0

I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one.
One approach would be to extract the certificates using keytool and the compare the certificates digest e.g.

keytool -exportcert -rfc -alias  user_cert -file cert_user1.pem -keystore  keystore1.jks -storepass 1234 -v 

keytool -exportcert -rfc -alias  user_cert -file cert_user2.pem -keystore  keystore2.jks -storepass 1234 -v

diff <(openssl x509 -noout -modulus -in cert_user1.pem | openssl md5) <(openssl x509 -noout -modulus -in cert_user2.pem | openssl md5)

Another approach is do compare the digest of the keystore files directly

diff <(openssl md5 keystore1.jks)<(openssl md5 keystore2.jks)

The issue I can think of with these approaches is that they both report a difference if the password of one of the keystore changes. The first approach also "breaks" if the alias in the keystore changes.

So I think diff <(openssl md5 keystore1.jks)<(openssl md5 keystore2.jks) is more reliable but I am not sure if using md5 is a good idea here.

Is there another way?

1
  • I have used the tags bash and perl because whatever approach I will do in a bash/perl script
    – Jim
    Aug 5, 2023 at 20:51

1 Answer 1

2

md5 is a worst idea. If a single bit changes, the hash will change.

You need to export the contents of each keystore and compare the relevant fields of them, not every single bit of information.For instance, if you don't care about the creation time, you don't need to compare them.

So create a script in perl or bash that opens the keystores, exports only the relevant fields, and compare them. You could, for instance, output the relevant data to a file, and use diff on them.

5
  • If a single bit changes, the hash will change. why is this bad though?
    – Jim
    Aug 6, 2023 at 8:16
  • To give you a bit of a context, they two keystores would contain the same certificates with different expiration dates. I.e. I am trying to see if there is a diff between the keystores which would mean the second would contain the newer issued certificate. If there is a diff I would compare the expiration date. If there is no diff I would not do anything
    – Jim
    Aug 6, 2023 at 8:23
  • So it would be easier to just extract and compare the expiration date. You don't need to test if they are equal and later compare the expiration dates.
    – ThoriumBR
    Aug 6, 2023 at 10:12
  • I thought it could be a minor optimization.
    – Jim
    Aug 6, 2023 at 10:46
  • You would read 2 files once to determine if they are the same, and read both them again when they differ, so 4 times if they are different and 2 if they are the same. If you just compare them, you read 2 files only once.
    – ThoriumBR
    Aug 6, 2023 at 23:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .