如何导出证书的 SPKI Fingerprint

openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64

或者参见https://datatracker.ietf.org/doc/html/draft-ietf-websec-key-pinning-21#appendix-A