Certificate Key Matcher

The Certificate Key Matcher confirms whether your SSL certificate, its private key, and the CSR belong to the same key pair. Paste or upload any two of the files, or all three, for an instant verdict. It runs entirely on your device, so your private key never leaves your machine.

---

How to Check That a Certificate and Private Key Match

Paste your certificate into the first box, your private key into the second, and your CSR into the third if you have one. Matching runs automatically as you type, or press «Check match» once the fields are filled. Upload buttons accept the files directly if you would rather not copy and paste.

Results come back as three verdicts:

1. Certificate against private key
2. CSR against certificate
3. CSR against private key

A green match on the pair you care about means those files were made together. Run the check before you install the certificate, since a wrong pairing is a common reason installs fail.

---

What the Matcher Compares

Two files belong together when they share the same public key. Your certificate, your CSR, and your private key each carry that public key, so comparing it proves whether they came from one key pair.

The matcher reads the public key from each file and produces a SHA-256 fingerprint of it, the SubjectPublicKeyInfo (SPKI). Identical fingerprints mean identical public keys, which means a real pair. Each panel shows the fingerprint, so you can compare the values yourself or copy them.

---

Match a Certificate, Key, and CSR With OpenSSL

Prefer the command line? Run each file through OpenSSL and compare the output. The three commands below print the SHA-256 fingerprint of the public key, the same value the tool above compares:

openssl x509 -in certificate.crt -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256

openssl pkey -in private.key -pubout -outform der | openssl dgst -sha256

openssl req -in request.csr -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256

When the fingerprints match, the files share a key pair. If even one differs, you have a mismatch.

---

RSA and ECC Keys

The fingerprint method works whether your certificate uses an RSA or an ECC key, because every certificate carries a public key to compare. The matcher detects the type for you and labels it, for instance RSA 2048, beside each result.

Modulus comparison is RSA-only. ECC keys have no modulus, so a command like openssl rsa -modulus returns an error instead of a hash.

Working with an ECC certificate? Compare the public key fingerprint, which is exactly what the tool does on your behalf.

---

When the Certificate and Private Key Do Not Match

A no-match result means the files come from different key pairs. Often the private key was generated by an external tool and never moved to the server, or a control panel such as cPanel or Plesk reused an old key from an earlier order. Reissuing a certificate with a fresh key while the original still sits on the server causes the same clash.

To fix it, find the private key created with your CSR, usually a .key file in your server’s configuration directory. If it is gone, generate a new CSR and key pair, then reissue the certificate so the certificate authority issues one that matches your new key. A private key cannot be recovered from a certificate, so a lost key always means reissuing.

---

Часто задаваемые вопросы