by BizMaC Tiếng Việt

ToolsCertificate key matcher

Certificate key matcher

Check that a certificate, CSR and private key belong together

A private key should not be pasted into any website. This tool works inside your browser and sends nothing to our server, but the safest way is the OpenSSL commands below, run on the server itself. If you pasted a live private key into some other site, make a new key and have the certificate reissued.

Fill in at least 2 of the 3 boxes. The tool detects what you pasted, so the box does not matter.

Everything is processed on your own device and never sent to our server.

Check with OpenSSL, no pasting needed

Run these on the server that holds the files, with your own file names. Identical output lines mean a match, and they equal the public key hash shown above.

Public key hash of the certificate:

openssl x509 -in certificate.crt -noout -pubkey | openssl sha256

Public key hash of the CSR:

openssl req -in request.csr -noout -pubkey | openssl sha256

Public key hash of the private key (the key never leaves the server):

openssl pkey -in private.key -pubout | openssl sha256

Check that a certificate, CSR and private key match

An SSL certificate only works with the private key that made its CSR. When a server complains that the key does not match, this tool compares the public key inside the certificate, CSR and private key to show which files belong together.

Why doesn’t my certificate match the key?

Usually the .key file is from a different CSR, or the certificate was reissued from a new CSR. Find the key that made the CSR, or make a new CSR and have the certificate reissued.

Is it safe to paste a private key here?

The tool works in your browser and sends nothing to our server. Still, a private key should not be pasted into any website: the safest way is the OpenSSL commands on this page, run on the server. If you pasted a live key into another site, make a new key and have the certificate reissued.

What does it compare?

The public key. For RSA keys that is the modulus and exponent, for ECC keys the curve and public point. A certificate, CSR and private key from the same key pair have identical values.