Compare two certificates side by side

Drop an old and a new certificate to see exactly what changed: hostnames (SANs), subject, issuer, key usage, validity, extensions and whether the key was reused. Use it to check a renewal before you deploy it. Everything runs in your browser.

What you can do

• Field-by-field comparison of subject, issuer, SANs, key usage and extended key usage
• Added and removed hostnames listed separately
• Detects key reuse between the two certificates
• Compares validity periods, signature algorithms and key sizes
• Works with PEM, DER and certificates inside PFX files

Frequently asked questions

What should I check before deploying a renewed certificate?

That every hostname from the old certificate is still in the new one's SAN list, that key usage and extended key usage haven't changed, that it chains to the issuer you expect, and that its validity has already started. The diff lists removed hostnames separately so a missing one stands out.

How can I tell whether the renewal reused the old private key?

PKIScope compares the public keys of the two certificates. The same public key means the same private key was reused, which some security policies and CAs don't allow on renewal.

Can I compare a certificate that is inside a PFX file?

Yes. Drop the PFX and enter its password; PEM and DER certificates work too.

Related tools

• Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs
• Expiry calendar — See every certificate's expiry on a timeline and export reminders
• Generator — Create certificates, CSRs and PFX files, or re-issue from a PFX
• Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords