SSL Certificate Key Matcher

What is SSL Certificate Key Matcher?

SSL Certificate Key Matcher answers the classic deploy-night panic question: does this private key actually belong to this certificate? Paste a mixed PEM bundle — a key, one or more certificates, a CSR, a whole fullchain.pem — and every block is classified, then each key is cryptographically compared against each certificate and CSR. Mismatches lead with the negative wording, because "key does not match certificate" is the query that brings people here.

What "matching" means

A certificate and a private key match when the public key inside the certificate is the public half of that private key pair. The tool imports the private key with WebCrypto, exports the public components (RSA modulus and exponent, or EC curve point), and compares them against the public key extracted from each certificate and CSR. Identical components = same key pair. This is exactly what the classic openssl recipe checks, modernized:

```bash

openssl rsa -modulus -in server.key -noout | openssl md5

openssl x509 -modulus -in server.crt -noout | openssl md5

openssl req -modulus -in server.csr -noout | openssl md5

```

Identical hashes = match. The tool does the same comparison for RSA, ECDSA and Ed25519 keys, without a terminal.

Key formats understood

PKCS#8 (PRIVATE KEY), traditional PKCS#1 RSA (RSA PRIVATE KEY) and SEC1 EC (EC PRIVATE KEY) keys are all read — legacy formats are re-wrapped to PKCS#8 locally. Certificates and CSRs are parsed per block, so a fullchain.pem (leaf + intermediates + root) pasted together with its key classifies correctly: CA certificates group under a neutral "not expected to match" section instead of showing up as failures.

Encrypted and OpenSSH keys

ENCRYPTED PRIVATE KEY blocks, Proc-Type: 4,ENCRYPTED legacy keys and OpenSSH-format keys are detected and reported with the exact remedy — decrypt with openssl rsa/openssl pkcs8, or convert with ssh-keygen -p -m PKCS8 -f <key>. Encrypted keys are never attempted.

What a match does NOT mean

A match only proves the key and certificate share the same public key. It says nothing about expiry, hostname coverage or chain trust — use the [Certificate Decoder](/certificate-decoder) for those checks.

Privacy

Everything runs in your browser with WebCrypto. Private keys never leave this page, never appear in errors or analytics, and nothing is stored — closing the tab wipes everything.