How to Mock Certificate Pinning with SPKI Hash in Python

import hashlib
import base64
import ssl
import socket

class MockCertificatePinner:
    """Demonstrates SPKI hash pinning for certificate validation."""
    
    def __init__(self, pinned_spki_hashes):
        self.pinned_hashes = set(pinned_spki_hashes)
    
    def get_spki_hash(self, cert_pem):
        """Compute the SPKI SHA-256 hash of a certificate."""
        # Decode PEM certificate
        cert_der = ssl.PEM_cert_to_DER_cert(cert_pem)
        
        # Parse certificate to extract SubjectPublicKeyInfo
        pkey = ssl._ssl._test_decode_cert(cert_der)["subjectPublicKeyInfo"]
        
        # Compute SHA-256 hash of SPKI
        digest = hashlib.sha256(pkey).digest()
        return base64.b64encode(digest).decode()
    
    def verify(self, cert_pem):
        """Verify that certificate's SPKI hash matches a pinned hash."""
        actual_hash = self.get_spki_hash(cert_pem)
        return actual_hash in self.pinned_hashes, actual_hash

# Example usage with a self-signed cert
pinner = MockCertificatePinner({"QmFzZTY0IGhhc2ggZXhhbXBsZQ=="})

# Mock certificate (in real usage, get from SSL handshake)
mock_cert = """
-----BEGIN CERTIFICATE-----
MIICpDCCAYwCAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwObW9jay1leGFt
-----END CERTIFICATE-----
"""

if __name__ == "__main__":
    is_valid, actual = pinner.verify(mock_cert)
    print(f"Certificate valid: {is_valid}")
    print(f"Actual SPKI hash: {actual}")
    print(f"Pinned hashes: {pinner.pinned_hashes}")