Plugin.Maui.TlsPin 1.0.2 is presented as a way to apply SPKI SHA-256 pin checks to a specific .NET MAUI HttpClient. Configure the pins on that client with UseTlsPin and AddTlsPin. A mismatch is rejected by default; enabling ReportOnly instead invokes OnPinFailure and allows the request to continue, according to the package walkthrough by NuvyntraLabs.
What the package configures
The NuvyntraLabs walkthrough describes Plugin.Maui.TlsPin 1.0.2 as a pin-checking addition for one named HttpClient, rather than a replacement for the application’s HTTP stack. It uses UseTlsPin followed by AddTlsPin on the relevant client builder, then associates host names with their allowed SPKI hashes through a TlsPinSet.
As an Amazon Associate I earn from qualifying purchases.
The article characterizes UseTlsPin as a no-op registrar and says there is no Current singleton. These are package-specific descriptions from the walkthrough; its linked official documentation and repository could not be independently retrieved. Treat the APIs, package behavior, version status, and platform claims below as source-reported rather than independently verified.
What to pin and how to obtain a value
An SPKI pin is described as a base64-encoded SHA-256 hash of the certificate’s Subject Public Key Info, not a hash of the entire certificate. The walkthrough gives the underlying operation as certificate.PublicKey.ExportSubjectPublicKeyInfo() followed by SHA-256 and base64 encoding, and identifies TlsPin.ComputeSpkiSha256 as a helper that accepts an X509Certificate2.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Configure a primary pin and a backup pin for each pinned host. The walkthrough does not report a live certificate test, so obtain and validate values for your own service and environment rather than copying an example hash.
What happens when configuration or a request fails
Empty configuration
The article says registration throws if the pin dictionary is empty or if a host’s SpkiSha256 list is empty. Check both levels of configuration when the client fails during setup.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Unlisted hosts
RequireHttps is reported to default to true. A host with no configured pins fails closed unless AllowUnpinnedHosts is explicitly enabled. If the same client sends requests to several hosts, each host needs a pin set when unpinned hosts are disallowed.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Pin mismatch
With ReportOnly disabled, the walkthrough says a pin mismatch fails the request. With ReportOnly enabled, it says OnPinFailure runs with a reason such as “pin mismatch” or “unpinned host,” and the request continues. That makes report-only behavior suitable for controlled staging checks, not a production substitute for enforcement: the walkthrough advises turning it off before a store build.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Stage pinning and prepare for key rotation
- Register the pins for the intended client. Use
UseTlsPinandAddTlsPinon the named client’s builder, and include a non-empty pin list for each host that must be pinned. - Verify the configured hashes in staging. The article recommends using
ReportOnlyand observingOnPinFailureto check for incorrect hashes or an unpinned host. Because requests are allowed in this mode, use it only where that trade-off is acceptable. - Turn enforcement on for release. Disable
ReportOnlybefore the store build so a mismatch rejects the request rather than merely being reported. - Configure a backup pin before changing keys. Add the expected backup SPKI hash ahead of a leaf-key rotation. The point is to avoid an unexpected mismatch for installed app versions when the active key changes.
The walkthrough does not specify a rotation schedule, a server-side deployment sequence, or an automatic pin-update mechanism. Coordinate the backup pin with the service’s key rollout and the app release process; do not assume the client can learn a new pin after an enforced mismatch.
Platform and scope claims to verify
The NuvyntraLabs article lists Android, iOS, Mac Catalyst, and Windows, and names net10.0 platform target frameworks. It also says Android needs the INTERNET permission only when the host manifest does not already declare it, iOS needs no extra usage string, and ATS remains enabled when RequireHttps is true. Since package metadata and official documentation were not independently available, confirm the supported target frameworks and platform setup against the package’s current documentation before implementation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When a different HTTP approach may fit better
The package is described as handling pin checks, not the rest of an API client’s lifecycle. The source points to HttpForge for source-generated REST interfaces, ApiResilience for retries, circuit breakers, and offline queues, and SecureSession for access tokens and 401 refresh. These are alternatives named by the article, not independently evaluated recommendations.
If the application already owns a custom HttpClientHandler or platform certificate callback, the walkthrough says a custom callback may be preferable. The practical decision is whether to attach pinning to a named client builder or integrate it into an existing callback, and how that choice preserves fail-closed handling, host scope, and backup-pin rotation.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
