Problem:
The Grid operator and Praxis use different fingerprint formats for the same certificate:
| Component |
Field |
Format |
Hash input |
| GridSite CRD |
spec.trust.certFingerprint |
Colon-separated hex (ab:cd:ef:...) |
SHA-256 of trimmed PEM bytes |
| Praxis |
peer_identity_trust.cert_digest |
Plain hex, 64 chars (abcdef...) |
SHA-256 of DER-encoded cert |
The Grid operator's sha256_fingerprint() hashes the PEM string bytes, while Praxis hashes the DER-encoded X.509 certificate. They also use different output formats (colons vs plain). Using one format in the other's config field causes silent 403 rejections or startup failures.
Proposed fix:
Standardize on one format and hash input across both systems.
Problem:
The Grid operator and Praxis use different fingerprint formats for the same certificate:
spec.trust.certFingerprintab:cd:ef:...)peer_identity_trust.cert_digestabcdef...)The Grid operator's
sha256_fingerprint()hashes the PEM string bytes, while Praxis hashes the DER-encoded X.509 certificate. They also use different output formats (colons vs plain). Using one format in the other's config field causes silent 403 rejections or startup failures.Proposed fix:
Standardize on one format and hash input across both systems.