pub fn spki_pin(certificate_pem: &str) -> Result<String>Expand description
Base64 of the SHA-256 of a certificate’s SubjectPublicKeyInfo.
The form a browser wants for a one-launch key pin: Chromium’s
--ignore-certificate-errors-spki-list takes exactly this. Computed here rather than left to
the caller so that nobody has to know that it is the public key info being hashed and not
the certificate — which is the mistake that makes a pin silently never match.
Measured, and the measurement corrected a guess: pinning the authority’s key does not work, because Chromium compares against the certificate it was actually served. The leaf’s pin does.