Can we use the Subject Key Identifier for "certificate" pinning ? Is it secure to rely only on the SKI?
The Subject Key Identifier (SKI) is a field (X509v3 extension) contained in the certificate. Even though it is typically derived from the subject and public key it does not need to be.
This means that an attacker could easily create a certificate which contains a specific SKI which would get accepted if pinning is done against the SKI. This of course makes it unusable for secure certificate pinning.
Are there other fields that we could use for pinning securely (e.g. Certificate hash) ?
The certificate hash is no field of the certificate but it is simply a hash over the certificate. Provided that a secure hash is used (i.e. SHA-256) it is usable for certificate pinning. One could of course also store the full certificate for comparison instead of only a hash of it.
Useful for pinning is also the public key or a secure hash of the public key. This makes it possible to accept multiple variants of the same certificate with different expiration times as long as the public key stays the same when reissueing the certificate. But this is usually called public key pinning, not certificate pinning.