Certificate Key Matcher
Check that a certificate, CSR and private key match — locally.
Runs 100% in your browser — nothing you paste or generate ever leaves your device.
Paste at least two of the three — certificate, CSR, private key. They match when their public keys (SPKI SHA-256) are identical.
Quick answer
Certificate Key Matcher checks in your browser whether a certificate, CSR, and private key share the same public key, so you know they will work together before deploying, with the key never uploaded. It is the fast way to resolve a key-values-mismatch error at server startup.
Certificate Key Matcher confirms that a certificate, a CSR, and a private key all belong to the same key pair, so you can be sure they will work together before you deploy. It runs in your browser, and your private key is never uploaded, which matters because verifying a key means handling the key. Server-side matchers receive your secret; this one compares everything locally and transmits nothing.
The check answers a deceptively simple but very common question: does this private key actually match this certificate. When a server refuses to start with a key-mismatch error, it usually means someone installed a certificate against the wrong key, often after regenerating a CSR or juggling several renewals. This tool compares the public key inside each artifact (the RSA modulus, or the elliptic-curve public point) and tells you at a glance whether they line up, without you having to run OpenSSL commands by hand.
Runs locally, private key never uploaded
The comparison happens in your browser. The tool derives the public key from your private key and from your certificate and CSR, then checks whether they are identical; the private key itself is never sent anywhere. This is essential, because the only way to match a key is to load it, and doing that on a remote server exposes your secret. Locally, you can verify production material safely.
How the match is computed
A certificate, its CSR, and the matching private key all share the same public key. For an RSA pair, that means the same modulus; for an elliptic-curve pair, the same public point, which is compared as the SubjectPublicKeyInfo (SPKI). The tool extracts the public key from each item you provide and compares them. If all present items derive the same public key, they match; if any differs, that item belongs to a different key pair and will fail when deployed together.
What a mismatch tells you
A mismatch means the certificate was not issued from the CSR that goes with the private key you have. The usual causes are a regenerated CSR that was never submitted, a renewal where the new certificate was paired with the old key, or files mixed up between two domains. The fix is to find the private key that actually matches the certificate, or if it is truly lost, reissue the certificate from a fresh CSR whose key you keep.
When to run this check
Run it before every certificate install, and the moment a web or mail server reports a key-mismatch or key-values-mismatch error at startup. It is also the quickest triage when you inherit a pile of .crt and .key files with unclear names: match them here to pair each certificate with its key. Confirming the match locally saves a failed deploy and the downtime a mismatched certificate would cause.
Frequently asked questions
- Is my private key uploaded to check the match?
- No. Everything is compared in your browser and the private key is never transmitted. Because matching a key inherently requires loading it, this local-only design is exactly why you should use it instead of a server-side matcher, which would receive your key on a machine you do not control.
- How does it know a certificate and key match?
- All three artifacts, certificate, CSR, and key, share one public key. For RSA that is the modulus; for ECDSA it is the public point compared as SPKI. The tool derives the public key from each item and checks they are identical. Matching public keys mean the files belong together; a difference means they do not.
- My server says key values mismatch, what do I do?
- That error means the installed certificate and the private key are from different pairs. Use this tool to test your key against the certificate. If they do not match, locate the correct key (often the one generated with the CSR that was actually submitted). If the correct key is lost, reissue the certificate from a new CSR and keep that key.
- Do I need all three files, or just two?
- Two is enough for the common check: certificate plus private key. Add the CSR if you also want to confirm the request that produced the certificate came from the same pair, which is useful right after generating a CSR and before install. Any pair you provide will be compared; all provided items must share the same public key to match.
- Does this work for ECDSA certificates or only RSA?
- Both. For RSA it compares the modulus; for elliptic-curve keys it compares the public point via the SubjectPublicKeyInfo. The principle is identical, that a matching pair shares one public key, so the tool handles modern ECDSA P-256 and P-384 certificates as well as traditional RSA ones.
- Can a certificate match more than one private key?
- No. A certificate binds exactly one public key, and only the single private key that corresponds to that public key will match it. There is no second key that fits. That is why losing the private key means the certificate cannot be used and must be reissued from a fresh key pair.