Avoid lost-key issuance
Confirm you still hold the private key required to install the certificate produced from this CSR.
RSA & ECC · SPKI SHA-256 comparison
Check Whether a CSR and Private Key Match.
Check CSR and private key match online before requesting or installing an SSL certificate. The matcher compares their public keys locally in your browser without uploading your private key.
Browser-only matching · Your private key is not uploaded
Paste or upload your CSR and private key.
Uploaded files are read locally. Both inputs stay in this browser tab and are discarded when you clear or close the page.
Accepts .csr, .p10, .req, .pem, or .der PKCS#10 requests.
Accepts unencrypted .key or .pem files in PKCS#8, RSA PKCS#1, or EC SEC1 format.
Your match result will appear here
The matcher extracts both public keys, compares their canonical SPKI bytes, and verifies the CSR self-signature.
CSR KEY PREFLIGHT
Check the pair before certificate issuance.
A CSR contains a public key and is signed by its corresponding private key. Filenames and domain names do not prove that two files belong together. A cryptographic comparison prevents submitting a request for a private key you no longer have.
Compare the actual keys
The decision uses canonical public-key bytes, not filenames, subjects, domains, or PEM formatting.
Keep key material local
Parsing, normalization, hashing, and comparison all happen inside the current browser tab.
CHECK CSR AND PRIVATE KEY MATCH
How to check if a CSR and private key match.
You need the complete CSR and the private key that you believe created it. Do not rely on matching filenames.
- 01
Add the complete CSR
Paste the PEM content or upload a .csr, .p10, .req, .pem, or .der PKCS#10 request.
- 02
Add the candidate private key
Paste the PEM content or upload an unencrypted .key or .pem file. The value remains in this tab.
- 03
Select Check Match
Review the Match or No match decision, both SPKI SHA-256 fingerprints, and the CSR signature status.
MATCH RESULTS
What your CSR match result means.
Match
The CSR contains the public key derived from this private key. Keep the private key secure and submit the CSR to your certificate authority.
No match
The two public keys differ. Locate the original key or generate a new key and CSR pair before requesting or installing a certificate.
Cannot parse
Check the PEM boundary lines, make sure neither input is truncated, and use OpenSSL locally when the private key is encrypted.
PUBLIC-KEY COMPARISON
How the CSR and private key matcher works.
The matcher extracts the public key embedded in the CSR and derives the public key from the supplied private key. Both keys are exported as canonical SubjectPublicKeyInfo (SPKI) DER before their bytes are compared.
It also calculates a SHA-256 fingerprint for each SPKI value, so you can audit the decision. This approach works for RSA and supported elliptic-curve keys; an RSA modulus comparison does not work for ECC.
What a match proves
- The CSR and private key contain the same public key
- The CSR can be verified with its embedded public key
- The private key can be used with a certificate issued from this CSR
A match does not prove domain ownership, validate the CSR subject, or guarantee certificate issuance.
Check CSR and private key match with OpenSSL.
Run these commands on a trusted machine when the private key is encrypted or your policy does not allow browser tools. Matching hashes mean the public keys are identical.
CSR SPKI SHA-256
openssl req -in request.csr -pubkey -noout \
| openssl pkey -pubin -outform DER \
| openssl dgst -sha256PRIVATE KEY SPKI SHA-256
openssl pkey -in private.key -pubout \
| openssl pkey -pubin -outform DER \
| openssl dgst -sha256What to do when the CSR and private key do not match.
Check the machine that generated the CSR, your renewal directory, secret manager, deployment records, and secure backups. A renewal may have produced a new private key while the old CSR or certificate kept the same filename.
A private key cannot be recovered from a CSR. If the correct key is unavailable, generate a new private key and CSR pair, then submit the new request or ask the CA to reissue the certificate.
Supported formats and limits.
Paste PKCS#10 CSR PEM or Base64 DER, or upload a .csr, .p10, .req, .pem, or .der file. Private keys can be pasted or uploaded as unencrypted .key or .pem files in PKCS#8, RSA PKCS#1, or EC SEC1 format. Supported EC curves are P-256, P-384, and P-521.
Encrypted private keys, certificates, PFX/PKCS#12 bundles, and hardware-backed non-exportable keys are intentionally outside this page's scope. Use OpenSSL or your key-management system for those formats.
RELATED CSR TOOLS
Inspect or replace the request.
CSR Decoder
Decode the subject, SANs, public key, signature, and requested extensions before submitting the CSR.
Decode CSRCSR Generator
Create a new CSR and private key pair locally when the current files do not match or the original key is lost.
Generate CSRCertificate Key Matcher
Compare an issued SSL certificate with its private key before installing it on a server.
Check certificate & keyPKCS#1 / PKCS#8 Converter
Private and public key format conversion between PKCS#1 and PKCS#8 when a server expects a different PEM header.
Convert key formatCSR AND PRIVATE KEY MATCHING FAQ
Common CSR and private key questions.
How do I check if a CSR and private key match?
Paste or upload the complete Certificate Signing Request and private key. The matcher extracts the public key from each input, converts both to canonical SubjectPublicKeyInfo data, and compares them. Identical public keys mean the CSR and private key match.
Is it safe to paste a private key into this checker?
The comparison runs locally in your browser. The CSR and private key are not sent to our server, stored, or added to the URL. Clear the form or close the tab when you finish. Follow your organization's key-handling policy for production keys.
Does the CSR matcher support RSA and ECC keys?
Yes. It compares canonical public keys instead of using the RSA-only modulus method, so it supports RSA as well as ECDSA keys on the P-256, P-384, and P-521 curves.
Can I check an encrypted private key?
This version does not request or decrypt private-key passphrases. Use the OpenSSL commands on this page when the key is encrypted, or create a temporary unencrypted copy on a trusted machine and remove it immediately afterward.
What should I do if the CSR and private key do not match?
Look for the private key created at the same time as the CSR. Check the original server, renewal directory, secret manager, and backups. If you cannot recover it, generate a new private key and CSR, then submit the new CSR or request certificate reissuance.
Is comparing the RSA modulus enough?
A modulus comparison works for RSA, but it does not cover elliptic-curve keys. This matcher compares the complete normalized public-key structure and reports a SHA-256 fingerprint, which works consistently for both RSA and supported ECC keys.
Can this page match a certificate with a private key?
No. This page is deliberately focused on checking a CSR against its private key. Use it before sending the CSR to a certificate authority. Certificate matching is a separate operation and is not inferred from names or filenames.