For you first point i.e. How to generate SHA256 hex string from PEM file

Method 1:

Get public key via terminal command-

Step 1: If you have the pem file with you please use the below openSSL command to get the public key.

openssl rsa -in inputPemFile.pem -pubout -out outputPublicKey.pem

Here, please do make sure your PEM file is in correct format which contains the private key.

Step 2: Now, use below command to extract/read the public key from outputPublicKey.pem file

cat public_key.pem

Method 2:

Direct method

Step 1: Open Qualys SSL Labs

Step 2: Enter your domain hostname from which you want to extract the public key e.g. https://www.google.com/ and press submit button

Step 3: In the next screen you will get your SHA256 public key, see reference image below

==========================================================================

For you second point i.e. Implement root certificate public key pinning?

Now, if you are using url session then use URL session delegate method i.e. // User defined variables

private let rsa2048Asn1Header:[UInt8] = [
    0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
    0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00
]

private let yourPublicKey: "Your Public Key"

// MARK: URL session delegate:

func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    // your code logic
}

Find below the logic which I basically used:

    //MARK:- SSL Pinning with URL Session
func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
    
    var res = SecTrustResultType.invalid
    guard
        challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
        let serverTrust = challenge.protectionSpace.serverTrust,
        SecTrustEvaluate(serverTrust, &res) == errSecSuccess,
        let serverCert = SecTrustGetCertificateAtIndex(serverTrust, 0) else {
        completionHandler(.cancelAuthenticationChallenge, nil)
        return
    }
    
    if #available(iOS 12.0, *) {
        if let serverPublicKey = SecCertificateCopyKey(serverCert), let serverPublicKeyData = SecKeyCopyExternalRepresentation(serverPublicKey, nil) {
            
            let data: Data = serverPublicKeyData as Data
            let serverHashKey = sha256(data: data)
            print(serverHashKey, serverHashKey.toSHA256())
            //comparing server and local hash keys
            if serverHashKey.toSHA256() == yourPublicKey {
                print("Public Key pinning is successfull")
                completionHandler(.useCredential, URLCredential(trust: serverTrust))
            } else {
                print("Public Key pinning is failed")
                completionHandler(.cancelAuthenticationChallenge, nil)
            }
        }
    } else {
        // Fallback on earlier versions
        if let serverPublicKey = SecCertificateCopyPublicKey(serverCert), let serverPublicKeyData = SecKeyCopyExternalRepresentation(serverPublicKey, nil) {
            
            let data: Data = serverPublicKeyData as Data
            let serverHashKey = sha256(data: data)
            print(serverHashKey, serverHashKey.toSHA256())
            //comparing server and local hash keys
            if serverHashKey.toSHA256() == yourPublicKey {
                print("Public Key pinning is successfull")
                completionHandler(.useCredential, URLCredential(trust: serverTrust))
            } else {
                print("Public Key pinning is failed.")
                completionHandler(.cancelAuthenticationChallenge, nil)
            }
        }
    }
}

Helper function to convert server certificate to SHA256

private func sha256(data : Data) -> String {
    var keyWithHeader = Data(rsa2048Asn1Header)
    keyWithHeader.append(data)
    var hash = [UInt8](repeating: 0,  count: Int(CC_SHA256_DIGEST_LENGTH))
    
    keyWithHeader.withUnsafeBytes {
        _ = CC_SHA256($0.baseAddress, CC_LONG(keyWithHeader.count), &hash)
    }
    return Data(hash).base64EncodedString()
}

If you are using Alamofire, then pass the domain path in the evaluators data in your alamofire session like below

    let evaluators: [String: ServerTrustEvaluating] = [
    "your.domain.com": PublicKeysTrustEvaluator(
        performDefaultValidation: false,
        validateHost: false
    )
]
let serverTrustManager = ServerTrustManager(evaluators: evaluators)
let session = Session(serverTrustManager: serverTrustManager)

Now use this session while calling your alamofire network request.

Hope, I will be able to help you here.

Thanks and regards.