RSA & ECC · SPKI SHA-256 comparison

Check Whether an SSL Certificate and Private Key Match.

Use this certificate key matcher before deployment. It compares the certificate and private key locally in your browser without uploading your private key.

Browser-only matching · Your private key is not uploaded

Paste or upload your SSL certificate and private key.

Uploaded files are read locally. Both inputs stay in this browser tab and are discarded when you clear or close the page.

Accepts .pem, .crt, .cer, or .der. If you provide a chain, the first certificate is checked.

Accepts unencrypted .key or .pem files in PKCS#8, RSA PKCS#1, or EC SEC1 format.

Your match result will appear here

The matcher extracts both public keys, normalizes their SPKI data, and compares the bytes and SHA-256 fingerprints.

DEPLOYMENT PREFLIGHT

Check the pair before SSL deployment.

A web server needs the private key that corresponds to the public key inside its certificate. Similar filenames and domain names do not prove that the files belong together. A cryptographic comparison catches a mismatch before a reload fails or causes downtime.

Prevent failed deployment

Verify the pair before updating Nginx, Apache, a load balancer, or a cloud certificate service.

Compare the actual keys

The result comes from canonical public-key bytes, not certificate names, domains, or PEM formatting.

Keep key material local

Parsing, public-key derivation, hashing, and comparison happen inside the current browser tab.

CERTIFICATE KEY MATCHER

How to check if a certificate and private key match.

Prepare the leaf SSL certificate and the private key you expect to use with it. Intermediate CA certificates do not have your server's public key.

  1. 01

    Provide the leaf certificate

    Paste PEM text or upload a .pem, .crt, .cer, or .der file. When a chain is provided, the first certificate is checked.

  2. 02

    Provide the candidate private key

    Paste the key or upload an unencrypted .key or .pem file in PKCS#8, RSA PKCS#1, or EC SEC1 format.

  3. 03

    Select Check Match

    Review the Match or No match decision, both SHA-256 fingerprints, and the certificate identity.

MATCH RESULTS

What your certificate match result means.

Match

The certificate contains the public key derived from this private key. The pair can be configured together on your server.

No match

The public keys differ. Locate the original key or create a new key and CSR before reissuing the certificate.

Cannot parse

Check the PEM boundary lines and use OpenSSL locally if the private key is encrypted or stored in unsupported hardware.

PUBLIC-KEY COMPARISON

How the certificate key matcher works.

The matcher extracts the public key from the X.509 certificate and derives the corresponding public key from the supplied private key. Both are exported as canonical SubjectPublicKeyInfo DER before their bytes are compared.

It also calculates a SHA-256 fingerprint for each public key so you can audit the decision. This works for RSA and supported elliptic-curve keys, while an RSA modulus comparison does not cover ECC.

What a match proves

  • The certificate and private key share the same public key
  • The private key can be configured with this leaf certificate
  • The comparison covers RSA and supported ECC key pairs

A match does not validate the certificate chain, hostname, expiration status, revocation status, or trust.

Check a certificate and private key with OpenSSL.

Run these commands on a trusted machine when the private key is encrypted or organizational policy does not allow browser tools. Identical hashes mean the public keys match.

CERTIFICATE SPKI SHA-256

openssl x509 -in certificate.crt -pubkey -noout \
  | openssl pkey -pubin -outform DER \
  | openssl dgst -sha256

PRIVATE KEY SPKI SHA-256

openssl pkey -in private.key -pubout -outform DER \
  | openssl dgst -sha256

What to do when the certificate and key do not match.

Check the server that created the original CSR, your renewal directory, secret manager, deployment records, and secure backups. Automated renewal may have created a new key while an older certificate or key kept a familiar filename.

A private key cannot be recovered from an SSL certificate. If the correct key is unavailable, generate a new private key and CSR, then ask the certificate authority to reissue the certificate.

Supported formats and limits.

The checker accepts an X.509 certificate as PEM or Base64 DER and unencrypted PKCS#8, RSA PKCS#1, or EC SEC1 private keys. Supported EC curves are P-256, P-384, and P-521.

Encrypted private keys, PFX/PKCS#12 bundles, and hardware-backed non-exportable keys are outside this page's scope. When a certificate chain is pasted, the first certificate is treated as the leaf certificate.

RELATED SSL TOOLS

Check the request or create a replacement.

CSR & Private Key Matcher

Check whether a certificate request was created from a particular private key.

Check CSR & key

CSR Decoder

Inspect the subject, SANs, public key, signature, and requested extensions.

Decode CSR

CSR Generator

Create a new CSR and private key pair locally when the original key is unavailable.

Generate CSR

CERTIFICATE KEY MATCHER FAQ

Common certificate and private key questions.

How do I check if an SSL certificate and private key match?

Paste the complete X.509 certificate and candidate private key, or select their local files. The matcher extracts the certificate public key, derives the public key from the private key, normalizes both as SubjectPublicKeyInfo data, and compares them.

Is it safe to paste a private key into this checker?

The matcher runs locally in your browser. Your certificate and private key are not uploaded, stored, or placed in the URL. Clear the form or close the tab after use, and follow your organization's key-handling policy for production keys.

Does the certificate key matcher support RSA and ECC?

Yes. It compares canonical public-key data instead of an RSA-only modulus, so it supports RSA plus ECDSA private keys on the P-256, P-384, and P-521 curves.

Can I check an encrypted private key?

This page does not request or decrypt private-key passphrases. Use the OpenSSL commands on this page on a trusted machine, or create a temporary unencrypted copy and securely remove it afterward.

What should I do if the certificate and key do not match?

Locate the private key used to create the certificate's original CSR by checking the issuing server, renewal directory, secret manager, and secure backups. If it cannot be recovered, generate a new key and CSR and reissue the certificate.

Can a private key be recovered from an SSL certificate?

No. An SSL certificate contains the public key but not the private key. Cryptographic key design prevents deriving the private key from the certificate.

Why does Nginx report that key values mismatch?

Nginx reports a key mismatch when the configured certificate contains a different public key from the configured private key. Check that the leaf certificate and key belong together and that the certificate file is not an incorrectly ordered chain.