Private key and certificate matcher

An online tool for checking that a private key really belongs to a certificate. It derives the public key from the private key and compares it with the one inside the certificate, so the answer is definitive rather than a hint. Handles RSA and elliptic-curve keys, encrypted keys in either the PKCS#8 or the legacy OpenSSL form, and .pfx / .p12 bundles.

How to use it

1
Add the key

Paste it, drop the file onto the left box, or pick it with the button. A .pfx works too — the key inside it is used.

2
Add the certificate

On the right. A CSR or a bare public key is accepted as well.

3
Enter a password if asked

The password field appears only when the key you provided turns out to be encrypted.

4
Read the answer

The comparison runs as soon as both boxes are filled. Both public keys are shown so you can check them by eye or against your own tooling.

Find out in one step whether a key and a certificate belong together

Paste, drop a file here, or
Paste, drop a file here, or

What it does

Compares the whole public key
The usual recipe — comparing an MD5 of the RSA modulus — only works for RSA, and quietly compares nothing at all for an EC key. This compares the complete SubjectPublicKeyInfo, so the answer is right for every key type.
Opens the key you actually have
PKCS#8, PKCS#1, SEC1, encrypted PKCS#8, the legacy "Proc-Type: 4,ENCRYPTED" form from old OpenSSL, and .pfx / .p12 bundles including the old Windows RC2-40 export.
Works against a CSR too
Compare a key with a certificate signing request to confirm that the request you are about to send was made from the key you still have.
Names the likely cause
When the two do not match it says why the server refuses to start, and if the key and certificate use different algorithms it points that out — the usual sign that one of the two files is left over from a previous reissue.
Runs in the browser
Parsing, decryption and comparison all happen in your tab using the WebCrypto API.

Frequently asked questions

nginx says "key values mismatch" — is this the same thing?

Yes. That error, and Apache's "Unable to configure RSA server private key", both mean the server loaded a certificate and a key whose public keys differ. This tool tells you which pair is wrong before you restart the server, and whether the two files are even the same algorithm.

How is this different from comparing modulus hashes?

The classic recipe runs openssl rsa -modulus and openssl x509 -modulus and compares the MD5 of each. It works, but only for RSA: run it against an EC key and openssl prints nothing for the modulus, so two empty strings hash identically and the check appears to pass for any pair. Comparing the full SubjectPublicKeyInfo has no such blind spot.

Can it open an encrypted key?

Yes, in all three common forms: modern encrypted PKCS#8, the legacy OpenSSL PEM with a "Proc-Type: 4,ENCRYPTED" header, and .pfx / .p12 bundles — including old Windows exports that use RC2-40, which browser-based tools normally cannot read at all.

The key and certificate do not match. What now?

One of them is from a different issuance. The usual cause is a renewal where a new key was generated but the old certificate is still deployed, or the reverse. If you have the CSR that was sent to the CA, compare the key against that: if they match, the certificate you were given belongs to a different request and you need the right file from your CA. If they do not, the key has been replaced and the certificate has to be reissued from the key you still hold.

You May Also Like

📝 CSR generator ⛓️ Certificate chain fixer 🔄 Certificate format converter 🧰 Let’s Encrypt troubleshooter 🔐 SSL Checker 📜 SSL certificate decoder 🏷️ Self-signed certificate generator

How do you rate this tool?

Thank you for your rating!
Want to share more? Leave a comment!
Thank you! Your comment will appear after moderation.
Who is this tool for?
💻 Developers & IT Pros 🔒 Security & Privacy
Published Updated Author: