SSL SPKI Pinning & Curl Proxy Toolkit curl --pinnedpubkey

Automate public key fingerprint extraction and TLS MITM verification

Copied to clipboard!

Target & Proxy Parameters

Auto-updates on keystroke
https://

Calculated SPKI Base64 Hash

Dynamic

Change this to any custom sha256 base64 pin, or use the automated one-liner below to calculate it live in bash without manual typing.

ℹ️
Curl format: --pinnedpubkey "sha256//<BASE64_HASH>". Curl checks the Subject Public Key Info (SPKI) rather than the entire leaf cert.
One-Liner

Automated Single Bash Command

Extracts the SPKI pin directly from abc.com into a subshell variable, then runs both direct & proxy verification! 


      

      

        
        Works out-of-the-box on macOS / Linux terminal with OpenSSL and Curl installed.
      

    


    
    

      
      
      

        

          

            
1

            

              
Extract SPKI SHA-256 Base64 Fingerprint

              
Connects to remote server, extracts SubjectPublicKeyInfo and hashes it

            

          

          
        

        

      


      
      

        

          

            
2

            

              
Direct Connection with Pinning Enforced

              
Curl will verify the server's public key matches the sha256 pin (Expected: HTTP 200/Success)

            

          

          
        

        

      


      
      

        

          

            
3

            

              
Proxied Connection (Squid SSL-Bump / Interception)

              
Standard CA trust succeeds via squidCA.crt, but pin check detects MITM key (Expected: SSL pinning failure / curl error 90)

            

          

          
        

        

      


      
      

        

          

            
4

            

              
Full Executable Bash Script (`test_pinning.sh`)

              
Clean, commented bash script with colored terminal output and automatic validation

            

          

          
        

        

      


    


    
    

      

        
What is SPKI Pinning?

        

          Subject Public Key Info (SPKI) pinning binds connections to the cryptographic public key itself instead of the entire certificate. When renewing certificates, keeping the same private key preserves the pin.
        

      


      

        
Why Squid Fails the Pin

        

          Squid SSL-Bump intercepts traffic by generating a dynamic certificate on-the-fly signed by squidCA.crt. Even though Curl trusts the CA, the dynamically generated key does not match the pinned public key hash.
        

      


      

        
Expected Curl Exit Code

        

          When pinning is violated, Curl terminates handshake with curl: (90) SSL: public key does not match pinned public key!, protecting clients from unauthorized interception.