SSL Tool

Certificate Key Matcher

Paste your SSL certificate and private key to verify they are a matching pair. Mismatched keys cause SSL handshake errors on your server.

Frequently Asked Questions

What does the certificate key matcher check?

The tool verifies that an SSL certificate and a private key are a matching pair by comparing their modulus values. If the certificate was not generated from that private key, the modulus values will differ and the tool reports a mismatch — saving you from installing a misconfigured SSL setup.

When would a certificate and private key not match?

A mismatch occurs if you generated a new CSR with a new private key after your original CSR was submitted, if the wrong certificate file was downloaded from your certificate authority, or if files were accidentally renamed or mixed up during the installation process.

Is it safe to paste my private key into this tool?

All processing is done locally in your browser — your private key is never sent to our servers. However, as a general security principle, avoid exposing private keys unnecessarily. Consider using the tool only with test certificates or in a secure, isolated environment.

Why does certificate and key mismatch happen?

A mismatch usually happens when a new certificate is issued but installed with an old private key, or when the wrong certificate file is used. The certificate must be issued for the specific private key used to generate the CSR.

Is my private key secure if I paste it here?

The check runs entirely server-side using PHP OpenSSL. Your private key is never logged or stored. However for maximum security, use a local tool like OpenSSL: openssl x509 -noout -modulus -in cert.pem | md5sum and compare with: openssl rsa -noout -modulus -in key.pem | md5sum

What happens if they do not match?

Your web server will fail to start or throw an SSL handshake error. Visitors will see certificate warnings. Fix by obtaining a new certificate with a CSR generated from your actual private key.

Related SSL tools: SSL Checker CSR Generator CSR Decoder SSL Converter All SSL Tools

Why a certificate must match its key

An SSL certificate contains a public key, and it only works with the private key generated alongside it. Install a certificate with the wrong key and the web server refuses to start, or visitors get connection errors. It happens more often than you would expect: after a certificate is reissued, when several requests were generated, or when files are copied between servers and renamed.

How the match is checked

The certificate and the private key both contain the same public-key values, for RSA the modulus. If they are identical, the pair belongs together. You can run the same check locally without the key leaving your server: openssl x509 -noout -modulus -in cert.pem | openssl md5 and openssl rsa -noout -modulus -in key.pem | openssl md5 should print the same value.

A word on private keys

A private key is the one secret that protects your site's HTTPS. Only paste it into a tool you trust, and for keys that protect live production sites, the OpenSSL commands above are the safest option.

When to check

Before installing a renewed or reissued certificate.
When the server will not start after a certificate change. Nginx, for example, reports a key values mismatch error.
When you have several key files and are not sure which belongs to which certificate.
Check the chain order too: your certificate first, then the intermediates. The SSL checker confirms the chain once it is live.