About Certificate Key Matcher
This free tool checks whether a private key, a CSR and a certificate belong together. Paste any two or all three and it compares the public key inside each one: a certificate matches a private key when it holds the public half of that key. Each item gets a short key ID so you can see which one is the odd one out.
It accepts PKCS#8 keys as well as the older RSA and EC private key formats, for both RSA and ECDSA. It is the quick answer to the classic “key values mismatch” error from Nginx, Apache or IIS. The check runs in your browser and nothing is uploaded.
How to use Certificate Key Matcher
- 01
Paste any two or all three: private key, CSR, certificate.
- 02
Click Check.
- 03
See whether they match and each item’s key ID.
When to use it
- Fixing a “key values mismatch” or “private key does not match” server error.
- Finding the right key among several old ones.
- Checking a certificate from your CA against the CSR you sent.
- Verifying files before building a PFX.
- Auditing certificate and key pairs on a server.
Frequently asked questions
How does the matching work?
It compares the public key in each item. A matching certificate holds the public half of the private key.
Which private key formats work?
Unencrypted PEM keys: PKCS#8 and the older RSA and EC formats. Remove a password from a key first.
Is my private key uploaded?
No. The comparison runs in your browser.