title: How Do We Generate a Base64-Encoded SHA256 Hash of SubjectPublicKeyInfo of an X.509 Certificate, for Android N Certificate Pinning?
body: <p>The documentation in the N Developer Preview for their network security configuration offers these instructions:</p>
  
  <blockquote>
    <p>Certificate pinning is done by providing a set of certificates by hash of the public key (SubjectPublicKeyInfo of the X.509 certificate). A certificate chain is then only valid if the certificate chain contains at least one of the pinned public keys. </p>
  </blockquote>
  
  <p>The XML that they show is broken (missing a closing tag), but otherwise suggests that the hash is SHA256 and encoded base64:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;network-security-config&gt;
      &lt;domain-config&gt;
          &lt;domain includeSubdomains="true"&gt;example.com&lt;/domain&gt;
          &lt;pin-set expiration="2018-01-01"&gt;
              &lt;pin digest="SHA-256"&gt;7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=&lt;/pin&gt;
              &lt;!-- backup pin --&gt;
              &lt;pin digest="SHA-256"&gt;fwza0LRMXouZHRC8Ei+4PyuldPDcf3UKgO/04cDM1oE=&lt;/pin&gt;
      &lt;/domain-config&gt;
  &lt;/network-security-config&gt;
  </code></pre>
  
  <p>How do we create such a hash?</p>
  
  <p>I tried the approach in <a href="https://gist.github.com/woodrow/9130294" rel="noreferrer">this gist</a>, but <code>openssl x509 -inform der -pubkey -noout</code> is not liking my CRT file. I cannot readily determine if the problem is in the CRT file, the instructions, my version of <code>openssl</code>, or something else.</p>
  
  <p>Does anyone have a known good recipe for creating this hash?</p>