# Certificate Key Matcher: Does My Key Match the Certificate?

> Check whether a certificate, CSR and private key belong together by comparing public keys in your browser. Fixes key values mismatch.

Source: https://ssl.sh/tools/key-matcher/
Last updated: 2026-11-10

Paste a certificate, CSR and private key (any two) to check that they contain the same public key. Runs locally; keys are not uploaded.

The key matcher tells you whether a certificate, a CSR and a private key belong to the same key pair. Paste any two or all three and press **Compare**: the tool extracts the public key from each, compares them and shows a clear match or mismatch. The comparison runs in your browser; the private key is not uploaded.

## How to use it

1. Paste the certificate (`BEGIN CERTIFICATE`), the CSR (`BEGIN CERTIFICATE REQUEST`) and/or the private key (`BEGIN PRIVATE KEY`, `BEGIN RSA PRIVATE KEY` or `BEGIN EC PRIVATE KEY`). Files can be chosen too.
2. If the key is encrypted, enter its password.
3. Press **Compare**. Each row shows the key type and the SHA-256 hash of the public key; equal hashes mean a match.

## When to use it

- Nginx refuses to start with `SSL_CTX_use_PrivateKey ... key values mismatch` (see [nginx key values mismatch](https://ssl.sh/errors/nginx-key-values-mismatch/)).
- Apache logs `AH02565: Certificate and private key ... do not match`.
- A hosting panel or cloud console rejects the uploaded certificate and key.
- After renewal you are not sure which of several `.key` files is current.

## How matching works

For RSA keys the tool compares the modulus; for ECDSA keys, the curve and public point; for Ed25519, the 32-byte public key. For a private key the public key is derived from the private key data. The hash shown is the SHA-256 of the SubjectPublicKeyInfo, the same value used by HPKP pins and TLSA `3 1 1` records.

## If they do not match

The certificate was most likely issued for a different CSR, or the key file was overwritten by a later CSR. Find the key that created the CSR you submitted; if it is lost, generate a new key and CSR with the [CSR generator](https://ssl.sh/tools/csr-generator/) and ask the CA to reissue the certificate (most CAs allow free reissues).


## FAQ

**Why compare public keys instead of names?**

Names can be identical across many certificates and keys. Only the public key ties a certificate to its private key: if they differ, the server cannot complete the handshake.

**I have several .key files on the server. How do I find the right one?**

Paste the certificate once and try each key in turn, or compare hashes on the server with openssl x509 -noout -pubkey -in cert.pem | openssl sha256 and openssl pkey -pubout -in key.pem | openssl sha256.

**Can I check an encrypted private key?**

Yes, for encrypted PKCS #8 (BEGIN ENCRYPTED PRIVATE KEY) and legacy encrypted RSA keys. Enter the password; it is used only in your browser.