From 8b7c057ff161664e62b57622ad26b2072cb8a583 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tobias=20Nie=C3=9Fen?= <tniessen@tnie.de>
Date: Fri, 1 Apr 2022 12:35:27 +0200
Subject: [PATCH] doc: guide towards x509.fingerprint256

Recommend using x509.fingerprint256 instead of x509.fingerprint and
x509.fingerprint512 and suggest using it instead of x509.serialNumber
in order to uniquely identify certificates.

PR-URL: https://github.com/nodejs/node/pull/42516
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Tierney Cyren <hello@bnb.im>
---
 doc/api/crypto.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 1a9c43504e87ae..76ee8097186436 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -2617,6 +2617,10 @@ added: v15.6.0
 
 The SHA-1 fingerprint of this certificate.
 
+Because SHA-1 is cryptographically broken and because the security of SHA-1 is
+significantly worse than that of algorithms that are commonly used to sign
+certificates, consider using [`x509.fingerprint256`][] instead.
+
 ### `x509.fingerprint256`
 
 <!-- YAML
@@ -2637,6 +2641,12 @@ added: v17.2.0
 
 The SHA-512 fingerprint of this certificate.
 
+Because computing the SHA-256 fingerprint is usually faster and because it is
+only half the size of the SHA-512 fingerprint, [`x509.fingerprint256`][] may be
+a better choice. While SHA-512 presumably provides a higher level of security in
+general, the security of SHA-256 matches that of most algorithms that are
+commonly used to sign certificates.
+
 ### `x509.infoAccess`
 
 <!-- YAML
@@ -2724,6 +2734,10 @@ added: v15.6.0
 
 The serial number of this certificate.
 
+Serial numbers are assigned by certificate authorities and do not uniquely
+identify certificates. Consider using [`x509.fingerprint256`][] as a unique
+identifier instead.
+
 ### `x509.subject`
 
 <!-- YAML
@@ -6056,6 +6070,7 @@ See the [list of SSL OP Flags][] for details.
 [`util.promisify()`]: util.md#utilpromisifyoriginal
 [`verify.update()`]: #verifyupdatedata-inputencoding
 [`verify.verify()`]: #verifyverifyobject-signature-signatureencoding
+[`x509.fingerprint256`]: #x509fingerprint256
 [caveats when using strings as inputs to cryptographic APIs]: #using-strings-as-inputs-to-cryptographic-apis
 [certificate object]: tls.md#certificate-object
 [encoding]: buffer.md#buffers-and-character-encodings