---
title: CertificateThumbprintFilter
description: Extracts a Java certificate from a trusted header or from a TLS connection, computes the SHA-256 thumbprint of that certificate, and makes the thumbprint available for the ConfirmationKeyVerifierAccessTokenResolver. Use this filter to enable verification of certificate-bound access tokens.
component: pinggateway
version: 2023.11
page_id: pinggateway:reference:CertificateThumbprintFilter
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/CertificateThumbprintFilter.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-03T11:21:31Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/CertificateThumbprintFilter.html
section_ids:
  CertificateThumbprintFilter-usage: Usage
  CertificateThumbprintFilter-properties: Properties
  CertificateThumbprintFilter-examples: Examples
  CertificateThumbprintFilter-moreinfo: More information
---

# CertificateThumbprintFilter

Extracts a Java certificate from a trusted header or from a TLS connection, computes the SHA-256 thumbprint of that certificate, and makes the thumbprint available for the ConfirmationKeyVerifierAccessTokenResolver. Use this filter to enable verification of certificate-bound access tokens.

CertificateThumbprintFilter computes and makes available the SHA-256 thumbprint of a client certificate as follows:

* Evaluates a runtime expression and yields a `java.security.cert.Certificate`

* Hashes the certificate using SHA-256

* Base64url-encodes the result

* Stores the result in the contexts chain

The runtime expression can access or build a client certificate from any information present at runtime, such as a PEM in a header, or a pre-built certificate.

Use CertificateThumbprintFilter with ConfirmationKeyVerifierAccessTokenResolver when the IG instance is behind the TLS termination point, for example, when IG is running behind a load balancer or other ingress point.

## Usage

```json
{
  "name": string,
  "type": "CertificateThumbprintFilter",
  "config": {
    "certificate": runtime expression<certificate>,
    "failureHandler": Handler reference,
  }
}
```

## Properties

* `"certificate"`: *runtime expression<[certificate](preface.html#definition-certificate)>, required*

  An EL expression which, when evaluated, yields an instance of a `java.security.cert.Certificate`.

  Use the following [Functions](Expressions.html#Functions) in the expression to define hash, decoding, and certificate format:

  * `digestSha256`, to calculate the SHA-256 hash of the certificate.

  * `decodeBase64url`, to decode an incoming base64url-encoded string.

  * `pemCertificate`, to convert a PEM representation string into a certificate.

  See [Examples](Filters.html#CertificateThumbprintFilter-examples).

- `"failureHandler"`: *Handler [reference](preface.html#definition-reference), optional*

  Handler to treat the request on failure.

  Provide an inline handler configuration object or the name of a handler object declared in the heap. See also [Handlers](Handlers.html).

  Default: HTTP 403 Forbidden, the request stops being executed.

## Examples

The following example uses the certificate associated with the incoming HTTP connection:

```json
{
  "name": "CertificateThumbprintFilter-1",
  "type": "CertificateThumbprintFilter",
  "config": {
    "certificate": "${contexts.client.certificates[0]}"
  }
}
```

The following example is adapted for a deployment with NGINX as the TLS termination, where NGINX fronts IG. NGINX provides the client certificate associated with its own incoming connection in the `x-ssl-client-cert` header. The certificate is encoded as PEM, and then url-encoded:

```json
{
  "name": "CertificateThumbprintFilter-2",
  "type": "CertificateThumbprintFilter",
  "config": {
    "certificate": "${pemCertificate(urlDecode(request.headers['x-ssl-client-cert'][0]))}"
  }
}
```

## More information

[org.forgerock.openig.filter.oauth2.cnf.CertificateThumbprintFilter](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/cnf/CertificateThumbprintFilter.html)