Get Base64 encoded SHA-256 checksum of a public key from a DER encoded certificate. This is useful for creating certificate pinning on Android. See https://developer.android.com/training/articles/security-config#CertificatePinning

extract_pubkey_hash.sh

#!/usr/bin/env bash

if [[ "$(uname)" == "Darwin" ]]; then
  alias sha256sum="shasum -a 256"
fi

function extract_pubkey_hash() {
  openssl x509 -inform der -in "$1" -pubkey -noout | sed -e 's/-----BEGIN PUBLIC KEY-----//' -e 's/-----END PUBLIC KEY-----//' | tr '\n' ',' | sed s/,//g | base64 -d | sha256sum - | awk '{ print $1 }' | xxd -r -p | base64
}

extract_pubkey_hash "$@"