How do I check the sha256 sum of my file's certificate (not the sha256 sum of my file!)?

# Show signature details
Get-AuthenticodeSignature "Winobj.exe" | fl

# Get the certificate object
$cert = (Get-AuthenticodeSignature "Winobj.exe").SignerCertificate
$algo = [System.Security.Cryptography.HashAlgorithm]::Create("sha256")
$digest = $algo.ComputeHash($cert.RawData)
$hexdigest = [System.BitConverter]::ToString($digest)
echo $hexdigest

First try a "sha1" hash and compare it against $cert.Thumbprint to verify that the manual procedure works (i.e. both calculate the hash the same way), then switch to "sha256".

SHA-1 is already vulnerable to collisions (where the attacker chooses both inputs), but AFAIK is still believed to not be vulnerable to "preimage" attacks (where the attacker tries to fit their input into an existing hash made from someone else's input), so it's not the end of the world to use it to verify a fingerprint that itself comes from a trusted source.

If you have the certificate file (in DER format – not PEM), in a CMD prompt, try certutil -hashfile <full path to certificate file> SHA256. You can also use use a third-party tool such as Nirsoft's HashMyFiles.

However, if the certificate has already been added to the Windows Certificate Store, you'd need to export that as a file. "The certificate store is located within the Windows operating system [in the Registry]:"

• Press WinR, type mmc, and press Enter.
• In the MMC console, go to File > Add/Remove Snap-in, select Certificates and click Add.
• Right-click on the certificate, select All Tasks and then Export. Choose DER as the format.
• Now get the checksum for the exported file as above.