides a free REST API endpoint (POST https://blueutils.com/api/aws/aws-oidc-thumbprint) to programmatically calculate AWS IAM-compliant 40-character SHA-1 thumbprints for OIDC Identity Providers and compute SHA-256 / MD5 fingerprints from X.509 PEM certificates.

API Request Parameters

API Request Payload Examples

cURL

curl -X POST https://blueutils.com/api/aws/aws-oidc-thumbprint \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "url",
    "targetUrl": "https://token.actions.githubusercontent.com"
  }'

Python

import requests

url = "https://blueutils.com/api/aws/aws-oidc-thumbprint"
payload = {
    "mode": "url",
    "targetUrl": "https://token.actions.githubusercontent.com"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.json())

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String jsonPayload = """
            {
                "mode": "url",
                "targetUrl": "https://token.actions.githubusercontent.com"
            }
            """;

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://blueutils.com/api/aws/aws-oidc-thumbprint"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API Response Parameters

API Response Payload Examples

Success Response (HTTP 200 OK)

{
  "isValid": true,
  "host": "token.actions.githubusercontent.com",
  "port": 443,
  "presetName": "GitHub Actions",
  "awsOidcThumbprint": "6938fd4d98bab03faadb97b34396831e3780aea1",
  "sha1": {
    "rawHex": "6938fd4d98bab03faadb97b34396831e3780aea1",
    "colonSeparated": "69:38:FD:4D:98:BA:B0:3F:AA:DB:97:B3:43:96:83:1E:37:80:AE:A1"
  },
  "source": "Verified Cloud Identity Preset"
}

Validation Failure Response (HTTP 400 Bad Request)

{
  "isValid": false,
  "error": "OIDC URL or hostname cannot be empty."
}

Rate Limit Exceeded Response (HTTP 429 Too Many Requests)

{
  "error": "API rate limit exceeded. Please wait or contact support@blueutils.com."
}

Why use an API to calculate AWS OIDC thumbprints?

Integrating the AWS OIDC Thumbprint API into infrastructure provisioning pipelines, Terraform CI/CD jobs, or cross-cloud setup scripts provides key benefits:

• Rapid Script Validation: Dynamically resolves TLS root CA thumbprints when creating AWS IAM OIDC providers across various Git providers.
• Optimized Token Efficiency for AI Agents: Eliminates the need for LLMs to generate complex OpenSSL bash commands. Invoking the API returns the exact 40-character hex thumbprint instantly.
• Deterministic Accuracy Without Hallucinations: Ensures 100% compliant SHA-1 DER calculation against official X.509 specifications.

Native Usage

How to calculate AWS OIDC thumbprints locally in terminal environments or scripts:

Windows (CMD / PowerShell)

# Extract certificate thumbprint using .NET in PowerShell
$hostName = "token.actions.githubusercontent.com"
$tcp = New-Object System.Net.Sockets.TcpClient($hostName, 443)
$ssl = New-Object System.Net.Security.SslStream($tcp.GetStream())
$ssl.AuthenticateAsClient($hostName)
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($ssl.RemoteCertificate)
$thumbprint = $cert.Thumbprint.ToLower()
Write-Output "OIDC Thumbprint: $thumbprint"
$tcp.Close()

Linux / Unix (Bash)

# Using OpenSSL pipeline to extract root SHA-1 thumbprint
HOST="token.actions.githubusercontent.com"
echo | openssl s_client -servername $HOST -showcerts -connect $HOST:443 2>/dev/null \
  | sed -n -e '/BEGIN/h' -e '/BEGIN/,/END/H' -e '$x' -e '$p' | tail +2 \
  | openssl x509 -fingerprint -noout \
  | sed -e "s/.*=//" -e "s/://g" \
  | tr "[:upper:]" "[:lower:]"

Python

Using Python ssl and cryptography:

import ssl
import hashlib
from urllib.parse import urlparse

host = "token.actions.githubusercontent.com"
port = 443

cert_der = ssl.get_server_certificate((host, port)).encode('utf-8')
# Strip PEM markers
clean_b64 = b"".join([line for line in cert_der.split(b"\n") if not line.startswith(b"-----")])
import base64
raw_der = base64.b64decode(clean_b64)

thumbprint = hashlib.sha1(raw_der).hexdigest().lower()
print(f"OIDC Thumbprint: {thumbprint}")

Java

Using Java SSLContext and MessageDigest:

import java.security.MessageDigest;
import java.security.cert.Certificate;
import javax.net.ssl.HttpsURLConnection;
import java.net.URL;

public class OidcThumbprintExample {
    public static void main(String[] args) throws Exception {
        URL url = new URL("https://token.actions.githubusercontent.com");
        HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
        conn.connect();

        Certificate[] certs = conn.getServerCertificates();
        Certificate rootCert = certs[certs.length - 1];

        MessageDigest sha1 = MessageDigest.getInstance("SHA-1");
        byte[] digest = sha1.digest(rootCert.getEncoded());

        StringBuilder sb = new StringBuilder();
        for (byte b : digest) sb.append(String.format("%02x", b));
        System.out.println("AWS OIDC Thumbprint: " + sb.toString());
        conn.disconnect();
    }
}