I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one.
One approach would be to extract the certificates using
keytool and the compare the certificates digest e.g.
keytool -exportcert -rfc -alias user_cert -file cert_user1.pem -keystore keystore1.jks -storepass 1234 -v
keytool -exportcert -rfc -alias user_cert -file cert_user2.pem -keystore keystore2.jks -storepass 1234 -v
diff <(openssl x509 -noout -modulus -in cert_user1.pem | openssl md5) <(openssl x509 -noout -modulus -in cert_user2.pem | openssl md5)
Another approach is do compare the digest of the keystore files directly
diff <(openssl md5 keystore1.jks)<(openssl md5 keystore2.jks)
The issue I can think of with these approaches is that they both report a difference if the password of one of the keystore changes. The first approach also "breaks" if the
alias in the keystore changes.
So I think
diff <(openssl md5 keystore1.jks)<(openssl md5 keystore2.jks) is more reliable but I am not sure if using
md5 is a good idea here.
Is there another way?