Skip to content
All tools

Certificate Comparison

Put the certificate you have next to the one you are about to install and see exactly what changed: key pair, issuer, names, dates and fingerprints.

Certificate A (current)

Usually the certificate a server is serving today.

Certificate B (new)

Usually the renewal or replacement you are about to install.

Equivalent OpenSSL command

diff <(openssl x509 -in a.pem -noout -text) <(openssl x509 -in b.pem -noout -text)

Prints every line that differs between the two decoded certificates. To check only whether the key pair changed, compare the output of openssl x509 -noout -pubkey for each file.

What to look for before a renewal goes live

A renewed certificate is rarely identical to the one it replaces, and three of the differences cause most of the outages. A new key pair means the old private key will not load. A new issuer means the old intermediate will not chain. A dropped SAN means one hostname stops working while the others look fine. The comparison flags each of these at the top, then lists every field so you can see the rest.

Other uses

  • Compare what a server is serving today against the file in your repository to find out whether a deployment actually took effect.
  • Compare the certificates two different load-balancer nodes present to spot one that was missed during a rollout.
  • Compare a certificate from the CA's portal against one found in Certificate Transparency to check they are the same issuance.

Frequently asked questions

Runs entirely in your browser. Certificates, keys and passwords you enter here are processed locally with JavaScript and are never uploaded or sent to any server — nothing is stored, logged or transmitted.