I've ran into this issue twice this month, where my auth would fail due to the TLS_FINGERPRINT.

The first time, I found the key online on a forum. Now, I can't find the updated key anywhere. I've tried getting it from this command:

openssl s_client -connect tuner.pandora.com:443 < /dev/null 2> /dev/null | openssl x509 -noout -fingerprint | tr -d ':' | cut -d'=' -f2

But the key that returns doesn't work...

  • Is it because the output, SHA1 Fingerprint=EB:F0:3C:1F:BD:AA:12:23:23:6B:27:D8:7C:CF:35:34:C8:00:F0:15 has Fingerprint= and what you're giving the fingerprint to only wants the actual fingerprint?
    – Josh Zhang
    Commented Aug 6, 2021 at 19:56
  • The output of the above command returns EBF03C1FBDAA1223236B27D87CCF3534C800F015 and that's the same format as previous fingerprints I've set for pianobar.
    – CPH
    Commented Aug 7, 2021 at 0:32

1 Answer 1


I finally found the solution!!! The issue is that the tls_fingerprint in the command in my question returns a SHA1 format, but needs to return a HEX-encoded format! Found this piece of information in the man pages here: https://linux.die.net/man/1/pianobar

So, after looking at how to format SHA1 to HEX, I came up with this command (and it works!)

openssl s_client -connect tuner.pandora.com:443 < /dev/null 2> /dev/null | awk '{print $3}' | base64 -d | md5sum -b | awk '{print $1}' | sed 's/../&:/g' | sed 's/://g'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.