What does a certificate key matcher do?
A certificate key matcher answers one question: do these two files belong together? It takes a certificate, a bare public key or a signing request on one side and a private key on the other, rebuilds the public half of the private key, and compares the two byte for byte. A match means a server configured with the pair will complete its handshake; a mismatch means it will fail every connection however the configuration is written. Both key fingerprints are shown so the comparison is visible rather than asserted.
Matching on the public half is the only sensible way to do it. A certificate and a private key share exactly one thing — the public key — which the certificate carries in a structure called SubjectPublicKeyInfo. A private key, whether stored as PKCS#8, PKCS#1 or SEC1, contains the same mathematical values. For RSA the rebuild is exact, since the modulus and public exponent sit alongside the secret parts; for an elliptic-curve key the public point is usually stored too, and again the rebuild is exact.
This matters because mismatched pairs are a common cause of a broken deployment and a confusing one to diagnose. A certificate renewed with a fresh key, a key rotated without the certificate being reissued, or two similarly named files from different renewals all produce the same symptom: a server that starts, loads both files without complaint, and then fails every handshake. Running this check before deploying takes seconds and names the problem precisely instead of leaving it to be guessed at from a log line.
How to check a key against a certificate
- Put the certificate, public key or request on the left — paste the PEM text or open the file.
- Put the private key on the right, in PKCS#8, PKCS#1 or SEC1 form.
- Press Compare the pair; the answer is stated in one line before any detail.
- If they match, deploy the pair with confidence; if they do not, check which renewal each file came from.
- Compare the two key fingerprints if you want to confirm the verdict by hand or quote it in a ticket.
- Clear both boxes when you are done, since the right-hand one held a secret.
Certificate Key Matcher limits and rules
| Item | Limit |
|---|---|
| Left side | A certificate, a bare public key, an RSA public key, or a signing request |
| Right side | An unencrypted PKCS#8, PKCS#1 RSA or SEC1 elliptic-curve private key |
| Comparison | A byte-for-byte equality test of the rebuilt public key against the one in the left file |
| Fingerprints | SHA-256 of each public key, shown side by side |
| Encrypted keys | Not supported — the passphrase would be needed, and decrypting here would be a different tool |
| Key types | RSA and elliptic curve; other types are reported rather than guessed at |
| No public point | An elliptic-curve key that omits its public point cannot be matched, and the tool says so |
When to use it
- Confirming that a renewed certificate was issued for the key already on the server.
- Finding out which of two similarly named key files goes with a certificate.
- Checking a pair before a deployment that would otherwise fail every handshake.
- Confirming that a signing request and a key file came from the same generation step.
- Reconciling a certificate against a backup key after a server rebuild.
Is it private?
Both files are read in this page, and the comparison happens in memory. Nothing is uploaded, stored or logged. A private key is a secret, so pasting one into any online tool is a judgement call — prefer running this on the machine that holds the key, and clear the box afterwards if you do not.
Frequently asked questions
No, paste the PEM block whole, including the BEGIN and END lines. The tool reads the armour to work out what kind of file it is — a certificate, a request, a public key or a private key — which is more reliable than guessing from the structure alone. Bare Base64 with the header lines removed is also accepted, as is a raw binary DER file, but the armoured form carries the label that makes the identification unambiguous.
Because reading an encrypted key means decrypting it, which needs the passphrase, and handling a passphrase in a browser tool is a different proposition from parsing a file that has no secrets beyond what is already there. The cipher and key-derivation parameters also vary between encodings, so support would be partial and easy to get wrong. Decrypt the key on the machine that holds it with openssl pkey, then match the unencrypted form here.
Some encoders write an elliptic-curve private key without the optional public point, in which case the public half cannot be recovered by arithmetic alone — it would have to be derived by multiplying the base point, which this tool does not do. The message names the situation rather than reporting a false mismatch. Exporting the key again with a tool that includes the public point, or matching against the certificate on the machine that holds the key, will resolve it.
The modulus is the large part of the key, and comparing it alone catches almost every real mismatch — two unrelated RSA keys sharing a modulus would be an extraordinary coincidence, and more likely a deliberate attack. Even so, a full comparison of the rebuilt public key structure is stricter and costs nothing, so that is what happens here. The result is a genuine equality test on the entire SubjectPublicKeyInfo, not a heuristic on one field.
Because a chain file holds several certificates and only the first is read; the intermediates have their own, different public keys. Matching an intermediate's key against your private key would correctly report a mismatch and confuse the issue. If your file is a chain, split the leaf out first or paste only the first block, and use the ssl-converter tool on this site if you need the pieces separated.
Yes, and it is a useful thing to do. A request carries the same public key the certificate will, so matching a key against the request confirms the pair before anything is issued — which is earlier than you would otherwise find out. The left-hand side accepts a certificate, a bare public key or a request, and reports which of the three it recognised, so the comparison is always against the right kind of material.
Related tools
Written and maintained by Md. Nur Hossain Repon.