Certificate and Private Key Matcher

Confirm a certificate and a private key belong together before you deploy them. Both stay in your browser - the key is never uploaded.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Certificate, CSR or public key

Or drop the certificate file

Read in your browser.

Private key Never sent anywhere. Parsed locally, only far enough to derive the public half.

Or drop the key file

Read in your browser. Never uploaded.

It compares the key material, not the metadata

This answers one question: were this certificate and this private key generated as a pair? It answers it by deriving the public key from the private key and comparing it with the public key inside the certificate - the actual numbers.

RSA - the modulus and the public exponent.
EC - the public point, on the same named curve.

That distinction matters more than it sounds. Two different 2048-bit RSA keys are identical by every superficial measure: same algorithm, same size, same file shape, often adjacent filenames from the same directory. Nothing about the metadata tells them apart, and that is precisely the situation this tool exists for - the deploy where server.key and server-new.key both look plausible.

The private key never leaves your browser

There is no server endpoint behind this page. The key is parsed locally, and only far enough to derive its public half - the private components are never displayed, exported, or retained after the comparison. Nothing is written into a URL, into storage, or into any request. A private key in a query string would end up in browser history and in every proxy log along the path, which is why this page does not have one.

The Clear everything button wipes both boxes and the result together, because a private key left in a textarea on an unattended screen is exactly the risk worth being careful about.

What "no match" usually means

Almost always the wrong file. The common causes are a key from a superseded CSR, a key regenerated after the CSR was submitted, a certificate issued from someone else's CSR, or simply two similar filenames. The symptom in production is a server that refuses to start with a message like "key values mismatch", or an nginx configuration test failure - and if it does start, TLS handshakes fail and the site is unreachable.

If the matching key genuinely cannot be found, the certificate is unusable. There is no way to recover it: generate a new key and CSR with CSR Decoder and Validator to check the result, and have the certificate reissued.

Encrypted keys

This tool does not accept passphrases, and deliberately so - asking for one would mean handling a passphrase alongside a key, and there is no need. An encrypted key is detected and named as encrypted, with the command to decrypt it yourself first:

openssl pkcs8 -topk8 -nocrypt -in encrypted.key -out plain.key

Both the classic OpenSSL format (with Proc-Type and DEK-Info headers) and encrypted PKCS#8 are recognised, so you get a useful message rather than a parse error.

What is supported

Certificates - X.509 in PEM or DER.
CSRs - PKCS#10, so you can check a key against a request before submitting it.
Keys - PKCS#8, PKCS#1 (RSA) and SEC1 (EC), unencrypted.
Algorithms - RSA and EC (P-256, P-384, P-521, secp256k1).

One honest limitation: a PKCS#8 EC key may omit the public point. Deriving it then requires scalar multiplication on the curve, which this tool does not implement - doing elliptic curve arithmetic badly is worse than declining to do it. In that case it says so and gives you the one-line conversion that adds the public key back.

Frequently asked questions

Is my private key uploaded?

No. There is no server endpoint behind this page. The key is parsed in your browser, only enough to derive the public half, and nothing is transmitted or stored.

Why not just compare the key sizes?

Because every 2048-bit RSA key has the same size. Size, algorithm and filename all match between unrelated keys - the only reliable comparison is of the key material itself, which is what this does.

It says my encrypted key is not supported. Why not just ask for the passphrase?

Because then the tool would be handling your passphrase as well as your key, for no benefit. Decrypting it yourself first with openssl keeps both under your control, and the page gives you the exact command.

Can I check a key against a CSR rather than a certificate?

Yes. Paste the CSR in the first box. That is often the more useful check, since it catches the mismatch before you submit the request.

My EC key gives an "could not derive public point" result.

That is a PKCS#8 EC key with no embedded public key. Run openssl ec -in key.pem -pubout and compare the resulting public key with the certificate instead.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.