I am currently using this code to have the public key pinning
OkHttpClientFactory okHttpClientFactory = () -> {
CertificatePinner certificatePinner = new CertificatePinner.Builder()
.add(domain, "sha256/" + pin)
.add(domain, "sha256/" + pin_backup)
.build();
return new OkHttpClient.Builder()
.certificatePinner(certificatePinner)
.cookieJar(new ReactCookieJarContainer())
.build();
};
Here the pin
or pin_backup
is the SHA-256 hash of my Certificate's Subject Public Key.
How can I get that pin from a CSR? so that I can use it as a backup pin. Because that future certificate is not yet created, I only have a CSR for the same.
Update:
I am able to get the hashed pin using these commands on the CSR txt file.
Command to get public key from CSR:
openssl req -in csr.txt -noout -pubkey -out publickey.pem
Command to get the hashed pin from the public key:
openssl rsa -in publickey.pem -pubin -outform DER | openssl dgst -sha256 -binary | openssl enc -base64
I took it from here:
-pubkey
. If you want to know how to do this in a specific programming language - that's not a security question but a programming question, i.e. off-topic and on-topic on stackoverflow.com.req -pubkey
is SPKI, as is nearly all output (and input) of publickeys byopenssl
commandline (the exception isrsa -RSAPublicKey_{in,out}
in 1.1.0 up). It IS PEM and not 'DER' (binary), which is why you had to convert it to DER before hashing it to get the correct value. See RFC7468 section 13 which confirms this PEM type is SPKI. And yes SPKI works for all (implemented) algorithms; that's it's whole purpose for existing.