doc: guide towards x509.fingerprint256

Recommend using x509.fingerprint256 instead of x509.fingerprint and x509.fingerprint512 and suggest using it instead of x509.serialNumber in order to uniquely identify certificates. PR-URL: #42516 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Tierney Cyren <[email protected]>
nodejs · Apr 6, 2022 · b819af6 · b819af6
1 parent f2355e4
commit b819af6
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
@@ -2617,6 +2617,10 @@ added: v15.6.0
 
 The SHA-1 fingerprint of this certificate.
 
+Because SHA-1 is cryptographically broken and because the security of SHA-1 is
+significantly worse than that of algorithms that are commonly used to sign
+certificates, consider using [`x509.fingerprint256`][] instead.
+
 ### `x509.fingerprint256`
 
 <!-- YAML
@@ -2637,6 +2641,12 @@ added: v17.2.0
 
 The SHA-512 fingerprint of this certificate.
 
+Because computing the SHA-256 fingerprint is usually faster and because it is
+only half the size of the SHA-512 fingerprint, [`x509.fingerprint256`][] may be
+a better choice. While SHA-512 presumably provides a higher level of security in
+general, the security of SHA-256 matches that of most algorithms that are
+commonly used to sign certificates.
+
 ### `x509.infoAccess`
 
 <!-- YAML
@@ -2724,6 +2734,10 @@ added: v15.6.0
 
 The serial number of this certificate.
 
+Serial numbers are assigned by certificate authorities and do not uniquely
+identify certificates. Consider using [`x509.fingerprint256`][] as a unique
+identifier instead.
+
 ### `x509.subject`
 
 <!-- YAML
@@ -6056,6 +6070,7 @@ See the [list of SSL OP Flags][] for details.
 [`util.promisify()`]: util.md#utilpromisifyoriginal
 [`verify.update()`]: #verifyupdatedata-inputencoding
 [`verify.verify()`]: #verifyverifyobject-signature-signatureencoding
+[`x509.fingerprint256`]: #x509fingerprint256
 [caveats when using strings as inputs to cryptographic APIs]: #using-strings-as-inputs-to-cryptographic-apis
 [certificate object]: tls.md#certificate-object
 [encoding]: buffer.md#buffers-and-character-encodings