u

src/cert-meta.js

@@ -0,0 +1,12 @@
+import { X509Certificate } from 'node:crypto';
+
+/** Derive pairing metadata from a PEM-encoded TLS certificate. */
+export function readCertMetadata(certPem) {
+  const x509 = new X509Certificate(certPem);
+  const sha1 = x509.fingerprint; // colon-separated uppercase hex
+  return {
+    certificateFingerprint: sha1.replace(/:/g, ''),
+    certificateSerialNumber: x509.serialNumber,
+    serverFingerprint: sha1.replace(/:/g, '-'),
+  };
+}