Key ↔ Certificate Matcher

About this tool

The Key and Certificate Matcher compares a PEM private key with a PEM certificate and tells you whether the two belong together. It derives the public key from the private key you paste, compares it with the public key embedded in the certificate, and reports a match or a mismatch.

This is the check that saves a failed maintenance window. When a renewal arrives it is easy to install a new certificate against the old key, and the symptom is a service that will not start or a handshake that fails with an unhelpful error at two in the morning. The comparison runs entirely in your browser — neither file is uploaded. If you would rather not paste a production key into a browser, compare the two moduli locally with openssl instead; our server support team can help you build that into your process.

How to use it

Paste both files and select Check match. Reading the result:

• Paste the full certificate, including its BEGIN and END lines, into the certificate box.
• Paste the full private key into the key box. It must be unencrypted; a passphrase-protected key has to be decrypted first.
• A match means the certificate was issued for this key pair and the two can be installed together.
• A mismatch means they are unrelated — wrong key, wrong certificate, or a certificate issued from a different CSR than you assumed.

Common questions

Do I have to upload my private key?

No. The check runs entirely in your browser and nothing you paste is transmitted to us. Treat any private key with care regardless of the tool: if the key is in production and you have shell access, running the equivalent openssl comparison on the server avoids putting it into a browser at all.

What does a mismatch actually mean?

That the public key inside the certificate is not the one derived from your private key, so the certificate was issued against a different CSR. It is not a fault in either file. Find the key generated alongside the CSR used for this order, or generate a new pair and have the certificate reissued.

Can I check the certificate chain here as well?

No, this tool compares one certificate against one key. Chain problems are separate and usually appear as untrusted-issuer errors rather than handshake failures. Decode each certificate individually to identify the leaf and the intermediates, then order the chain file leaf first.