Certificate Pin Lookup
SPKI and Certificate Pins for Any Domain
Enter a hostname to get every certificate it serves or has in the Certificate Transparency logs, each with SPKI SHA-256, SPKI SHA-512 and certificate hashes, validity, key details and ready-to-paste pinning configuration for OkHttp, Android, iOS, TrustKit and the TrustPin CLI.
What does the lookup return?
The tool runs the same lookup TrustPin's API and CLI use. It opens a TLS connection to the host on port 443 with SNI and full hostname verification and records the certificate served to an up-to-date client; when the server also holds a certificate of the other key family (an RSA and an ECDSA certificate side by side), a second handshake retrieves that one too. It then reads every unexpired, unrevoked issuance for the name in the public Certificate Transparency logs, including wildcard certificates that cover it, and drops duplicates of the live certificate. Live entries come first; Certificate Transparency entries follow, newest issued first.
For each certificate you get the common name, issuer, subject alternative names, validity window, key algorithm and size, signature algorithm, the number of embedded SCTs, the domain's CAA issuer for live entries, and four pins: SPKI SHA-256 (recommended), SPKI SHA-512, and the SHA-256 and SHA-512 of the certificate itself.
How do I use the pins?
Pick the snippet for your platform under the results. Each one includes every SPKI pin found, so the certificate currently served and the ones already issued for its rotation are all accepted. If you would rather not paste pins at all, trustpin-cli projects refresh-certs performs this lookup and applies the result to your project; see the CLI documentation and the SDK documentation for your platform.
Frequently asked questions
Which pin should I use?
Use the SPKI SHA-256 pin. It hashes the public key rather than the whole certificate, so it survives a renewal that reuses the key, it is what OkHttp, the Android Network Security Config, Apple's NSPinnedDomains and TrustKit expect, and it is the format OWASP recommends. Certificate hashes change at every renewal.
Why does the tool show certificates the server is not serving?
Certificate Transparency logs record every publicly trusted certificate at issuance, including ones issued ahead of deployment and wildcard certificates that cover the name. Pinning all of their keys means the next rotation is already accepted. Entries whose log record is a precertificate have no certificate hash, because that digest never matches what a server sends; their SPKI pin is still correct.
Why is the tool limited to five lookups per hour?
Each lookup opens TLS connections to the host and queries the Certificate Transparency logs on your behalf. The limit keeps the tool free and available. TrustPin users get the same lookup without limits from the console or with trustpin-cli domains certificates, and projects refresh-certs applies the result directly.
New to pinning? Start with What is certificate pinning?