SPKI pin (HPKP-style)

Compute the RFC 7469 pin-sha256 of a certificate or public key's SubjectPublicKeyInfo, for HTTP Public Key Pinning or certificate pinning.

SPKI pin (HPKP-style) pulls the SubjectPublicKeyInfo from a certificate or standalone public key and prints it as an RFC 7469 pin-sha256 value, base64 of that structure's SHA-256 digest. Handed a certificate, it extracts the SPKI from inside that structure first; handed a bare public key, it hashes the bytes as-is. Raw DER falls back to a bare SPKI reading.

Questions

What input types does it accept?

A PEM CERTIFICATE block, a PEM PUBLIC KEY block, or raw DER with no PEM label at all.

How does it handle a certificate versus a bare public key?

A certificate has its SubjectPublicKeyInfo extracted from inside the surrounding certificate structure first; a public key block is hashed as-is.

What does it output?

A pin-sha256="..." line in the exact RFC 7469 HPKP format.

What happens with raw DER and no PEM label?

It is tried as a certificate first, and falls back to being treated as an SPKI directly if that parse fails.

What hash does the pin use?

SHA-256 over the DER bytes of the SubjectPublicKeyInfo structure.

Related Security tools

n→nX.509 certificate parserDecode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions, parsing every certificate in a multi-cert PEM chain instead of only the first. Reports what each certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.n→nCSR parserDecode a PEM or DER PKCS#10 certificate signing request into subject, public key and requested extensions (including subjectAltName, when present in an extensionRequest attribute). Reports the request, not a decision about whether it should be signed.n→nCRL parserDecode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.n→nJWK ↔ PEMConvert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.n→nPEM ↔ HexConvert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.n→nPublic key from cert / private keyExtract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.n→nCertificate chain validatorCheck that each certificate in a PEM chain was signed by the next one, with a valid signature, a current validity window, and CA flags that line up.n→nPEM bundle splitSplit a PEM bundle, such as a certificate chain, into one file per block.