咨询GCP推导服务账号上传公钥ID的哈希算法

我正在查找GCP为服务账号上传的公钥推导ID的方式。该ID并非随机生成，上传同一密钥时会得到相同ID。此前ServerFault的相关问题指出ID是证书的SHA1指纹，但我的计算结果与GCP显示的不匹配。

我通过以下openssl命令生成证书：

openssl req -x509 -nodes -newkey rsa:2048 -days 365 \
    -keyout ./private_key.pem \
    -out ./public_key.pem \
    -subj "/CN=unused"

生成的公钥内容如下：

-----BEGIN CERTIFICATE-----
MIIDAzCCAeugAwIBAgIUfs79opzHOFGsOBCZ9/NIKzBjMTIwDQYJKoZIhvcNAQEL
BQAwETEPMA0GA1UEAwwGdW51c2VkMB4XDTIzMTIxNDIzMDgyNloXDTI0MTIxMzIz
MDgyNlowETEPMA0GA1UEAwwGdW51c2VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA8iw13qYRx4fi/+NX9P+EBulETiwyx6XguNLyiirQBrF0vDoZpc89
SHggWNYRHtWTzRf6PVlWswksc699t/nGeS0AFVPU4BtDeShBbCE0rsIIxvJlGFDf
37Hz4v/+P9NzSvLkQeVp+FtjoGNbkW9jAnrAyls+sUEFMkcBCYCAI7wSFV7bJt0F
2wnAeel3g3HkoBmu1nZcCCZYqxG7Xs//3I0i9Bky5C1y5VzWjz/TXdthuv19MRMg
7oOVTUa8CmSVhbZ5AUNqt7KWY8ysU43mqDN3Ri1t6eW3H2dVrAu067Y2RsRiqNZh
FvCWIGPZyfdMVWV+vDoptC3zzJ/mEndnuwIDAQABo1MwUTAdBgNVHQ4EFgQUqJAi
pEhcOlhvkGa5OCUi9n0AlFgwHwYDVR0jBBgwFoAUqJAipEhcOlhvkGa5OCUi9n0A
lFgwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEA6uc+BcURaU9A
wOE4FukoYtiXfJ+at5JMnEAjWGWhLB1gDx9YqOVGTWbnHNw4kkljQsrobqiQ9Dxz
qhaseB8NzJrzI0zJQuzMMIwK9+ZaEOq0OSwVtje2cUIeG17S9Z4KCj9WnGd3FHjk
rntVP3oh679gsBHqWsrHWFebkssDwt5ryKp/BOQCjaMSNG+lnHIqOWWp5BKL//lt
2P4Ra0n1jvJT5HG7Vwv75+1BtlVwYFNv1RZvtbb/D9iERTRfMCOCPpDnKsRiLI1Y
AU6J1i38oWQqh0Y1LnVfn1xl+KVpEJwjLUJoFsfbFu1yGZGi8y0DsIRh+HQ0omYy
OSt51bforg==
-----END CERTIFICATE-----

计算得到的SHA1指纹为：

SHA1 Fingerprint=3F:82:28:D5:CD:25:D8:43:0C:7A:5D:7D:00:F6:32:DC:0A:8F:71:29

将该公钥上传至GCP服务账号后得到的ID为：

253b469718cfe08e09a30bd55e09f16f68a0fe97

对该ID进行Base64解码后得到：

db:9d:db:e3:af:7b:d7:c7:1f:7b:4f:1e:d3:d6:b7:d1:b7:79:e5:ed:3d:7f:5e:9f:eb:c6:b4:7d:ef:7b

补充：计算指纹使用的命令为openssl x509 -in ./public_key.pem -noout -fingerprint

现咨询谷歌使用何种算法推导服务账号上传公钥的ID。

内容的提问来源于Stack Exchange，提问作者Russel Vela