[Defect]: certificateProperties.fingerprint description conflicts with the common definition of a certificate fingerprint

[nikpivkin]

Describe the defect

In bom-1.7.schema.json, certificateProperties.fingerprint is described as:

The fingerprint is a cryptographic hash of the certificate excluding it's signature.

Everywhere else, a certificate fingerprint is the hash over the complete DER encoding of the Certificate structure, including signatureAlgorithm and signatureValue:

• openssl x509 -fingerprint -sha256
• Java: digest over X509Certificate.getEncoded()
• Go: digest over x509.Certificate.Raw

Read literally, the description means a hash of DER(tbsCertificate) rather than of the certificate itself. A value computed that way cannot be correlated with any of the sources above. Which of the two is intended?

Additional context

The field is new in 1.7, there is no equivalent in 1.6, so there is no backwards compatibility constraint on the wording.

If the usual fingerprint is intended, a possible wording:

A cryptographic hash of the certificate, computed over its complete DER encoding, including the signature. For certificates stored in other encodings (for example PEM), the hash is computed over the decoded DER.