SSL & Security

Certificate Key Matcher

Key Match

Match Certificate and Key

Upload or paste your certificate and private key to verify they are correctly paired.
Certificate Content
Paste or upload your certificate
Private Key Content
Paste or upload your private key

Tool features

Professional certificate and key matching for secure SSL/TLS configuration
4 checks

Secure Matching

Verify certificate and key pairing using secure hash comparison

Multiple Key Formats

Support for RSA and PKCS#8 private key formats

Instant Verification

Quick validation to ensure certificate and key are correctly paired

File Upload Support

Upload certificate and key files directly or paste PEM content

What is certificate–key matching & how it works

Why a certificate only works with one private key

Every certificate contains a public key, and only one private key can complete a TLS handshake for it. If your server is configured with a private key from a different key pair, the web server refuses to start or clients fail with key-mismatch errors.

This tool derives the public key from both inputs, encodes each as DER (SubjectPublicKeyInfo) and compares their SHA-256 hashes. Identical hashes mean the certificate and private key belong to the same key pair.

Key pair
A private key and the public key mathematically derived from it.
SPKI
SubjectPublicKeyInfo: the standard encoding of a public key and its algorithm.
SHA-256 digest
A fingerprint of the public key; equal digests mean an identical key.

How to use this tool

Check a certificate against its private key in four steps
1
Add the certificate
Paste the PEM certificate or upload the .crt / .pem file.
2
Add the private key
Paste or upload the PEM private key (PKCS#1 RSA or PKCS#8).
3
Compare
Run the check to hash the public key from each input and compare the digests.
4
Fix a mismatch
If they differ, find the key generated with the certificate’s CSR, or reissue the certificate with a new CSR.

Related tools

Keep debugging with tools from the same suite
3 tools
Certificate CSR Matcher
Verify if SSL certificate matches its Certificate Signing Request (CSR)
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment

Frequently asked questions

Common questions about matching certificates and private keys
5 Q&A

Both must contain the same public key. This tool compares SHA-256 hashes of the public key taken from each. Locally you can compare openssl x509 -noout -pubkey -in cert.pem | openssl sha256 with openssl pkey -pubout -in key.pem | openssl sha256.

Nginx reports key values mismatch, Apache logs AH02565 or refuses to start, and other servers report that the private key does not match the certificate public key.

Treat any private key as sensitive. The key is used in server memory only to derive its public half and is not stored or logged, but for production keys the OpenSSL commands above let you run the same check without the key leaving your machine.

PEM private keys in PKCS#1 (BEGIN RSA PRIVATE KEY) and PKCS#8 (BEGIN PRIVATE KEY) format, for RSA and EC keys.

No. A certificate only contains the public key. Generate a new key and CSR and ask your CA to reissue the certificate.