sha256 hash from public key

I am trying to read sha256 has from a public key certificates. The certificate is shown below.

I am running following command to read sha256 hash but it is not giving proper result:

openssl x509 -in test.crt -pubkey -noout | openssl rsa -pubin -outform der | \
  openssl dgst -sha256 -binary | openssl enc -base64

I am getting some wrong value RTy7aSpufwRDWUudgZCwR5Xc7NETd6Imk4YlzvgKTRU=

Correct values are:

sha256/i1RfARNCYn9+K3xmRNTaXG9sVSK6TMgY9l8SDm3MUZ4=
sha256/7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=
sha256/h6801m+z8v3zbgkRHpq6L29Esgfzhj89C1SyUCOQmqU=

I am wondering how three values came in, yes only one is correct but to validate these values i do run sample program given below:

public class Main {

    public static void main(String[] args) throws IOException {
        HttpLoggingInterceptor interceptor = new HttpLoggingInterceptor();
        interceptor.setLevel(HttpLoggingInterceptor.Level.BODY);
        String hostName = "www.google.com";
        CertificatePinner certificatePinner = new CertificatePinner.Builder()
                .add(hostName, "sha256/pqrmt")
                .build();
        OkHttpClient client = new OkHttpClient.Builder()
                .addNetworkInterceptor(interceptor)
                .certificatePinner(certificatePinner)
                .build();
        Request request = new Request.Builder()
                .url("https://" + hostName)
                .build();
        client.newCall(request).execute();

    }
}

Adding wrong key hash give me proper one on error logs, and using proper one allows me to communicate with ease.

Solution

sha256/i1RfARNCYn9+K3xmRNTaXG9sVSK6TMgY9l8SDm3MUZ4=

This pin matches the leaf certificate returned when accessing www.google.com:

$ openssl s_client -connect www.google.com:443 |\
   openssl x509  -pubkey -noout |\
   openssl pkey -pubin -outform der |\
   openssl dgst -sha256 -binary |\
   openssl enc -base64
...
depth=0 ... CN = www.google.com
i1RfARNCYn9+K3xmRNTaXG9sVSK6TMgY9l8SDm3MUZ4=

But, if you have a closer look at the certificate returned when accessing www.google.com you see that is has a CN of www.google.com. Instead the certificate you've included in your question has a CN of *.google.com, i.e. is a different certificate. This certificate is returned for example if you access google.com instead of www.google.com:

$ openssl s_client -connect google.com:443 |\
   openssl x509  -pubkey -noout |\
   openssl pkey -pubin -outform der |\
   openssl dgst -sha256 -binary |\
   openssl enc -base64
...
depth=0 ... CN = *.google.com
RTy7aSpufwRDWUudgZCwR5Xc7NETd6Imk4YlzvgKTRU=

As you can see, the public key fingerprint you had computed was the correct one. Only your assumptions about the correct fingerprints where incorrect because you've checked these against the wrong site.