Cert Pinning Checker

Generate SPKI SHA-256 hashes for certificate pinning

About Certificate Pinning

Certificate pinning associates a host with its expected X.509 certificate or public key, preventing man-in-the-middle attacks by rejecting unexpected certificates. Our Certificate Pinning Checker generates SHA-256 SPKI (Subject Public Key Info) hashes from a server's certificate, which you can use in HPKP headers, mobile app pinning, or browser configuration to lock down which certificates are trusted for your domain.

How to Use

Enter the domain name for which you want to generate pinning hashes.
Click Generate Hash to fetch the server's certificate and compute the SPKI SHA-256 fingerprint.
Copy the generated hash for use in your HPKP header or application configuration.
Repeat for backup certificates to include multiple pins for redundancy.

Use Cases

HPKP Deployment: Generate SPKI hashes for HTTP Public Key Pinning headers on your web server.
Mobile App Security: Pin certificates in Android, iOS, or desktop applications to prevent MITM attacks.
API Security: Ensure API clients only trust pinned certificates for backend communications.
Certificate Rotation: Generate pins for both current and backup certificates to enable smooth rotation.

Frequently Asked Questions

SPKI stands for Subject Public Key Info. The SPKI hash is a SHA-256 hash of the certificate's public key information. Unlike a certificate fingerprint, the SPKI hash remains the same even after certificate renewal if the same key pair is used, making it ideal for pinning.

HPKP has been deprecated by major browsers due to abuse potential and lockout risk. However, certificate pinning remains widely used in mobile applications, API clients, and internal infrastructure where careful key management is possible. Always include backup pins to avoid lockout.

Best practice is to pin at least two keys: the current production key and a backup key from a different key pair. For HPKP, include a pin for an intermediate CA as well. This ensures continuity if the primary key needs to be rotated or is compromised.

Tips & Best Practices

•Pin to intermediate certificates rather than leaf certificates for flexibility
•Include backup pins in case your primary certificate is compromised
•Use both SHA-256 hashes and public key pins for maximum security
•Monitor pin validity to prevent pin validation failures

Technical Details

Method: Public key pinning and certificate pinning analysis
Hash: SHA-256 hash calculation for pin values
Backup: Backup pin configuration and validation
Output: Pin values and implementation recommendations