How Do We Generate a Base64-Encoded SHA256 Hash of SubjectPublicKeyInfo of an X.509 Certificate, for Android N Certificate Pinning?
<p>The documentation in the N Developer Preview for their network security configuration offers these instructions:</p>

<blockquote>
  <p>Certificate pinning is done by providing a set of certificates by hash of the public key (SubjectPublicKeyInfo of the X.509 certificate). A certificate chain is then only valid if the certificate chain contains at least one of the pinned public keys. </p>
</blockquote>

<p>The XML that they show is broken (missing a closing tag), but otherwise suggests that the hash is SHA256 and encoded base64:</p>

<pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
&lt;network-security-config&gt;
    &lt;domain-config&gt;
        &lt;domain includeSubdomains="true"&gt;example.com&lt;/domain&gt;
        &lt;pin-set expiration="2018-01-01"&gt;
            &lt;pin digest="SHA-256"&gt;7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=&lt;/pin&gt;
            &lt;!-- backup pin --&gt;
            &lt;pin digest="SHA-256"&gt;fwza0LRMXouZHRC8Ei+4PyuldPDcf3UKgO/04cDM1oE=&lt;/pin&gt;
    &lt;/domain-config&gt;
&lt;/network-security-config&gt;
</code></pre>

<p>How do we create such a hash?</p>

<p>I tried the approach in <a href="https://gist.github.com/woodrow/9130294" rel="noreferrer">this gist</a>, but <code>openssl x509 -inform der -pubkey -noout</code> is not liking my CRT file. I cannot readily determine if the problem is in the CRT file, the instructions, my version of <code>openssl</code>, or something else.</p>

<p>Does anyone have a known good recipe for creating this hash?</p>