Certificate-Key Matcher

Find out whether your certificate, CSR and private key belong together before you install them. The comparison runs in your browser, so the private key never leaves your device.

Short answer

The Certificate-Key Matcher checks whether a private key, an SSL certificate and a CSR belong to the same key pair by comparing their public keys. It supports RSA and ECDSA, accepts password-protected keys and certificate chains, and runs entirely in your browser, so your private key is never uploaded or stored.

Last updated: 2026-10-18

What does it mean for a certificate and key to match?

They match when they were created from the same key pair: a certificate holds the public key, and only the private key that was generated with it can work with that certificate. If the pair differs, the server cannot complete the HTTPS handshake.

The tool reads the public key from your certificate and your CSR, derives the public key from your private key, and compares them. Items that share a key pair get the same group letter and the same short fingerprint; items with different keys get different groups. A CSR is included because it carries the public key you asked the CA to certify.

How do I check a certificate, CSR and key?

Paste at least two of the three items and press the button; the verdict appears at the top.

Paste the certificate (PEM) into the first box. A whole chain is fine: the end-entity certificate is picked automatically.
Paste the CSR into the second box, if you have it.
Paste the private key into the third box, or open the files directly. If the key is encrypted, enter its password.
Press Check match.
Read the verdict: Match means one key pair; No match shows which items differ.

You can also paste a public key instead of the private key, which lets you check a pair without ever pasting the secret half.

Why do a certificate and key not match?

A mismatch almost always comes from mixing files from different orders. These are the usual causes.

The key is from a different CSR: you generated several CSRs and kept the wrong key.
A reissue or renewal created a new key, and the old key is still installed.
The control panel created its own key, while you ordered with a CSR made elsewhere.
The certificate is for another domain or server than the key you are looking at.

On the server this appears as an error such as key values mismatch when Nginx or Apache starts. The fix is to find the key created together with your CSR, or to generate a new key and CSR with the CSR Generator and ask your CA to reissue the certificate. Inspect any certificate in detail with the Certificate Decoder.

Is it safe to paste my private key here?

The page compares keys locally and has no code that sends anything to a server; nothing is stored in cookies, browser storage or the address bar. You can verify this with your browser developer tools by watching the Network tab. Even so, treat a private key as a secret: use a computer you trust, press Clear when you finish and close the tab.

If you would rather never paste the key, run this on the server: openssl pkey -in private.key -pubout. Paste that public key instead. For RSA you can also compare the modulus hashes with OpenSSL, as the commands on the page show. For other conversions, use the SSL Converter.

Frequently asked questions

Does the tool send my private key anywhere?

No. The comparison is done by JavaScript inside your browser tab, and the tool contains no code that uploads keys, certificates or passwords. Nothing is saved in cookies, browser storage or the address bar. You can confirm this in your browser developer tools by watching the Network tab while you check, then press Clear and close the tab.

Can I check a match using only a public key?

Yes. Paste the public key (a block that starts with BEGIN PUBLIC KEY) into the key box instead of the private key. You can extract it on the server with openssl pkey -in private.key -pubout. The tool then compares it with your certificate and CSR, so the secret half of the key never leaves the server.

What if my private key is password-protected?

Enter the password in the key password field and check again. The tool opens common encrypted RSA and ECDSA keys. If your key uses an encryption it cannot open, extract the public key on the server with openssl pkey -in encrypted.key -pubout and paste that instead.

Which key types does it support?

It supports RSA and ECDSA (P-256, P-384 and P-521) keys in certificates, CSRs and private keys, in PEM format as PKCS#1, PKCS#8 or SEC1. Ed25519 keys are compared where your browser supports them. PFX and PKCS#12 files are not read here; convert them to PEM with the SSL Converter first.

Why does Nginx or Apache say the key values mismatch?

It means the private key file does not belong to the certificate file the server was told to use. Run this tool with your certificate and key to confirm, then locate the key created with your CSR. If it is lost, generate a new key and CSR and ask your CA to reissue the certificate.