Verify that each pinned domain's live TLS chain is covered by the Android Network Security Configuration declared in network_security_config.xml.

go install github.com/ndx-technologies/verify-android-pinned-certs@latest

$ verify-android-pinned-certs -network-security-config ../android/app/src/main/res/xml/network_security_config.xml 
=== Android pins (../android/app/src/main/res/xml/network_security_config.xml) ===
api-2.ndx.one         26
api-3.ndx.one         26

=== verify api-2.ndx.one ===
error: tls dial api-2.ndx.one: dial tcp: lookup api-2.ndx.one: no such host

=== verify api-3.ndx.one ===
chain: 3 certs
[1] leaf         CN=ndx.one                                     SPKI 8rGwA04S8OanpZ5d9pE7niFWqLakdXXjJFKIt/xDIRw=
[2] intermediate CN=WE1                                         SPKI kIdp6NNEd8wsugYyyIYFsi1ylMCED3hZbSR8ZFsa/A4=
[3] root         CN=GTS Root R4                                 SPKI mEflZT5enoR1FuXLgYYGqnVEoZvmf9c2bVBpiOjYQ0c=

api-3.ndx.one        ok    26 pins; chain cert [2] matches kIdp6NNEd8wsugYyyIYFsi1ylMCED3hZbSR8ZFsa/A4=

error : one or more domains are not covered by Android cert pinning
exit status 1