Key Matcher: Verify Key & Certificate Match
Verify that your private key matches your SSL certificate or CSR. Prevent "Key Mismatch" errors during installation.
📖 Learn more: How to check if a private key matches a certificate
Match Keys
Why Match Keys?
Before installing an SSL certificate, you must ensure that the private key matches the certificate. A mismatch will cause installation errors and prevent your SSL from working.
Common Scenarios:
- Verify private key matches certificate before installation
- Check if private key matches CSR before submitting to CA
- Troubleshoot "Key Mismatch" errors
How to Check if a Private Key Matches a Certificate
- Paste your private key, including the
-----BEGIN ... PRIVATE KEY-----and-----END ... PRIVATE KEY-----lines, into the first box. - Paste the certificate or CSR you want to compare into the second box.
- Click Check Match.
- If the keys match, you can install the certificate with that key. If not, find the key that was generated with the CSR for this certificate.
How Key Matching Works
Every private key has exactly one matching public key. A certificate and a CSR both contain a public key. The Key Matcher derives the public key from your private key, extracts the public key from the certificate or CSR, and compares the two. If they are identical, the files belong together. RSA, DSA and ECC keys are supported.
You can run the same check yourself with OpenSSL by comparing the output of openssl pkey -in private.key -pubout with openssl x509 -in certificate.crt -pubkey -noout; matching output means matching keys.
What to Do When Keys Don't Match
- Search the server where you generated the CSR. The matching key is usually in the same directory, often named after the domain.
- Check for a renewed certificate. If you generated a new CSR at renewal, the new certificate needs the new key, not the old one.
- Check the order of a combined file. If a PEM bundle contains several certificates, compare your key against the server certificate, not an intermediate.
- Reissue if the key is lost. Generate a new key and CSR and ask your CA to reissue the certificate.
Frequently Asked Questions
How does the Key Matcher work?
It derives the public key from your private key and compares it with the public key inside your certificate or CSR. If the two public keys are identical, the private key and certificate belong to the same key pair.
What is a 'key mismatch' error?
A key mismatch error means the private key configured on your server does not correspond to the public key in the SSL certificate. Web servers such as Apache and Nginx refuse to start with a mismatched pair.
Is it safe to paste my private key here?
Keys are compared in memory and are never logged or stored, as described in our privacy policy. For production keys under strict security policies, you can run the OpenSSL commands shown above locally instead.
Can I match a private key against a CSR?
Yes. Paste the CSR into the second box. This is a good check to run before submitting the CSR to a Certificate Authority.
Does it support ECC keys?
Yes. RSA, DSA and ECC (elliptic curve) keys are supported. The result also shows which key type was detected.