OkHTTP

certpin.java

public static void main(String[] args) throws IOException {

        String hostname = "api.github.com";
        //run with random key, error says pin hashes
        //or
        /*
        openssl s_client -connect api.github.com:443 | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

        output:
        depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
        verify error:num=20:unable to get local issuer certificate
        verify return:0
        writing RSA key
        VRtYBz1boKOXjChfZYssN1AeNZCjywl77l2RTl/v380=
         */
        CertificatePinner certificatePinner = new CertificatePinner.Builder()
                .add(hostname, "sha256/VRtYBz1boKOXjChfZYssN1AeNZCjywl77l2RTl/v380=")
                .build();
        OkHttpClient client = new OkHttpClient.Builder()
                .certificatePinner(certificatePinner)
                .build();


        Retrofit retrofit = new Retrofit.Builder()
                .client(client)
                .addConverterFactory(ScalarsConverterFactory.create())
                .baseUrl("https://" + hostname)
                .build();

        GithubAPI githubAPI = retrofit.create(GithubAPI.class);
        Call<String> message = githubAPI.getMessage();
        System.out.println(message.execute().body());
    }
}

public interface GithubAPI {
    @GET(value = "/zen")
    Call<String> getMessage();
}

/*gradle dependencies
compile 'com.squareup.retrofit2:retrofit:2.2.0'
compile 'com.squareup.retrofit2:converter-scalars:2.2.0'
*/