Certificate Key Matcher: Free SSL Key Check

A certificate key matcher checks whether an SSL/TLS certificate and a private key, or a certificate and a CSR, belong to the same key pair. Paste your PEM text, pick what to compare, and the tool answers Match Found or No Match. It also shows the expiry date, key size and domain names, so you can catch install problems before they reach production.

What Is a Certificate and Private Key Match?

A certificate and private key match when the public key inside the certificate was generated from that exact private key. The two are mathematically linked halves of one key pair, and a server can only complete a TLS handshake when it holds both halves of the same pair.

The certificate is public. It carries the public key, the domain names it covers, the issuer, and the validity dates. The private key is the secret half and never leaves your server. A CSR (certificate signing request) sits in between: you create it from a private key, and it carries the matching public key plus your organization details. The certificate authority signs that public key and returns your certificate.

Certificate vs private key: why they get mixed up

Most mismatches happen because several keys exist for one domain. You may have generated a new key and CSR when you reissued the certificate, but the web server still points to the old key file. The certificate is perfectly valid, yet it does not belong to the key the server is loading. A match check is the fastest way to prove which file goes with which.

What a match does not prove

A match only proves the two items belong together. It does not prove the certificate is trusted by browsers, that the chain is complete, or that the hostname is right for your site. For those questions, a decoder helps, such as the Certificate Decoder.

How to Use the Certificate Key Matcher

You can run a check in under a minute with the fields on this page. Have your PEM files open in a text editor first.

1. Under What to check?, choose Certificate + Private Key to confirm an installed pair, or Certificate + CSR to confirm that a signed certificate came from your request.
2. Paste your server certificate into the Certificate (PEM) box, including the lines that start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.
3. If you chose the private key option, paste the key into Private Key (PEM). It begins with -----BEGIN PRIVATE KEY----- or a similar header.
4. If you chose the CSR option, paste the request into CSR (PEM). It begins with -----BEGIN CERTIFICATE REQUEST-----.
5. Click Check Match.
6. Read the headline result, then scroll through the Certificate Details, the Private Key Details or CSR Details, and the Submitted Data box to confirm you pasted the right files.

All three text boxes expect PEM text. If your files are in another format, such as DER or PFX, convert them to PEM first.

Worked Example: A Reissued Certificate That Will Not Install

Say you renewed the certificate for www.example.com and your Nginx server now refuses to start with a key mismatch error. You have two key files in the folder: one from last year and one from the reissue.

Select Certificate + Private Key, paste the new certificate, paste the first key file, and click Check Match. The tool returns No Match with the message that the certificate and private key do not match. You paste the second key instead, and the result changes to Match Found.

The Certificate Details then show a Common Name of www.example.com, a Key Type of RSA, a Key Size of 2048 bit, and 45 days remaining on the Valid To line. The Private Key Details show the same RSA 2048 bit values. You now know the second file is the right one, and the 45-day note tells you that renewal is approaching. Point your server configuration at the second key and reload.

How to Read and Act on the Results

The result block answers one question first: do the two items match? Everything below it helps you confirm the details are what you expect.

Certificate details to check

The details panel lists the Common Name, organization, issuer, Valid From and Valid To dates, key type, key size, signature algorithm, serial number, Subject Alternative Names and SHA-256 and SHA-1 fingerprints. Check that the Subject Alternative Names list includes every hostname you plan to serve, because browsers rely on those names rather than the Common Name.

Expiry warnings

The Valid To line shows how many days remain. A certificate with 30 days or fewer, or one already expired, is highlighted in red. One with 31 to 90 days left is highlighted in amber. Plan renewal while you are still in the amber range, so a slow validation step does not cause an outage.

Key size and type

Key size is shown in bits, and key type is RSA, EC, DSA or DH. For RSA, 2048 bits is the widely used minimum for public websites, and 3072 or 4096 bits are common for higher-security needs. Elliptic curve keys are much shorter, since a 256-bit EC key offers strength comparable to RSA 3072. Do not treat a smaller number as a defect when the type is EC. If the certificate and key show different sizes or types, that alone explains a mismatch.

CSR checks

In the CSR mode, the CSR Details show the Common Name, organization, location, key type and key size. If the CSR names a different domain than the certificate, you probably submitted the wrong request to your certificate authority. You can inspect any request in more depth with the CSR Decoder.

When to Use a Certificate Key Matcher

The tool is most useful at the moments when a wrong file would cost you time or uptime.

• Installing a new certificate: confirm the file the authority sent matches the key already on your server before you touch the live configuration.
• Renewals and reissues: prove which of several key files belongs to the new certificate.
• Server migrations: check that the certificate and key you copied to the new host survived the transfer intact.
• Load balancers and CDNs: confirm the pair before uploading to a control panel that only shows a vague "invalid certificate" message.
• Auditing an old folder: sort through a directory of unlabeled .pem, .crt and .key files and label them correctly.
• Support work: verify a client's files without logging in to their server.

If you have not requested a certificate yet, create the request first with the CSR Generator, and keep the private key it produces in a safe place.

Best Practices and Troubleshooting

Most surprising results come from what was pasted rather than from the files themselves. Work through these checks before you assume the certificate is bad.

• Paste only the server certificate. A chain file holds the intermediate and root certificates too. The leaf certificate (the one for your domain) is what should be compared to your key. An intermediate certificate will always show No Match.
• Include the full header and footer lines. Dropping a dash or the final line makes the text unreadable, and the result will say No Match.
• Watch for stray characters. Extra spaces, smart quotes added by a word processor, or a line break in the middle of the encoded text can break parsing. Copy straight from the file in a plain-text editor.
• Check for a passphrase. There is no field for a key password, so a passphrase-protected key may be reported as No Match even when it belongs to the certificate. Test with an unencrypted copy of the key and keep the original protected.
• Do not mix up the modes. If you chose Certificate + CSR but pasted a key, the tool will complain that the CSR is missing or report No Match.
• Use the Submitted Data section. The result page repeats exactly what was read, so you can spot an old certificate or the wrong key at a glance.

If a pair matches here but your server still fails, the cause is usually elsewhere: a missing intermediate certificate, a wrong file path, a stale configuration that was never reloaded, or a hostname that is not in the Subject Alternative Names. If you need to see what a request claims before sending it, the Check CSR page is another useful stop.

Limits to Keep in Mind

This page compares one certificate with one key or one CSR at a time. It does not test your live website, follow the chain to a trusted root, check revocation, or confirm that your DNS points where you expect. A Match Found result means the files are a compatible pair, nothing more.

Treat private keys with care. Anyone who holds a private key can impersonate your site, so use test or expired keys when you can, and consider replacing any key you pasted into a shared screen or a ticket. Learn more about related utilities in the Security & Encryption Tools category.

Matching the right files before you deploy saves hours of guessing at cryptic server errors. Paste your certificate and key or CSR into the boxes above, click Check Match, and you will know within seconds whether the pair is ready to install.