An agent that accepts exactly one server certificate, identified by its SHA-256 fingerprint
(trust on first use, confirmed by the user). Chain and host-name checks are skipped for that one
certificate only. Any other certificate, or the same one after it expired (unless the user
accepted that), ends the connection before any request bytes are written.
The check runs when the handshake finishes. Writes are corked until then so that nothing, not
even the Basic-auth header, can be sent to a server whose certificate is not the pinned one.
An agent that accepts exactly one server certificate, identified by its SHA-256 fingerprint (trust on first use, confirmed by the user). Chain and host-name checks are skipped for that one certificate only. Any other certificate, or the same one after it expired (unless the user accepted that), ends the connection before any request bytes are written.
The check runs when the handshake finishes. Writes are corked until then so that nothing, not even the Basic-auth header, can be sent to a server whose certificate is not the pinned one.