Certificate and Key Matcher

Check that a private key, a certificate and a CSR share the same key pair. The key is read in your browser and never sent anywhere.

Everything is compared in your browser; the private key never leaves this page. Still, prefer a test key, or compare with openssl locally (commands below).

Certificate (PEM)

Private key (PEM)

CSR (PEM, optional)

openssl x509 -in cert.pem -noout -pubkey | openssl sha256
openssl pkey -in key.pem -pubout | openssl sha256
openssl req -in request.csr -noout -pubkey | openssl sha256
# the same hash = the same key pair

Check a live site

The SSL Certificate Checker reads the certificate your server actually sends, its chain, revocation, CAA and renewal health.

Open the SSL Certificate Checker