Pinned

Trust a certificate only if the SHA-256 of its subject public key info matches one of sha256.

Pinning the key rather than the certificate is what lets a server renew without the client being rebuilt, as long as the key is kept. Pin more than one: a pin set with a single entry becomes an outage the moment that key has to be rotated in a hurry.

openssl x509 -in server.pem -pubkey -noout |
  openssl pkey -pubin -outform der |
  openssl dgst -sha256 -binary | base64