What is the best way to compare two SSL certificates? Are there any authoritative tools? The reason I want to do this is I have 2 certificates, seemingly with the same properties, but one works and the other one doesn't. Just to be clear, I want to compare the attributes, I know the signatures won't match due to them being issued at different times.

  • 1
    Have you tried dumping both as text and compared them with a suitable diff tool?
    – kasperd
    May 21, 2018 at 19:08
  • I didn't realize that was an options :-) - You should leave it as an answer.
    – Matt
    May 21, 2018 at 19:08

6 Answers 6


Packet capture clients using each on the wire. Use a tool that can do a bit of analysis on the conversations like Wireshark. Or get fancy and use wire data analytics products like ExtraHop, Dynatrace, or LANGuardian. The advantage here is that you see the actual TLS implementations in use. Not likely that one of the implementations is broken, but it is possible.

For looking at certs, OpenSSL is not the only game in town, any operating system you might use a cert on will have utilities to query them. The PowerShell pki module is neat because you can filter by or look at any or all properties.


If one cert works and the other does not, then my first suspect is that both certs did not originate from the same private key.

Start by checking that both certs actually are the same

$ openssl x509 -noout -modulus -in server.nr1.crt | openssl md5
$ openssl x509 -noout -modulus -in server.nr2.crt | openssl md5

If these both came from the same csr, then the md5 will match.

Check the certs against the private key as follows to ensure the cert and private key match up:

$ openssl x509 -noout -modulus -in server.crt | openssl md5
$ openssl rsa -noout -modulus -in server.key | openssl md5

The output md5 hash values should match.

You can check your csr also to ensure that it matches your private key and cert.

$ openssl req -noout -modulus -in server.csr | openssl md5

Openssl provides a tool to decode them:

openssl x509 -text -in bla.pem

You could subsequently use vimdiff to compare them, or any other diffing tool.

One guess is that if you included the proper domain names, did you also include them as 'subject alternative name'?


Your both certificates can be fully identical (without serial number and issue date), but one is working successfully and another doesn't. It may be because the serial number of another certificate is listed in CRL(certificate revocation list).

From Wikipedia:

A certificate revocation list (or CRL) is "a list of digital certificates that have been revoked by the issuing certificate authority (CA) before their scheduled expiration date and should no longer be trusted.

  • It can be pinning too and many other reasons.
    – nethero
    Jul 19, 2021 at 8:32

I've seen many poor answers to the question. The x509 certificate is not in arbitrary order nor they're displayed in an arbitrary order so eye-balling them with openssl decoding is not a good practice. On a similar thread someone proposed use of diff which is also not going to work. You should skip -text option, and add -noout

Below is the list of options you can add to the output for comparison: -serial -subject_hash -issuer_hash -hash -subject -issuer -email -startdate -enddate -purpose -dates -modulus -pubkey -fingerprint -alias -noout -nocert -ocspid -ocsp_uri -trustout -clrtrust -clrext -addtrust -addreject -setalias -days -checkend

So if you want to compare the fingerprints of two certs and their modulus you would do this: diff <(openssl x509 -in cert1.pem -modulus -fingerprint) <(openssl x509 -in cert2.pem -modulus -fingerprint)


To view certificate details once you have them locally (e.g. PEM-encoded file) you can use:

  • Your OS's built-in tools (e.g. on Windows try changing file extension to .crt then double-clicking to open with Crypto Shell Extensions)
  • An open source program like openssl, e.g. openssl x509 -in cert_file_to_read.pem -text -noout (As another answer mentions, WireShark can also be used both to obtain and view the certificates)
  • An online tool like certdecoder.

If you need to obtain/download the certificates then check out this answer as well as this one. There is also a handy online tool at sslchecker.com/ which can do this for Internet facing HTTPS servers. Depending on the application, using a web browser such as Chromium may also provide this information (usually by clicking on the red/green "lock icon").

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .