# QC on fingerprint before even visiting admin page

**URL:** <https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887>\
**Category:** uncategorized\
**Created:** [April 10, 2021, 10:36pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887 "2021-04-10T22:36:36Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 10:36pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/1 "2021-04-10T22:36:36Z")

</div>

Does not match, see attached. Is this mitm attack?

 ![finger](https://discourse.mailinabox.email/uploads/default/original/2X/c/c761601cf8c4e5b42c10082a1e0351ad2105af81.png)

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:18pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/2 "2021-04-10T23:18:04Z")

</div>

I’ve never actually seen one!

Did you try looking at the certificate in the browser?

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 11:20pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/3 "2021-04-10T23:20:29Z")

</div>

All the browsers I have tried don’t give the option.  
Brave  
Edge  
I.E.

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:25pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/4 "2021-04-10T23:25:31Z")

</div>

It is there, you just have to navigate through the warnings without enabling the site.

Here is what I get when I load the site:

 ![certinfo](https://discourse.mailinabox.email/uploads/default/original/2X/b/b3a5aa1d9c4204141861cfb58743218694f05acb.png)

Looks like MiaB is giving the SHA-256 hash and grc is giving the SHA-1 hash.

I just noticed the SHA-256 hash was cutoff in the screen shot:

> 7D:94:44:9F:16:61:F2:CD:6F:B2:40:1C:37:63:89:93:F3:EC:82:D8:F3:B1:61:B1:96:3F:6D:E0:FE:14:E3:97

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 11:36pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/5 "2021-04-10T23:36:37Z")

</div>

Hmm, interesting… I was checking the incorrect algo? Lemme double check and I will get back with you.

Edited for brevity (my correspondence with support)

> **[Pastebin.com - Locked Paste](https://pastebin.com/ay82QVQW)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

4bANrfaXFU

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 11:40pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/6 "2021-04-10T23:40:40Z")

</div>

I would like to verify this my self, what web browser do you use?

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:40pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/7 "2021-04-10T23:40:54Z")

</div>

The ISP probably will not help on this sort of issue since it would be something outside their network.

You could also connect to the server with SSH configured as a SOCKS proxy including the DNS server, this way there really isn’t anything between your computer and the server.

However, there doesn’t seem to be an issue in this case.

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:44pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/8 "2021-04-10T23:44:28Z")

</div>

> [@xyzsco](#):
>
> I would like to verify this my self, what web browser do you use?

You can achieve similar results in Brave. The browser will first display a privacy warning page. In the address bar, click the ‘Not Secure’ button and then click ‘Certificate (Invalid)’.

That will show something similar to what I posted.

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 11:45pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/9 "2021-04-10T23:45:02Z")

</div>

I managed to find the print in brave.

Totally not matching  
sha256 in my web, and the grc checker  
ac16ad2a633c1c69f0adb3d0c476b585f68cf0d3  
but not the initial setup…

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:46pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/10 "2021-04-10T23:46:47Z")

</div>

This is what I see in Brave:

 ![bravecertinfo](https://discourse.mailinabox.email/uploads/default/original/2X/8/8b73b9612ccf6f36112c09fcbf4f8c9583a345cf.png)

> SHA-256 Fingerprint 7D 94 44 9F 16 61 F2 CD 6F B2 40 1C 37 63 89 93  
> F3 EC 82 D8 F3 B1 61 B1 96 3F 6D E0 FE 14 E3 97

> SHA-1 Fingerprint AC 16 AD 2A 63 3C 1C 69 F0 AD B3 D0 C4 76 B5 85  
> F6 8C F0 D3

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 11:51pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/11 "2021-04-10T23:51:15Z")

</div>

Well, maybe from your end, but the pick in this post is attached a pic that something is not right between the server and me…

 ![image](https://discourse.mailinabox.email/uploads/default/original/2X/3/36798991dff5cd9f14c027315ee27e989b034c3c.png)

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 10, 2021, 11:53pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/12 "2021-04-10T23:53:38Z")

</div>

> [@openletter](#):
>
> You could also connect to the server with SSH configured as a SOCKS proxy including the DNS server, this way there really isn’t anything between your computer and the server.

any recommendations for good socks sever? I like netgates stuff…

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:55pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/13 "2021-04-10T23:55:18Z")

</div>

The hash you are showing there is the SHA-1 hash. Is that by chance Edge? Nevermind, I see the Brave logo, lol.

The SOCKS server would be your MiaB server. You can use `sshd` as a SOCKS server.

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 10, 2021, 11:57pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/14 "2021-04-10T23:57:52Z")

</div>

Try the drop-down box or other options to see if it displays the SHA-256 hash.

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 11, 2021, 12:12am UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/15 "2021-04-11T00:12:45Z")

</div>

![image](https://discourse.mailinabox.email/uploads/default/original/2X/c/c3fcd6e45fba6be67ec585b2040d62ab8fa9d5be.png)

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 11, 2021, 12:14am UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/16 "2021-04-11T00:14:35Z")

</div>

> [@openletter](#):
>
> The SOCKS server would be your MiaB server. You can use `sshd` as a SOCKS server.

Ahh, good stuff. I am at the butt end of this tonight. I need to do something else for awhile.

Will check in later.

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 11, 2021, 1:55am UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/17 "2021-04-11T01:55:03Z")

</div>

> [@xyzsco](#):
>
> ![image](https://discourse.mailinabox.email/uploads/default/original/2X/c/c3fcd6e45fba6be67ec585b2040d62ab8fa9d5be.png)

Are you able to click the “Signature hash alg…”? Some times that will display the results in the box.

I think you’re better off just finding a browser that will show you an SHA-256 fingerprint, so you can verify against MiaB. I don’t know which one that is because there seems to be something different with Windows versions of programs.

---

<div class="post-metadata">

**Author:** ![xyzsco](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/x/ea666f/32.png) [@xyzsco](https://discourse.mailinabox.email/u/xyzsco)\
**Post date:** [April 11, 2021, 2:15am UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/18 "2021-04-11T02:15:18Z")

</div>

It’s there It’s at the top of the dialog box s h a 256 value

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [April 11, 2021, 2:27am UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/19 "2021-04-11T02:27:41Z")

</div>

The `sha256` is just the hash algorithm. The hash will look completely different, like the one provided by the MiaB install instructions.

Did you try clicking on it and nothing showed up in the box below?

---

<div class="post-metadata">

**Author:** ![alento](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/alento/32/1371_2.png) [@alento](https://discourse.mailinabox.email/u/alento)\
**Post date:** [April 11, 2021, 11:03pm UTC](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887/20 "2021-04-11T23:03:18Z")

</div>

Uhmm, I did not read throgh this entire thread so if I am stating what has already been determined, my apologies.

The fingerprint is for the self-signed certificate created when MiaB is set up. And you are comparing it to the actual certificate issued for the domain.

Of course they are not going to match. @xyzsco

[Next page](https://discourse.mailinabox.email/t/qc-on-fingerprint-before-even-visiting-admin-page/7887.md?page=2)