Certificate and Private Key Matcher
Check whether an SSL certificate and a private key belong together before you install them — a mismatch is a common cause of servers that refuse to start.
How it works
How the match is checked
Same public key
A certificate contains a public key. It matches a private key when the public key derived from that private key is identical.
Typical mix-ups
Renewing with a new CSR creates a new key; installing the new certificate with the old key fails.
FAQ
Frequently asked questions
Is my private key sent to the server?
Yes, for this check, and it is not stored. You can also compare locally: openssl x509 -noout -modulus and openssl rsa -noout -modulus must print the same value.
What do I do if they don't match?
Find the key that was created with the CSR for this certificate, or create a new CSR and reissue the certificate.
More free tools
All toolsSSL CheckerCheck a site's certificate, chain, expiry and TLS versions.Security Headers CheckerGrade a site's HTTP security headers from A+ to F.CAA Record GeneratorChoose which certificate authorities may issue for your domain.SSL ToolsGenerate CSRs, decode certificates, build chains, match keys.CSR GeneratorCreate a certificate signing request and private key.Certificate DecoderDecode a PEM certificate: names, issuer, validity, key.SSL Chain BuilderFetch missing intermediates and build a full certificate chain.DNS LookupQuery A, AAAA, MX, TXT, NS, CAA and more from public resolvers.
SSL certificates from free DV to EV
SSL Certificates DV, OV and EV from trusted CAs