Certificate ↔ Key Matcher
or drop .crt / .key / .csr files anywhere on this card — each lands in its box automatically
or drop .crt / .key / .csr files anywhere on this card — each lands in its box automatically
Paste (or drop) at least two of: the certificate, the private key, the CSR — each lands in its own box.
If the key is encrypted, enter its passphrase.
Click Compare.
A green verdict means the items share one key pair; a red one names exactly which pair disagrees.
Half of all TLS installation failures come down to one question: does this private key actually belong to this certificate? The classic answer is three openssl commands comparing modulus hashes — this tool does the same comparison in your browser. Paste or drop any two of certificate, private key and CSR, and their public keys are derived and compared byte-for-byte.
It works for RSA and ECDSA keys alike, understands PKCS#8, traditional RSA and SEC1 EC formats, and can open encrypted keys if you supply the passphrase — all locally. The private key is the one file that must never travel; here it never does.
100% private“The comparison derives public keys locally and never transmits anything — the private key, certificate and CSR all stay in this browser tab. This is precisely the check you should never do on a website that uploads your key.”
Every certificate and CSR embeds the public key; every private key contains enough information to recompute its public half. The tool derives all of them as DER-encoded SubjectPublicKeyInfo blocks and compares the bytes — identical bytes means the same key pair, guaranteed.
Find the right key: check for older .key files from the same order, or the CSR you originally submitted (if the CSR matches the certificate, the key that made that CSR is the one you need). If it is truly lost, generate a new CSR and have the certificate reissued — no tool can reconstruct a missing private key.
When a CA order went through months ago, the CSR is the paper trail: certificate ↔ CSR mismatch means the CA issued from a different request than you think; CSR ↔ key mismatch means you are holding the wrong key file. Testing all three pinpoints where the mix-up happened.