Where is the “Fingerprint” of my server?

You’ve probably encountered us talking about a server’s fingerprint more than a few times. Ever wonder where to get it? Me too, so I made a point of finding out.

Basically, the fingerprint is a unique grouping of characters derived from the certificate the server is using and should be unique for every certificate. PaperCut NG/MF uses this certificate identifier to allow us to communicate via SSL to any device that supports it.

SHA-1 — This is an older encryption method that has been deprecated. It is characterized by a 40-character string. Some legacy devices might still require this key.

SHA-256 — This is considered very secure and has replaced SHA-1. It is characterized by a 64-character string.

Finding the SHA-256 fingerprint

I’ll use a Chromium browser to show how easy it is to find the fingerprint for your PaperCut server and copy it.

PaperCut installs a ‘self-signed’ certificate by default. Some browsers might show a warning, and this is expected, as they typically look for a certificate that’s verified through a trusted Certificate Authority (CA). Since a self-signed certificate doesn’t come from a recognized CA, it doesn’t meet that requirement.

You can import your own trusted certificate into PaperCut quite easily. Take a look at Installing an SSL Certificate the easy way .

Right, let’s get started then.

1. Open a connection to your PaperCut server.
   https://[server name or IP]:9191/admin
2. If your browser warns you about the site not being safe (as explained above), click Advanced, then Proceed to site to continue.
   You should arrive at the screen below.
   
3. Click the padlock symbol.
4. Click connection status.
   
5. Select the certificate.
   
6. Copy the thumbprint. A new window is displayed showing the certificate details.
   

The SHA-1 can also be found here, but you’ll need to download the certificate, as shown in the recording below.

Finding the SHA-1 fingerprint in the MMC

1. Open MMC by pressing Win + R, type mmc, and press Enter.
2. Add Certificates Snap-in:
   1. In the MMC console, go to File > Add/Remove Snap-in….
   2. Select Certificates and click Add.
   3. Choose Computer account (as the PaperCut server certificate is usually in the computer’s store), then click Next.
   4. Select Local computer and click Finish.
   5. Click OK to close the Add/Remove Snap-in dialog.
3. Navigate to the Certificate Store:
   1. In the left-hand pane of MMC, expand Certificates (Local Computer).
   2. Look for the certificate under the Personal > Certificates store. Your PaperCut server’s certificate will be here. (It might be named after your server or “PaperCut NG/MF”.)
4. Find and copy the thumbprint:
   1. Double-click on your PaperCut server’s SSL certificate.
   2. Go to the Details tab.
   3. Scroll down the list of fields until you find “Thumbprint”.
   4. Select Thumbprint. The SHA-1 thumbprint should be displayed in the lower pane.
   5. Crucially, this will usually be the SHA-1 thumbprint. Copy the value.