FermiHDI public keys

Everything on this page is public material. Verify the fingerprints below out-of-band before trusting anything fetched from here.

Container image signing

Images in cr.fermihdi.io are signed with cosign. Verify with:

cosign verify --key https://keys.fermihdi.io/cosign.pub \
  --insecure-ignore-tlog=true \
  cr.fermihdi.io/<project>/<repo>:<tag>

--insecure-ignore-tlog is required because signatures are kept off the public Sigstore transparency log, so private image names are not disclosed. It does not weaken the check against the key.

Certificate authorities

File	Subject	Key	Valid from	Expires
root_ca.pem	FermiHDI Ltd. root CN=root.fermihdi.com · self-signed	RSA 4096	2026-02-10	2046-02-05
lic_ica.pem	FermiHDI Testing ICA O=FermiHDI Ltd. · OU=Testing CI · issued by the root above	RSA 2048	2026-04-06	2036-04-03

Public keys

The subject public keys of the two certificates above, plus the cosign signing key. Provided separately for tools that want a bare key rather than a certificate.

File	Algorithm	Corresponds to
cosign.pub	ECDSA P-256	cosign image signing — no certificate, no expiry
root_ca.pub	RSA 4096	`root_ca.pem`
lic_ica.pub	RSA 2048	`lic_ica.pem`

Fingerprints

SHA-256, lowercase hex, no separators.

Certificate and key fingerprints are different values. A certificate fingerprint digests the whole certificate, so it changes on re-issue even when the key stays the same. A key fingerprint digests only the public key and survives re-issue. Compare like with like — a mismatch between the two tables is expected, not a warning sign.

Certificate fingerprints

Reproduce with: openssl x509 -in FILE -noout -fingerprint -sha256 | cut -d= -f2 | tr -d ':' | tr 'A-Z' 'a-z'

File	SHA-256
root_ca.pem	`e94b122e84b2ce5b1787eb1c2e4bf5898af9f9eb2dc0ea894e072d9fdeb46e4a`
lic_ica.pem	`096e97623c126dd7340190747f6af4337b2313a280a11399ef557513fda519b4`

Public key fingerprints

Reproduce with: openssl pkey -pubin -in FILE -outform DER | openssl dgst -sha256 (for a .pem certificate, pipe openssl x509 -in FILE -pubkey -noout into it)

Key	SHA-256
cosign.pub	`e8dc6115257e99f0e1e098145a0501859621fa2842f0217fb0aabae286201f79`
root_ca.pub	`237884b9e113f7ab1b6c2855239830f4a2c285592aa13cd52faab3bbd8402502`
lic_ica.pub	`77c2c94238b9051253277658bdd4f949523fbc267e2f2823c275c36c85f2052a`

Serial numbers — root_ca: 15186085ab950fa50eee2b95a0d9454945e42de6, lic_ica: 011b7abea271139b00c59c49fb70106b461f281e.