What is the relationship between certificates and TLS fingerprints? What level of concept is a certificate? What level of concept is a TLS fingerprint?
Certificates and TLS fingerprints are two completely different aspects of the TLS handshake. A certificate is an "ID card" for authentication, while a TLS fingerprint is a "behavioral profile" that identifies the client or server software characteristics. Certificates: Authentication Level Certificates (usually X.509 digital certificates) address the question of "who you are". They are electronic credentials issued by a trusted third party (CA), binding a public key to an entity's identity (such as a domain name or organization). In the TLS handshake, the server presents a certificate, and the client verifies the certificate chain, validity period, and domain name match to confirm the server's identity. The "certificate binding" (SSL Pinning) you learned about earlier is to narrow down this verification logic from "trust all CAs" to "only trust that one specific certificate" to prevent man-in-the-middle attacks. TLS Fingerprints: Behavioral Characteristics Level TLS fingerprints address the question of "what software/configuration you are". It does not care about the certificate content but analyzes the combination of technical characteristics presented in the TLS handshake messages (such as Client Hello).
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
