Skip to content
All tools

Certificate Key Matcher

Confirm whether your SSL certificate, its private key and the CSR belong to the same key pair. Paste or upload any two of the files, or all three, for an instant verdict.

Try an example:

Leave blank if the key isn't password-protected. RSA, EC and Ed25519/Ed448 keys are supported, in PKCS#8, PKCS#1 or SEC1 ("EC PRIVATE KEY") form.

Any two of the three files are enough; add all three for a full three-way check.

How to check that a certificate and private key match

Paste the certificate and the private key, or upload the files, and press Check match. If you still have the CSR you sent to the certificate authority, add it too. You get a separate verdict for each pair: certificate against private key, CSR against certificate and CSR against private key. Run this before installing a certificate — a web server that is handed a certificate and a key from different pairs will refuse to start, or worse, start and silently serve the wrong certificate.

What the matcher compares

A certificate and a CSR each embed a public key. A private key is enough to derive the public key that belongs to it. The matcher extracts all three public keys as SubjectPublicKeyInfo structures, hashes each one with SHA-256 and compares the hashes. Identical fingerprints mean the files share one key pair; different fingerprints mean they come from different key pairs, no matter how similar the subject names look.

RSA and ECC keys

Older guides compare the RSA modulus with openssl x509 -modulus and openssl rsa -modulus. That only works for RSA. Comparing the public-key fingerprint works for RSA, ECDSA and EdDSA alike, which is why this tool — and the OpenSSL commands it shows — use the public key rather than the modulus.

When they do not match

  • The CSR was regenerated. Each run of a CSR generator creates a fresh key pair; a certificate issued from the first CSR only matches the first key.
  • The wrong file was copied from a server with several sites, or a backup restored an older key.
  • A reissue or renewal was done with a new key while the old key stayed in the server configuration.
  • The private key was lost. There is no way to recover it from the certificate; generate a new key and CSR and have the certificate reissued.

Frequently asked questions

Runs entirely in your browser. Certificates, keys and passwords you enter here are processed locally with JavaScript and are never uploaded or sent to any server — nothing is stored, logged or transmitted.