0
$\begingroup$
  1. Where is the Digital Signature value in my certificate? I can find Signature Algorithm and Signature Hash algorithm.
  2. Also why are there two fields specifying the Signature's Hash? With Signature Algorithm field, one can easily figure out Digital Certificate is signed with SHA-1/SHA2 hash.

Please clarify my doubts. I would appreciate if someone can show Signature Value field in certificate?

Sample certificate

Improve this question
$\endgroup$

3 Answers 3

Reset to default
2
$\begingroup$

The signature value is contained in the certificate - right at the end to be precise. The signature value is not for human consumption, so it doesn't make a whole lot of sense to display it. Instead the verification result is shown. You need to parse the certificate yourself to view the signature value. For this you can use OpenSSL (openssl asn1parse) or you can for instance export the certificate to PEM and import it in an online decoder such as this one.

I'm not sure why the hash and signature algorithm are listed separately. I can make an educated guess though. It may be that this is a leftover from signature algorithm identifiers that consisted of a separate "encryption" algorithm (e.g. rsaEncryption) and a hash algorithm as parameter. Currently though the OID of the signature generation algorithm contains both, using NULL as parameter.

Improve this answer
$\endgroup$
7
  • $\begingroup$ I tried using the site you suggested and using my pem file, but I don't see the signaturevalue field. What am I missing? $\endgroup$
    – dev4life
    Commented Aug 23, 2019 at 17:50
  • 1
    $\begingroup$ It's not called the signature value field, as the site really performs DER decoding to the tree, and converting some values. So the name of the different nodes of the tree representing the ASN.1 structure is missing. The signature value is contained in the final BIT STRING in the example that I show in the link, as that's the type used for the signature value element. I presume your PEM file will have a similar BIT STRING (and if it is a certificate, it should be at the end). $\endgroup$
    – Maarten Bodewes ♦
    Commented Aug 23, 2019 at 22:31
  • $\begingroup$ Yes, I did see that. I was hoping to get the actually SignatureValue because I need it to set into a header request. I have found the DigestValue, Modulus and Exponent. This is the last piece of the puzzle. $\endgroup$
    – dev4life
    Commented Aug 26, 2019 at 15:44
  • $\begingroup$ Some basic BER decoding is all what's really required, if you look at the specs you can simply count the number of values and get to the right field (or you just parse to the last one). That way I managed to decode and verify an X.509 certificate on a Java Card even (with less than 8 KiB of RAM available to me, in total). $\endgroup$
    – Maarten Bodewes ♦
    Commented Aug 26, 2019 at 17:25
  • 1
    $\begingroup$ Also openssl x509 [-in file else stdin] [-inform PEM|DER] -text [-noout] displays the signature, without a label, following the last labelled field Signature Algorithm: ... $\endgroup$
    – dave_thompson_085
    Commented Nov 15, 2019 at 2:00
1
$\begingroup$

Certificate Signature Value is seen in the Firefox browser, whereas google chrome or IE will not show this field and value.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Where in Firefox? $\endgroup$
    – dev4life
    Commented Aug 23, 2019 at 18:28
  • $\begingroup$ @dev4life: i.sstatic.net/nIYpX.png $\endgroup$
    – dave_thompson_085
    Commented Nov 15, 2019 at 1:55
  • 1
    $\begingroup$ UPDATE (since I re-found this while checking something else) @dev4life+ sadly Firefox has modified their cert display, from the old movable popup to a browser tab with subtabs for the certs in the chain, and it no longer shows the signature. I don't remember exactly when this happened; somewhere around the beginning of 2021 I think. (openssl x509 -text still works.) $\endgroup$
    – dave_thompson_085
    Commented Oct 16, 2021 at 10:45
0
$\begingroup$

If your Certificate is in pem format then you will get Signature value with this command in OpenSSl. openssl x509 -in cert.pem -text -noout -certopt ca_default -certopt no_validity -certopt no_serial -certopt no_subject -certopt no_extensions -certopt no_signame Output: Signature Algorithm: ecdsa-with-SHA256 Signature Value: 30:46:02:21:00:ee:61:d3:eb:28:3c:e6:3b:50:19:6a:77:33: bb:4f:4f:b2:64:db:ec:ec:bd:51:c6:b3:76:d4:e5:9e:d8:13: af:02:21:00:fa:d1:e6:d0:6a:66:23:62:f7:5e:6e:71:63:35: fc:78:5f:87:68:a7:b2:ec:10:11:42:35:2b:0b:63:42:05:69

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.