I am currently using this code to have the public key pinning

    OkHttpClientFactory okHttpClientFactory = () -> {
        CertificatePinner certificatePinner = new CertificatePinner.Builder()
                .add(domain, "sha256/" + pin)
                .add(domain, "sha256/" + pin_backup)
        return new OkHttpClient.Builder()
                .cookieJar(new ReactCookieJarContainer())

Here the pin or pin_backup is the SHA-256 hash of my Certificate's Subject Public Key.

enter image description here

How can I get that pin from a CSR? so that I can use it as a backup pin. Because that future certificate is not yet created, I only have a CSR for the same.


I am able to get the hashed pin using these commands on the CSR txt file.

Command to get public key from CSR:

openssl req -in csr.txt -noout -pubkey -out publickey.pem

Command to get the hashed pin from the public key:

openssl rsa -in publickey.pem -pubin -outform DER | openssl dgst -sha256 -binary | openssl enc -base64

I took it from here:

  • 1
    I'm not sure what kind of answer you expect, i.e. if you just want to know how to get the key in general or how to do it within a specific programming language. The public key can for example be extracted with openssl req and the parameter -pubkey. If you want to know how to do this in a specific programming language - that's not a security question but a programming question, i.e. off-topic and on-topic on stackoverflow.com. Oct 11, 2023 at 14:28
  • I think you are referring to certificate pinning. Certificate pinning is generally done using a public key or the certificate itself. In the case of public keys, pin may be either of two parameters: subjectPublicKeyInfo or (RSA/DSA)PublicKey. But I'm not sure how you can extract it from the CSR. Generally, certificates are used for pinning. Try extracting the public key from the CSR and calculate the sha256 hash? And see if it matches?
    – saurabh
    Oct 11, 2023 at 15:18
  • @saurabh I was able to get the public key from CSR. But a sha256 hash of it is not matching with the pin I got from the actual certificate. However I was able to get it to work(matches the pin from my actual certificate) using the commands in the update part of the answer. But 1 thing is still unclear for me - would these commands work irrespective of the algorithm or no of bits used for the public key? because such info is not there in the public key, it would be inside the subjectPublicKeyInfo, which I dont have or cannot get from the CSR. Oct 12, 2023 at 9:04
  • Why not test by creating CSR's with RSA keys of various lengths, and EC keys based on various curves.
    – mti2935
    Oct 12, 2023 at 11:11
  • 1
    You ARE using SubjectPublicKeyInfo. The output of req -pubkey is SPKI, as is nearly all output (and input) of publickeys by openssl commandline (the exception is rsa -RSAPublicKey_{in,out} in 1.1.0 up). It IS PEM and not 'DER' (binary), which is why you had to convert it to DER before hashing it to get the correct value. See RFC7468 section 13 which confirms this PEM type is SPKI. And yes SPKI works for all (implemented) algorithms; that's it's whole purpose for existing. Oct 13, 2023 at 1:49


You must log in to answer this question.

Browse other questions tagged .