Function fingerprint_colon_hex 

pub fn fingerprint_colon_hex(cert: &CertificateDer<'_>) -> String

Format the SHA-256 fingerprint of a certificate DER as lowercase colon-separated hex (DW-035): the format the mtls_consumer_mapping.consumers[].fingerprint config field and the X-Client-Cert-Fingerprint forwarding header use. The raw hex (no colons) is the credential SELECTOR the authn registry indexes; this colon-separated form is the OPERATOR-facing display format (config and headers), so the two never collide.