certFingerprintSha256

Colon-separated uppercase-hex SHA-256 of the server certificate's DER encoding (e.g. A1:B2:...). Stable across restarts as long as the same keystore is reused. Pin this on the client.