SSL Key Matcher
Check that a certificate, its private key and the CSR it came from are all the same key pair — before a server refuses to start.
Everything you paste, private key included, stays in your browser. This tool makes no network request — nothing is uploaded, logged or stored.
The error this prevents
A certificate and a private key are two halves of one pair. Pair the wrong halves and the server refuses to start — key values mismatch in Nginx, certificate and private key do not match in Apache — usually at the worst moment, during a renewal window. Checking first takes a few seconds and is entirely local.
# The OpenSSL equivalent — all three hashes must be identical openssl x509 -noout -modulus -in certificate.crt | openssl md5 openssl rsa -noout -modulus -in private-key.pem | openssl md5 openssl req -noout -modulus -in request.csr | openssl md5
Related
To read what is inside the certificate itself, use the certificate decoder. If no key matches and you need to start again, the CSR generator creates a fresh pair.
Key matcher FAQ
Is it safe to paste a private key into a website?
As a rule, no — and you should be suspicious of any site that asks. This one is built so the question does not arise: the comparison runs as JavaScript in your browser and the page makes no network request, so the key cannot reach us even in principle. Verify it yourself with your browser’s network tab. If you would still rather not, the equivalent OpenSSL commands are below and they are just as good.
How does the matching work?
Every certificate, CSR and private key contains, or lets you derive, the same public key. For RSA that is the modulus; for ECDSA it is the public point on the curve. The tool extracts that value from each thing you paste and compares them byte for byte. Identical values mean one key pair; anything else means they do not belong together.
What does “key values mismatch” mean?
Nginx’s x509 certificate and private key values mismatch, Apache’s certificate and private key do not match, and IIS’s missing private key are all the same fault: the certificate you installed was issued from a different key pair than the key file next to it. It usually happens when a CSR is regenerated and the certificate gets paired with the older key, or when several sites’ files end up in one directory.
Which key formats are supported?
PKCS#8 (BEGIN PRIVATE KEY), traditional PKCS#1 RSA keys (BEGIN RSA PRIVATE KEY) and SEC1 EC keys (BEGIN EC PRIVATE KEY). Encrypted keys are not supported — decrypt with openssl rsa -in key.pem -out decrypted.pem first, and prefer doing so on your own machine.
They do not match. What now?
Find the key that made the CSR this certificate was issued from — it is usually still on the server, often alongside an older certificate. Run the match against each candidate until one agrees. If no key matches, the key is genuinely lost and the certificate cannot be recovered: generate a new CSR and key and reissue. Nothing about the certificate can be changed to fit a different key.
Can I check a certificate against a CSR too?
Yes — fill in any two of the three boxes, or all three. Matching the CSR as well confirms the whole chain of custody: this key made this request, and this certificate was issued from it.
How do I do this with OpenSSL?
Compare the hashes of the moduli — they should be identical: openssl x509 -noout -modulus -in certificate.crt | openssl md5, openssl rsa -noout -modulus -in private-key.pem | openssl md5, and openssl req -noout -modulus -in request.csr | openssl md5. For EC keys, compare openssl ec -in key.pem -pubout with openssl x509 -in cert.crt -pubkey -noout.
More free SSL tools
SSL Checker
Check a live site’s certificate: expiry, issuer, chain and hostname match.
SSL Certificate Decoder
Paste a PEM certificate and read every field — subject, SANs, dates, key, extensions.
CSR Decoder
Check what a certificate signing request actually asks for before you submit it.
CSR Generator
Generate a key pair and CSR in your browser — the key never leaves the page.
SSL Converter
Convert between PEM and DER, and split a bundle into its individual certificates.
Stop checking by hand
SSLNudge checks your live endpoints daily, so a bad deploy or a coming expiry reaches you before your users do.