You can do it in Google Chrome with chrome://net-internals/#hsts :
In that screen you can consult the pinning state of a website (HSTS, HPKP and preloaded) but you can add certificate pinning for any domains too :
In the Add domain section, you can specify for any domain :
- If you want to force HSTS
- If you want to pin some certificate : you need to specify the list of public key fingerprints
Is there a reason why there is no option to "Pin this certificate to this URI" when viewing the details of a certificate in a web browser? Would it undermine the concept of CAs, or is it just not implemented?
Yes, there is one reason to make it difficult for users to pin a certificate : If the webmaster need to update his certificate, then he has no way to notify users. The browser will tell you that the key is not valid but you will have no way to decide if it's legitimate or not.
To do it, you mush export the certificate , then execute :
openssl x509 -in certificate.crt -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
(replace "certificate.crt" with the name of the file you saved before)
You will get something like :
Then you fill "Public key fingerprints" field with sha256/YpcIku2YvZ9Q6rgTn8juPpBlEdzH7YFm9ZOLPImwwJk=
(note the sha256/ added in the beginning)
But if you want do it for more than one website, I strongly suggest to use an addon like Certificate Patrol for Firefox ( https://addons.mozilla.org/fr/firefox/addon/certificate-patrol/ ) as @WhiteWinterWolf suggested.