openssl x509 -pubkey < /etc/letsencrypt/archive/tollwerk.de/cert1.pem | \
    openssl pkey -pubin -outform der | \
    openssl dgst -sha256 -binary | base64