Skip to content

diff.md

Latest commit

 

History

History
143 lines (107 loc) · 4.53 KB

diff.md

File metadata and controls

143 lines (107 loc) · 4.53 KB

certz diff -- Reference

Compare two certificates side-by-side and highlight which fields changed. Useful when validating renewals, auditing cert rotations, or checking that staging and production certs are equivalent.

See also: inspect | Exit Codes

Usage

certz diff <source1> <source2> [options]

Source types

Each source can be a file path, HTTPS URL, or certificate store thumbprint -- the same auto-detection logic used by certz inspect.

Source Example Notes
File path cert.pem, cert.pfx, cert.der PEM, DER, PFX, .crt, .cer all supported
HTTPS URL https://example.com Fetches the server's leaf certificate
Thumbprint ABC123... (40 hex chars) Requires --store to specify the store name

Options

Option Short Default Description
--password --pass, -p (none) Password for source1 (PFX files)
--password2 --pass2 (none) Password for source2 (PFX files)
--store -s (none) Store name for source1 thumbprint lookup (My, Root, CA)
--store2 (none) Store name for source2 thumbprint lookup
--location -l CurrentUser Store location for source1: CurrentUser or LocalMachine
--location2 CurrentUser Store location for source2: CurrentUser or LocalMachine
--format --fmt text Output format: text or json

Compared Fields

certz diff compares the following fields between the two certificates:

Field Notes
Subject Full Distinguished Name
Issuer Full Distinguished Name
Serial Number Unique per CA issuance
Thumbprint SHA-1 hash of the certificate
Valid From Certificate NotBefore date (UTC)
Valid To Certificate NotAfter date (UTC)
Key Algorithm Algorithm and key size (e.g., ECDSA P-256, RSA 3072 bits)
Signature Algorithm Hash+key algorithm used to sign the cert
SANs Subject Alternative Names (comma-joined)
Key Usage e.g., Digital Signature, Key Encipherment
Enhanced Key Usage e.g., Server Authentication, Client Authentication
Is CA Whether the certificate has the CA basic constraint
Path Length CA path length constraint (shown only for CA certs)

Examples

File comparisons

# Compare two PEM certificates
certz diff old.pem new.pem

# Compare two PFX files with separate passwords
certz diff old.pfx new.pfx --password OldPass --password2 NewPass

# Compare a PFX with a PEM
certz diff server.pfx server.pem --password MyPass

# Compare a local cert with a live server cert
certz diff cert.pem https://example.com

JSON output

certz diff old.pem new.pem --format json
{
  "success": true,
  "areIdentical": false,
  "differenceCount": 3,
  "source1": "old.pem",
  "source2": "new.pem",
  "fields": [
    { "name": "Serial Number", "leftValue": "3F2A",       "rightValue": "7C9B",       "status": "changed" },
    { "name": "Valid From",    "leftValue": "2024-01-01", "rightValue": "2025-01-01", "status": "changed" },
    { "name": "Valid To",      "leftValue": "2024-04-01", "rightValue": "2025-04-01", "status": "changed" },
    { "name": "Subject",       "leftValue": "CN=api.local", "rightValue": "CN=api.local", "status": "unchanged" }
  ]
}

Store thumbprint comparison

certz diff <thumbprint1> <thumbprint2> --store My --store2 My

Text output format

The text output shows a four-column table: Property, Left, Right, Status.

  • Changed fields: property name and values highlighted in yellow/red/green
  • Unchanged fields: dimmed with unchanged marker
  • Footer shows the resolved paths for both sources
+------------------+-------------------+-------------------+-----------+
| Property         | Left              | Right             | Status    |
+------------------+-------------------+-------------------+-----------+
| Serial Number    | 3F2A              | 7C9B              | changed   |
| Valid From       | 2024-01-01 UTC    | 2025-01-01 UTC    | changed   |
| Valid To         | 2024-04-01 UTC    | 2025-04-01 UTC    | changed   |
| Subject          | CN=api.local      | CN=api.local      | unchanged |
+------------------+-------------------+-------------------+-----------+

  Left:  old.pem
  Right: new.pem

Exit codes

Code Meaning
0 Certificates are identical (all fields match)
1 Certificates differ OR source could not be loaded