Certificate and private key matcher

The key matcher tells you whether a certificate, a CSR and a private key belong to the same key pair. Paste any two or all three and press Compare: the tool extracts the public key from each, compares them and shows a clear match or mismatch. The comparison runs in your browser; the private key is not uploaded.

How to use it

1. Paste the certificate (BEGIN CERTIFICATE), the CSR (BEGIN CERTIFICATE REQUEST) and/or the private key (BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY or BEGIN EC PRIVATE KEY). Files can be chosen too.
2. If the key is encrypted, enter its password.
3. Press Compare. Each row shows the key type and the SHA-256 hash of the public key; equal hashes mean a match.

When to use it

• Nginx refuses to start with SSL_CTX_use_PrivateKey ... key values mismatch (see nginx key values mismatch).
• Apache logs AH02565: Certificate and private key ... do not match.
• A hosting panel or cloud console rejects the uploaded certificate and key.
• After renewal you are not sure which of several .key files is current.

How matching works

For RSA keys the tool compares the modulus; for ECDSA keys, the curve and public point; for Ed25519, the 32-byte public key. For a private key the public key is derived from the private key data. The hash shown is the SHA-256 of the SubjectPublicKeyInfo, the same value used by HPKP pins and TLSA 3 1 1 records.

If they do not match

The certificate was most likely issued for a different CSR, or the key file was overwritten by a later CSR. Find the key that created the CSR you submitted; if it is lost, generate a new key and CSR with the CSR generator and ask the CA to reissue the certificate (most CAs allow free reissues).