Certificate Key Matcher
🔒 In your browserCheck a certificate, private key & CSR belong together.
How it works
Before installing a certificate, confirm it actually belongs to your private key — a mismatch is the most common cause of "key values mismatch" errors in Nginx and Apache. Paste any two of the three and we compare the public key inside each.
It works by comparing the RSA modulus (or EC public point) — the same thing openssl rsa -modulus prints, just without the typing.
Encrypted keys must be decrypted first: openssl pkcs8 -topk8 -nocrypt -in key.pem -out pkcs8.pem
🔒 Parsed with the Web Crypto API in your browser — the certificate, CSR, and especially your private key are never uploaded.
🔒 Parsed in your browser: certificates, CSRs and private keys are decoded locally with the Web Crypto API and are never sent to a server — unlike most online SSL tools, which ask you to upload them. Still, treat any private key you paste online as sensitive.
About the Certificate Key Matcher
Installing SSL fails if the certificate, private key and CSR don't belong together. This free certificate key matcher confirms they match — by comparing their public-key fingerprints — before you deploy, saving you a broken HTTPS setup.
Everything is compared in your browser; your private key never leaves your device.
How the matcher works
- Paste any two or three of: certificate, private key and CSR.
- The tool derives and compares their public keys.
- A match means they belong together and will install correctly.
Why matching matters before you deploy
A web server only serves HTTPS correctly if the installed certificate corresponds to its private key. If they don't match — easy to mix up when juggling several domains or renewals — TLS fails and the site goes down. Checking the certificate, key and CSR all derive from the same key pair before you deploy avoids a broken-HTTPS outage.
Frequently asked questions
Why check that a certificate and key match?
A web server only serves HTTPS correctly if the installed certificate corresponds to its private key. Mismatched files cause TLS to fail, so it's worth checking before deploying.
How does it compare them without my key leaving the browser?
It computes the public key from each input locally and compares those. Your private key is processed only in your browser and never uploaded.
Is it safe to paste a private key?
The tool works entirely locally, but as a rule treat any private key as sensitive and avoid pasting production keys into online tools when you can test another way.
How can it compare my private key without uploading it?
It derives the public key from each input locally and compares those. Your private key is processed only in your browser and never sent anywhere. Even so, treat production private keys with care.
Related searches
Learn more
Related Networking tools
🔗 Embed this tool on your website — free
Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.
<iframe src="https://toolhq.dev/embed/certificate-key-matcher/" title="Certificate Key Matcher — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>Optional: auto-resize the iframe height
Add this once on the same page so the iframe grows to fit the tool:
<script>
addEventListener("message", function (e) {
if (e.data && e.data.type === "toolshub:resize") {
document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
});
}
});
</script>