Obtain the thumbprint for an OpenID Connect identity provider

Before you can obtain the thumbprint for an OIDC IdP, you need to obtain the OpenSSL command line tool. You use this tool to download the OIDC IdP certificate chain and produce a thumbprint of the final certificate in the certificate chain. If you need to install and configure OpenSSL, follow the instructions at Install OpenSSL and Configure OpenSSL.

Start with the OIDC IdP URL (for example, https://server.example.com), and then add /.well-known/openid-configuration to form the URL for the IdP's configuration document, such as the following:

https://server.example.com/.well-known/openid-configuration

Open this URL in a web browser, replacing server.example.com with your IdP server name.

In the displayed document, use your web browser Find feature to locate the text "jwks_uri". Immediately following the text "jwks_uri", there is a colon (:) followed by a URL. Copy the fully qualified domain name of the URL. Do not include https:// or any path that comes after the top-level domain.

{
 "issuer": "https://accounts.example.com",
 "authorization_endpoint": "https://accounts.example.com/o/oauth2/v2/auth",
 "device_authorization_endpoint": "https://oauth2.exampleapis.com/device/code",
 "token_endpoint": "https://oauth2.exampleapis.com/token",
 "userinfo_endpoint": "https://openidconnect.exampleapis.com/v1/userinfo",
 "revocation_endpoint": "https://oauth2.exampleapis.com/revoke",
 "jwks_uri": "https://www.exampleapis.com/oauth2/v3/certs",
...
      

Use the OpenSSL command line tool to run the following command. Replace keys.example.com with the domain name you obtained in Step 3.

openssl s_client -servername keys.example.com -showcerts -connect keys.example.com:443

In your command window, scroll up until you see a certificate similar to the following example. If you see more than one certificate, find the last certificate displayed (at the end of the command output). This contains the certificate of the top intermediate CA in the certificate authority chain.

-----BEGIN CERTIFICATE-----
 MIICiTCCAfICCQD6m7oRw0uXOjANBgkqhkiG9w0BAQUFADCBiDELMAkGA1UEBhMC
 VVMxCzAJBgNVBAgTAldBMRAwDgYDVQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6
 b24xFDASBgNVBAsTC0lBTSBDb25zb2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAd
 BgkqhkiG9w0BCQEWEG5vb25lQGFtYXpvbi5jb20wHhcNMTEwNDI1MjA0NTIxWhcN
 MTIwNDI0MjA0NTIxWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAldBMRAwDgYD
 VQQHEwdTZWF0dGxlMQ8wDQYDVQQKEwZBbWF6b24xFDASBgNVBAsTC0lBTSBDb25z
 b2xlMRIwEAYDVQQDEwlUZXN0Q2lsYWMxHzAdBgkqhkiG9w0BCQEWEG5vb25lQGFt
 YXpvbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMaK0dn+a4GmWIWJ
 21uUSfwfEvySWtC2XADZ4nB+BLYgVIk60CpiwsZ3G93vUEIO3IyNoH/f0wYK8m9T
 rDHudUZg3qX4waLG5M43q7Wgc/MbQITxOUSQv7c7ugFFDzQGBzZswY6786m86gpE
 Ibb3OhjZnzcvQAaRHhdlQWIMm2nrAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAtCu4
 nUhVVxYUntneD9+h8Mg9q6q+auNKyExzyLwaxlAoo7TJHidbtS4J5iNmZgXL0Fkb
 FFBjvSfpJIlJ00zbhNYS5f6GuoEDmFJl0ZxBHjJnyp378OD8uTs7fLvjx79LjSTb
 NYiytVbZPQUQ5Yaxu2jXnimvw3rrszlaEXAMPLE=
 -----END CERTIFICATE-----

Copy the certificate (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines) and paste it into a text file. Then save the file with the file name certificate.crt.

Use the OpenSSL command line tool to run the following command.

openssl x509 -in certificate.crt -fingerprint -sha1 -noout

Your command window displays the certificate thumbprint, which looks similar to the following example:

SHA1 Fingerprint=99:0F:41:93:97:2F:2B:EC:F1:2D:DE:DA:52:37:F9:C9:52:F2:0D:9E

Remove the colon characters (:) from this string to produce the final thumbprint, like this:

990F4193972F2BECF12DDEDA5237F9C952F20D9E

If you are creating the IAM OIDC identity provider with the AWS CLI, Tools for Windows PowerShell, or the IAM API, providing a thumbprint is optional. If you choose not to include a thumbprint during creation, IAM will retrieve the top intermediate CA thumbprint of the OIDC IdP server certificate. After the IAM OIDC identity provider is created, you can compare this thumbprint to the thumbprint retrieved by IAM.

If you are creating the IAM OIDC identity provider in the IAM console, the console attempts to retrieve the top intermediate CA thumbprint of the OIDC IdP server certificate for you. You can compare this thumbprint to the thumbprint retrieved by IAM. After the IAM OIDC identity provider is created, you can view the thumbprint for the IAM OIDC identity provider in the Endpoint verification tab on the OIDC provider Summary console page.

Go to OpenSSL: Source, Tarballs (https://openssl.org/source/).

Download the latest source and build the package.

Go to OpenSSL: Binary Distributions (https://wiki.openssl.org/index.php/Binaries) for a list of sites from which you can install the Windows version.

Follow the instructions on your selected site to start the installation.

If you are asked to install the Microsoft Visual C++ 2008 Redistributables and it is not already installed on your system, choose the download link appropriate for your environment. Follow the instructions provided by the Microsoft Visual C++ 2008 Redistributable Setup Wizard.

After you have installed the Microsoft Visual C++ 2008 Redistributables, select the appropriate version of the OpenSSL binaries for your environment and save the file locally. Start the OpenSSL Setup Wizard.

Follow the instructions described in the OpenSSL Setup Wizard.

At the command line, set the OpenSSL_HOME variable to the location of the OpenSSL installation:

$ export OpenSSL_HOME=path_to_your_OpenSSL_installation

Set the path to include the OpenSSL installation:

$ export PATH=$PATH:$OpenSSL_HOME/bin

Open a Command Prompt window.

Set the OpenSSL_HOME variable to the location of the OpenSSL installation:

C:\> set OpenSSL_HOME=path_to_your_OpenSSL_installation

Set the OpenSSL_CONF variable to the location of the configuration file in your OpenSSL installation:

C:\> set OpenSSL_CONF=path_to_your_OpenSSL_installation\bin\openssl.cfg

Set the path to include the OpenSSL installation:

C:\> set Path=%Path%;%OpenSSL_HOME%\bin