Certificate Pin Lookup
SPKI and Certificate Pins for Any Domain
Enter a hostname to get every certificate it serves or has in the Certificate Transparency logs, each with SPKI SHA-256, SPKI SHA-512 and certificate hashes, validity, key details and ready-to-paste pinning configuration for OkHttp, Android, iOS, TrustKit and the TrustPin CLI.
What does the lookup return?
Whether you call it an SPKI pin lookup, a public key hash generator or a certificate fingerprint tool, the job is the same: turn the certificates a hostname actually uses into pins you can paste into a pinning configuration.
The tool runs the same lookup TrustPin's API and CLI use. It opens a TLS connection to the host on port 443 with SNI and full hostname verification and records the certificate served to an up-to-date client; when the server also holds a certificate of the other key family (an RSA and an ECDSA certificate side by side), a second handshake retrieves that one too. It then reads every unexpired, unrevoked issuance for the name in the public Certificate Transparency logs, including wildcard certificates that cover it, and drops duplicates of the live certificate. Live entries come first; Certificate Transparency entries follow, newest issued first.
For each certificate you get the common name, issuer, subject alternative names, validity window, key algorithm and size, signature algorithm, the number of embedded SCTs, the domain's CAA issuer for live entries, and four pins: SPKI SHA-256 (recommended), SPKI SHA-512, and the SHA-256 and SHA-512 of the certificate itself.
How do I use the pins?
Pick the snippet for your platform under the results. Each one includes every SPKI pin found, so the certificate currently served and the ones already issued for its rotation are all accepted. If you would rather not paste pins at all, trustpin-cli projects refresh-certs performs this lookup and applies the result to your project; see the CLI documentation and the SDK documentation for your platform.
Platform guides: iOS and macOS (URLSession, Alamofire), Android (OkHttp, Retrofit, Ktor), Flutter, React Native and the CLI DevOps guide.
Frequently asked questions
What is an SPKI SHA-256 hash?
An SPKI hash is the SHA-256 digest of a certificate's Subject Public Key Info: the DER-encoded public key together with its algorithm identifier, usually shown base64-encoded. Because it covers only the key, it stays the same across renewals that reuse the key pair and changes whenever the key changes. You can compute one by hand with OpenSSL (openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64); this tool does the same for every certificate a hostname serves or has in Certificate Transparency.
Which pin should I use?
Use the SPKI SHA-256 pin. It hashes the public key rather than the whole certificate, so it survives a renewal that reuses the key, it is what OkHttp, the Android Network Security Config, Apple's NSPinnedDomains and TrustKit expect, and it is the format OWASP recommends. Certificate hashes change at every renewal.
Are the Certificate Transparency results live certificates or future keys?
Certificate Transparency logs record every publicly trusted certificate at issuance, including ones issued ahead of deployment and wildcard certificates that cover the name. Pinning all of their keys means the next rotation is already accepted. Entries whose log record is a precertificate have no certificate hash, because that digest never matches what a server sends; their SPKI pin is still correct.
Why is the tool limited to five lookups per hour?
Each lookup opens TLS connections to the host and queries the Certificate Transparency logs on your behalf. The limit keeps the tool free and available. TrustPin users get the same lookup without limits from the console or with trustpin-cli domains certificates, and projects refresh-certs applies the result directly.
New to pinning? Start with What is certificate pinning? Rotating soon? Read how to rotate certificates in a pinned app.
Stop pasting pins by hand
TrustPin runs this lookup for you, signs the result, and delivers it to installed apps in minutes. The free plan covers one project and two domains with no time limit.