diff --git a/mercurial/chgserver.py b/mercurial/chgserver.py
--- a/mercurial/chgserver.py
+++ b/mercurial/chgserver.py
@@ -55,6 +55,7 @@
     encoding,
     error,
     extensions,
+    node,
     pycompat,
     util,
 )
@@ -63,7 +64,7 @@
 
 def _hashlist(items):
     """return sha1 hexdigest for a list"""
-    return hashlib.sha1(str(items)).hexdigest()
+    return node.hex(hashlib.sha1(str(items)).digest())
 
 # sensitive config sections affecting confighash
 _configsections = [
diff --git a/mercurial/hg.py b/mercurial/hg.py
--- a/mercurial/hg.py
+++ b/mercurial/hg.py
@@ -569,7 +569,7 @@
                             'unable to resolve identity of remote)\n'))
         elif sharenamemode == 'remote':
             sharepath = os.path.join(
-                sharepool, hashlib.sha1(source).hexdigest())
+                sharepool, node.hex(hashlib.sha1(source).digest()))
         else:
             raise error.Abort(_('unknown share naming mode: %s') %
                               sharenamemode)
diff --git a/mercurial/keepalive.py b/mercurial/keepalive.py
--- a/mercurial/keepalive.py
+++ b/mercurial/keepalive.py
@@ -92,6 +92,7 @@
 
 from .i18n import _
 from . import (
+    node,
     pycompat,
     urllibcompat,
     util,
@@ -607,7 +608,7 @@
     foo = fo.read()
     fo.close()
     m = md5(foo)
-    print(format % ('normal urllib', m.hexdigest()))
+    print(format % ('normal urllib', node.hex(m.digest())))
 
     # now install the keepalive handler and try again
     opener = urlreq.buildopener(HTTPHandler())
@@ -617,7 +618,7 @@
     foo = fo.read()
     fo.close()
     m = md5(foo)
-    print(format % ('keepalive read', m.hexdigest()))
+    print(format % ('keepalive read', node.hex(m.digest())))
 
     fo = urlreq.urlopen(url)
     foo = ''
@@ -629,7 +630,7 @@
             break
     fo.close()
     m = md5(foo)
-    print(format % ('keepalive readline', m.hexdigest()))
+    print(format % ('keepalive readline', node.hex(m.digest())))
 
 def comp(N, url):
     print('  making %i connections to:\n  %s' % (N, url))
diff --git a/mercurial/patch.py b/mercurial/patch.py
--- a/mercurial/patch.py
+++ b/mercurial/patch.py
@@ -2654,7 +2654,7 @@
         l = len(text)
         s = hashlib.sha1('blob %d\0' % l)
         s.update(text)
-        return s.hexdigest()
+        return hex(s.digest())
 
     if opts.noprefix:
         aprefix = bprefix = ''
diff --git a/mercurial/sparse.py b/mercurial/sparse.py
--- a/mercurial/sparse.py
+++ b/mercurial/sparse.py
@@ -12,7 +12,10 @@
 import os
 
 from .i18n import _
-from .node import nullid
+from .node import (
+    hex,
+    nullid,
+)
 from . import (
     error,
     match as matchmod,
@@ -173,12 +176,12 @@
         tempsignature = '0'
 
     if signature is None or (includetemp and tempsignature is None):
-        signature = hashlib.sha1(repo.vfs.tryread('sparse')).hexdigest()
+        signature = hex(hashlib.sha1(repo.vfs.tryread('sparse')).digest())
         cache['signature'] = signature
 
         if includetemp:
             raw = repo.vfs.tryread('tempsparse')
-            tempsignature = hashlib.sha1(raw).hexdigest()
+            tempsignature = hex(hashlib.sha1(raw).digest())
             cache['tempsignature'] = tempsignature
 
     return '%s %s' % (signature, tempsignature)
diff --git a/mercurial/sslutil.py b/mercurial/sslutil.py
--- a/mercurial/sslutil.py
+++ b/mercurial/sslutil.py
@@ -17,6 +17,7 @@
 from .i18n import _
 from . import (
     error,
+    node,
     pycompat,
     util,
 )
@@ -808,9 +809,9 @@
     # If a certificate fingerprint is pinned, use it and only it to
     # validate the remote cert.
     peerfingerprints = {
-        'sha1': hashlib.sha1(peercert).hexdigest(),
-        'sha256': hashlib.sha256(peercert).hexdigest(),
-        'sha512': hashlib.sha512(peercert).hexdigest(),
+        'sha1': node.hex(hashlib.sha1(peercert).digest()),
+        'sha256': node.hex(hashlib.sha256(peercert).digest()),
+        'sha512': node.hex(hashlib.sha512(peercert).digest()),
     }
 
     def fmtfingerprint(s):
diff --git a/mercurial/store.py b/mercurial/store.py
--- a/mercurial/store.py
+++ b/mercurial/store.py
@@ -15,6 +15,7 @@
 from .i18n import _
 from . import (
     error,
+    node,
     policy,
     pycompat,
     util,
@@ -221,7 +222,7 @@
 _maxshortdirslen = 8 * (_dirprefixlen + 1) - 4
 
 def _hashencode(path, dotencode):
-    digest = hashlib.sha1(path).hexdigest()
+    digest = node.hex(hashlib.sha1(path).digest())
     le = lowerencode(path[5:]).split('/') # skips prefix 'data/' or 'meta/'
     parts = _auxencode(le, dotencode)
     basename = parts[-1]
diff --git a/mercurial/subrepo.py b/mercurial/subrepo.py
--- a/mercurial/subrepo.py
+++ b/mercurial/subrepo.py
@@ -55,7 +55,7 @@
 
 def _getstorehashcachename(remotepath):
     '''get a unique filename for the store hash cache of a remote repository'''
-    return hashlib.sha1(_expandedabspath(remotepath)).hexdigest()[0:12]
+    return node.hex(hashlib.sha1(_expandedabspath(remotepath)).digest())[0:12]
 
 class SubrepoAbort(error.Abort):
     """Exception class used to avoid handling a subrepo error more than once"""
@@ -789,7 +789,7 @@
         yield '# %s\n' % _expandedabspath(remotepath)
         vfs = self._repo.vfs
         for relname in filelist:
-            filehash = hashlib.sha1(vfs.tryread(relname)).hexdigest()
+            filehash = node.hex(hashlib.sha1(vfs.tryread(relname)).digest())
             yield '%s = %s\n' % (relname, filehash)
 
     @propertycache
diff --git a/mercurial/util.py b/mercurial/util.py
--- a/mercurial/util.py
+++ b/mercurial/util.py
@@ -49,6 +49,7 @@
     encoding,
     error,
     i18n,
+    node as nodemod,
     policy,
     pycompat,
     urllibcompat,
@@ -265,7 +266,7 @@
     def __getitem__(self, key):
         if key not in DIGESTS:
             raise Abort(_('unknown digest type: %s') % k)
-        return self._hashes[key].hexdigest()
+        return nodemod.hex(self._hashes[key].digest())
 
     def __iter__(self):
         return iter(self._hashes)