Cert pin changes

[owenkelley-1]

Description

• Replace the embedded ca_certs.pem file and full X.509 certificate comparison with SPKI (SubjectPublicKeyInfo) hash pinning using base64-encoded SHA-256 hashes
• The pinner now walks the entire certificate chain and succeeds if any certificate's SPKI hash matches a pinned value, rather than only checking the root
• Extract SPKI directly from the certificate's raw DER to compute hashes without platform-specific API dependencies
• Custom certificate roots (via ClientBuilder) are automatically converted to SPKI hashes for consistent pinning behavior
• Remove the embedded ca_certs.pem resource from the build

Motivation and Context

SPKI hash pinning is more resilient to certificate re-issuance — when a CA renews a certificate with the same key pair, the SPKI hash stays the same while the full certificate bytes change. This avoids unnecessary breakage when Duo's CAs rotate certificates. It also aligns with industry standard pinning approaches (RFC 7469, Chrome, curl).

Test plan

• All 116 existing unit tests pass
• New tests verify chain-walking behavior (intermediate match, leaf match, no-match rejection)
• TestGetDuoSpkiHashes confirms all 15 pinned hashes are present
• Integration test against live Duo API to confirm TLS connections succeed with new pinning
• Tested using mitmproxy. Verified app rejected request when proxy was enabled, worked when communicating with Duo. Could not test custom cert piece though.

How Has This Been Tested?

Added unit tests and tested with bundled DLL on ADFS product.

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)