Certificate / Key Matcher
Confirms a private key really belongs to a certificate — the check worth doing before a failed deploy proves it for you.
What this tool does
Confirms that a private key really belongs to a given certificate or CSR. It derives the public key from the private key using the Web Crypto API and compares it with the public key embedded in the certificate — for RSA the modulus and exponent, for EC the curve and public point.
Both files are processed in your browser. The private key is never transmitted.
How to use it
Paste the certificate or CSR in the first box and the private key in the second, then press Check match. If the certificate is already live, type the domain and press Fetch from a domain — the server opens a TLS connection and drops the certificate it serves into the first box, so you can check the key you are about to deploy against the one already installed.
Modern PKCS#8 keys (BEGIN PRIVATE KEY) and legacy PKCS#1 RSA keys (BEGIN RSA PRIVATE KEY) are both supported. SEC1 EC keys and password-encrypted keys are not — convert them first with openssl pkcs8 -topk8 -nocrypt.
Reading the result
The verdict is binary. MATCH means the key can serve that certificate. NO MATCH means it cannot, and no configuration change will make it work — you need the correct key, or a re-issue against the key you have.
Common problems
- "This key is password-encrypted". Decrypt it first:
openssl pkcs8 -in key.pem -out plain.key. - "SEC1 EC PRIVATE KEY isn't parsed here". Convert:
openssl pkcs8 -topk8 -nocrypt -in key.pem -out key8.pem. - Type mismatch. An RSA key can never match an EC certificate. One of the two is from a different issuance.
- No match after a renewal. Common when a renewal generated a fresh key while the server still points at the old one.